Lua Version in 9.6?

[nlannin3]

Hi all,

I am currently using Setup Factory 9.5.1 which includes Lua 5.1 in it's runtime. Do new versions of Setup Factory use Lua 5.4 (the latest) or do they still use Lua 5.1? I can't seem to find a definitive answer.

Thanks for your assistance.

[nlannin3]

Also, is it possible to specify a runtime library to use? For instance, if 9.6 targets Lua 5.1, is there any way we could target 5.4 for my packages?

[Ted Sullivan]

5.1. In what way would 5.4 be a factor in a Setup Factory project?

[nlannin3]

5.1. In what way would 5.4 be a factor in a Setup Factory project?

I was generally wondering since Lua 5.1 was discontinued in 2012 according to their website - https://www.lua.org/versions.html

[nlannin3]

Our product that we build using Setup Factory was flagged for a security vulnerability. Specifically, Lua5.1 was flagged.

[Ted Sullivan]

We’ve looked at this from many angles, and there is no issue with the way it is used in Setup Factory. Frankly, someone running any installer is the security “vulnerability”. That’s where trust comes into play (code signing, reputable vendor etc). An installer runs as admin and can basically do anything to a system. Exploiting an obscure stack overflow in Lua is the least worrisome thing you can do… you’d just code the installer to do the bad stuff if you were a “bad guy”. Lesson: don’t run installers from random web sites.