Can you trust "loadstring" on all compiled platforms

Hi just checking that in Corona you can use the LUA loadstring command to generate functions at run time on all platforms ?

Example

    f = assert (loadstring (“print ‘hello, world’ return 5”))

    print (f ()) 

    Output:

    hello, world

    5

Any gotchas ?

I appear to have answered my own question. From Corona documentation;

The basic Lua library provides several core functions. For security reasons, the dofile(), load(), loadfile(), and loadstring() functions are not available in Corona.

This is an interesting question.

From what I remember, Apple used to reject/remove all apps that used interpreted code. They especially didn’t want apps to have the ability to download external code and run it. Since 2017 or so, they relaxed the restrictions, see App Store Review Guidelines point 2.5.2 (https://developer.apple.com/app-store/review/guidelines/#software-requirements), it says:

2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the Application completely viewable and editable by the user.

Apple isn’t as strict when it comes to use of interpreted code anymore, but there are clear limitations as to what can be done with it. So, depending on your use case, the use of loadstring() and others could be allowed within Apple’s new rules. However, I am not sure if Corona’s documentation is outdated (I am betting on the documentation being outdated) or if Corona is still blocking those particular functions from running on iOS builds.

Additionally, here’s Rob discussing this very topic on another thread https://forums.coronalabs.com/topic/72285-how-does-it-work-today-can-downloaded-lua-be-loaded-dynamically/

In Rob’s very last post on the thread, he says: "Apple has eased some of these restrictions and we’ve enabled the loadstring() Lua API to dynamically execute some Lua after the fact."

So, it sounds to me like loadstring() does work on all platforms. I am not sure about what Rob is referring to by the dynamically executing some Lua using loadstring(), i.e. is there something it won’t execute? Maybe someone else could chime in? @Rob, perhaps? :smiley:

Anyway, TLDR, it mostly depends on what you are using loadstring() for, but yes, I’ve understood that you can use it across all platforms. I won’t be at home for several days and I can’t build a test app for iOS to confirm, but maybe someone else could. :stuck_out_tongue:

I use https://marketplace.coronalabs.com/corona-plugins/patcher in my iOS apps. When I find a defect or an issue, I have the ability to upload the new version of the .lua file to Gamesparks and then the clients will download it on the next internet connection. So far Apple has not rejected my apps because of this. Actually recently Apple rejected one of my updates because of an unrelated issue (offer wall showing apps to download). I updated the new version of the file and submitted the response that if they use the app connected to the internet it should download a new file that removes the offer wall. Never heard back but they approved the app.

I don’t think I have anything to add. We’ve not opened any other API’s other than loadstring() that I’m aware of. I’ve never needed to use this feature, so I can’t talk much about what you can or can’t do with it.

Rob

I appear to have answered my own question. From Corona documentation;

The basic Lua library provides several core functions. For security reasons, the dofile(), load(), loadfile(), and loadstring() functions are not available in Corona.

This is an interesting question.

From what I remember, Apple used to reject/remove all apps that used interpreted code. They especially didn’t want apps to have the ability to download external code and run it. Since 2017 or so, they relaxed the restrictions, see App Store Review Guidelines point 2.5.2 (https://developer.apple.com/app-store/review/guidelines/#software-requirements), it says:

2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the Application completely viewable and editable by the user.

Apple isn’t as strict when it comes to use of interpreted code anymore, but there are clear limitations as to what can be done with it. So, depending on your use case, the use of loadstring() and others could be allowed within Apple’s new rules. However, I am not sure if Corona’s documentation is outdated (I am betting on the documentation being outdated) or if Corona is still blocking those particular functions from running on iOS builds.

Additionally, here’s Rob discussing this very topic on another thread https://forums.coronalabs.com/topic/72285-how-does-it-work-today-can-downloaded-lua-be-loaded-dynamically/

In Rob’s very last post on the thread, he says: "Apple has eased some of these restrictions and we’ve enabled the loadstring() Lua API to dynamically execute some Lua after the fact."

So, it sounds to me like loadstring() does work on all platforms. I am not sure about what Rob is referring to by the dynamically executing some Lua using loadstring(), i.e. is there something it won’t execute? Maybe someone else could chime in? @Rob, perhaps? :smiley:

Anyway, TLDR, it mostly depends on what you are using loadstring() for, but yes, I’ve understood that you can use it across all platforms. I won’t be at home for several days and I can’t build a test app for iOS to confirm, but maybe someone else could. :stuck_out_tongue:

I use https://marketplace.coronalabs.com/corona-plugins/patcher in my iOS apps. When I find a defect or an issue, I have the ability to upload the new version of the .lua file to Gamesparks and then the clients will download it on the next internet connection. So far Apple has not rejected my apps because of this. Actually recently Apple rejected one of my updates because of an unrelated issue (offer wall showing apps to download). I updated the new version of the file and submitted the response that if they use the app connected to the internet it should download a new file that removes the offer wall. Never heard back but they approved the app.

I don’t think I have anything to add. We’ve not opened any other API’s other than loadstring() that I’m aware of. I’ve never needed to use this feature, so I can’t talk much about what you can or can’t do with it.

Rob