Editing WoW:API loadstring (section)

=== Protecting the global environment ===

Lua can manipulate the environment that a function gets to see with [[API setfenv|setfenv]](). It is however important to remember that already-existing functions that the code is allowed to call retain their original environments, so e.g. giving protected code access to the standard [[API setglobal|setglobal]]() is probably not a good idea.

 local func = assert(loadstring([[
   print( 
     format("format is %s", tostring(format)) 
   );
   print("setglobal is "..tostring(getglobal("setglobal")));
 ]]));
 local smallenv = {format=format, tostring=tostring, getglobal=getglobal};
 smallenv.print = function(msg) DEFAULT_CHAT_FRAME:AddMessage(msg); end
 
 setfenv(func, smallenv);
 func();

Note how we're using the <nowiki>"[[", "]]"</nowiki> quoting style here. Such strings can span multiple lines. The above could of course also be written in a single line with regular quotes; it's just an example.

The above code cannot manipulate anything in the global environment. All it has access to is what we give it. It will output something like this in the default chat frame:
 format is function:00127436
 setglobal is nil

If the protected code modifies its environment, e.g. to return values out, we can examine the changes via looking at "smallenv". E.g. if the protected code does <code>greeting = "So long and thanks for the fish";</code>, we get hold of it via accessing <code>smallenv.greeting</code>.