Is binser safe?

[jtackaberry]

The README says that binser "does not [...] use the Lua parser to read expressions" and that "[t]his makes it safe."

But the deserializer uses loadstring() for functions.

Doesn't this mean that binser is in fact not safe? Perhaps deserialize() could take an argument to enable the non-safe behavior of deserializing functions?

[pakeke-constructor]

Loadstring will load the lua code, but not run anything.

If you did loadstring(code)(), then this could be very bad, as the lua code inside code would be executed.

(So to answer your question, Yes, binser is safe)