Remove setlocal and setupvalue from `debug` table whitelist

It's likely that these could be used trick mods into revealing the insecure
environment even if they do everything right (which is already hard enough).

diff --git a/src/script/cpp_api/s_security.cpp b/src/script/cpp_api/s_security.cpp
index 5faf8cc80e7f358433b8cb9ef09a03ea7092a788..11c277839aac41ba7e7ec07ad6204cf797387d5c 100644 (file)
--- a/src/script/cpp_api/s_security.cpp
+++ b/src/script/cpp_api/s_security.cpp
@@ -129,12 +129,10 @@ void ScriptApiSecurity::initializeSecurity()
                "traceback",
                "getinfo",
                "getmetatable",
-               "setupvalue",
                "setmetatable",
                "upvalueid",
                "sethook",
                "debug",
-               "setlocal",
        };
        static const char *package_whitelist[] = {
                "config",