Exert more control over NSE library search path

nse_main.cc

@@ -957,6 +957,13 @@ void open_nse (void)
     lua_atpanic(L_NSE, panic);
     lua_settop(L_NSE, 0);
 
+    /* Do not allow environment variables to override the module search path.
+     * We do this here instead of in init_main to ensure we control all
+     * standard library loads as well.
+     */
+    lua_pushboolean(L_NSE, 1);
+    lua_setfield(L_NSE, LUA_REGISTRYINDEX, "LUA_NOENV");
+
     lua_pushcfunction(L_NSE, nseU_traceback);
     lua_pushcfunction(L_NSE, init_main);
     lua_pushlightuserdata(L_NSE, &o.chosenScripts);

nse_main.lua

@@ -144,7 +144,11 @@ do -- Add loader to look in nselib/?.lua (nselib/ can be in multiple places)
       return "\n\tNSE failed to find "..name.." in search paths.";
     end
   end
-  insert(package.searchers, 1, loader);
+  -- Replace all file-path searchers with our fetchfile searcher
+  package.searchers = {
+    package.searchers[1], -- Original preload searcher
+    loader, -- Our fetchfile searcher
+  }
 end
 
 local lpeg = require "lpeg";