@ WillFa: For Bad #1, that's true, there's a touchy side of this I hadn't considered. But you can do a lot of bad even without this "sneaky" bas64 thing, and it certainly wouldn't need to be added to serialize.lua to happen. Plus, I'm certain that a compiled .lua file could be supplied with a plugin, and all that's needed to use it is to dofile() it. There's absolutely no base64 there, and the point of the compiled Lua is hidden from sight. That's not something my technique creates: it's there already.
For Bad #2, that's also true, but consider that most functions wouldn't need serialization. This is a niche technique that is definitely useful where needed, but can usually be left alone. In my opinion, it's good for completeness' sake.
For Good #2, that's true, except I'd much rather use OnPluginBroadcast or CallPlugin anyways; using serialized functions seems hacky in this case.
@ Nick: When you're interacting with C++ via a Lua interface, I think it becomes slightly less high-level. Consider: if all we ever used here was pure Lua, then there would be no need for the obfuscation of the dumped function. It's only against the grain because it's a necessary evil.
Also, being able to serialize a function and save it somewhere is already supported by Lua by virtue of string.dump(), and this sort of thing could be emulated (albeit roughly) by saving the serialized functions to a file, and calling another plugin with the name of the file to load. It's, again, a bit hacky, so adding in-built support for serialized functions - which isn't terribly hard as I've displayed - simply makes it easier to do.
Upvalues are only a problem with closure functions so far as I've seen, and you can serialize the closure function itself, just not the function it creates (so far as I know). With future versions... you always have those kinds of problems, with loss of backwards compatability. I don't think high-value functions will be stored this way, though -and if they are, it's either fleetingly for passing it elsewhere within the client, or the coder better know the inherent risk.
EDIT: Anyways, thanks for the comments. At the very least it helped me understand some of the implications of this technique, and if I find a bona fide use for it, you can bet I'll be using it. Something to add to my "Oh nifty" list! |