immunio 1.1.13 → 1.1.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 67b141794571c8c22164d0747303ae976b47ce0c
-  data.tar.gz: 7fe8103a055bbceec95db059e986d43038bd33f9
+  metadata.gz: 7ae2946181dda203daf7cce9652ac99d78f0c822
+  data.tar.gz: c5c3ef8b2ab329ac11e5f3823601df36db381853
 SHA512:
-  metadata.gz: 4f1b26c8e09aeff86edfd5040a73b696994a199f2e576a1a50c0a7fb9980183d7123070a5a9ff9111ac9c53b26fce27a58c56b967c51974386cbdafa8ec74698
-  data.tar.gz: 0599ef0dfc60a801631dcda7c50358fbbfa69cac7e98f2b678582f88075632cd627871bca2df25646b9bef1098dd768ed535dab5ff2d8218bea07cb7720bdc7c
+  metadata.gz: ce62844b8ece04eaef147d59391ede1299b46734078ab3e5c1f4bf2965fa57544ed1a7439797a9cc1bda6dffe3473af2411f04d8a513ef199b8e3e2658761c54
+  data.tar.gz: 266a2912f823c888e4c61ed20c84b2a780592f60ad1f6b581d1bbe5587b386b99347d2bb70f21815ce357b65221c9895135751d2e72a9e11519e6575925df8fd

data/lib/immunio/plugins/action_view.rb

@@ -1,5 +1,6 @@
 # Hook into ActionView rendering to inject Immunio's hooks.
 require 'securerandom'
+require 'ripper'
 
 module Immunio
   # Renders templates by filtering them through Immunio's hook handlers.
@@ -237,6 +238,18 @@ module Immunio
       end
     end
 
+    def self.remove_comment(code)
+      *, last_line = code.rpartition("\n")
+
+      comment = Ripper.slice(last_line, "comment")
+
+      if comment
+        code = code.sub(Regexp.new(Regexp.escape(comment) + "\\Z"), "")
+      end
+
+      code
+    end
+
     # Generate code injected in templates to wrap everything inside `<%= ... %>`.
     def self.generate_render_var_code(code, escape)
       template = Template.current
@@ -250,7 +263,7 @@ module Immunio
           handler.class.name
         end
 
-        "(__immunio_result = (#{code}); Immunio::Template.render_var(#{code.strip.inspect}, __immunio_result, #{template_id}, '#{template.template_sha}', __FILE__, __LINE__, #{escape}, #{template.is_text?}, '#{handler_name}'))"
+        "(__immunio_result = (#{remove_comment(code)}); Immunio::Template.render_var(#{code.strip.inspect}, __immunio_result, #{template_id}, '#{template.template_sha}', __FILE__, __LINE__, #{escape}, #{template.is_text?}, '#{handler_name}'))"
       else
         code
       end
@@ -568,9 +581,14 @@ Immunio::Plugin.load(
 
   ActionView::TemplateRenderer.send :include, Immunio::TemplateRendererHooks
   ActionView::Template.send :include, Immunio::TemplateHooks
-  ActionController::Caching::Fragments.send(
-    :include,
-    Immunio::FragmentCachingHooks)
+
+  if Rails::VERSION::MAJOR < 5
+    ActionController::Caching::Fragments.send(
+      :include,
+      Immunio::FragmentCachingHooks)
+  else
+    AbstractController::Caching.send(:include, Immunio::FragmentCachingHooks)
+  end
 
   plugin.loaded! Rails.version
 end

data/lib/immunio/plugins/active_record.rb

@@ -168,7 +168,12 @@ module Immunio
         visit o.wheres, modifier: :where
         visit o.groups, modifier: :group
         visit o.windows, context
-        visit o.having, modifier: :having
+
+        if Rails::VERSION::MAJOR > 4
+          visit o.havings, modifier: :having
+        else
+          visit o.having, modifier: :having
+        end
       end
 
       def visit_Arel_Nodes_SelectStatement(o, context, _opts)

data/lib/immunio/plugins/active_record_relation.rb

@@ -41,8 +41,8 @@ module Immunio
     # Sometimes ActiveRecord creates a new relation with a new condition and
     # merges it into an existing relation. I'm not sure why, and I'm not going
     # to ask. Just copy the context data from the other relation into this one.
-    def merge_with_immunio(other)
-      return merge_without_immunio(other) unless other && !other.is_a?(Array)
+    def merge_with_immunio(other, *args)
+      return merge_without_immunio(other, *args) unless other && !other.is_a?(Array)
 
       # Rails 4 added the ability to call merge with a proc, like:
       #
@@ -51,7 +51,7 @@ module Immunio
       # We don't need to do anything here. If the proc calls relation methods,
       # they will be called on the right relation and everything will be good.
       if !other.is_a?(ActiveRecord::Relation) && other.respond_to?(:to_proc)
-        return merge_without_immunio(other)
+        return merge_without_immunio(other, *args)
       end
 
       # Rails 4 added the ability to merge in a hash of conditions, like:
@@ -63,13 +63,13 @@ module Immunio
       if other.is_a?(Hash)
         # This shouldn't happen, but let's be safe.
         unless defined? ActiveRecord::Relation::HashMerger
-          return merge_without_immunio(other)
+          return merge_without_immunio(other, *args)
         end
 
         other = ActiveRecord::Relation::HashMerger.new(self, other).other
       end
 
-      spawned = merge_without_immunio(other)
+      spawned = merge_without_immunio(other, *args)
       Request.time "plugin", "Immunio::RelationTracking" do
         QueryTracker.instance.merge_relations spawned, other
       end

data/lib/immunio/plugins/exception_handler.rb

@@ -46,8 +46,14 @@ module Immunio
 
     # Unwrap the innermost original exception.
     def unwrap_exception(e)
-      while e.respond_to?(:original_exception) && e.original_exception.is_a?(Exception)
-        e = e.original_exception
+      if Rails::VERSION::MAJOR > 4
+        while e.respond_to?(:cause) && e.cause.is_a?(Exception)
+          e = e.cause
+        end
+      else
+        while e.respond_to?(:original_exception) && e.original_exception.is_a?(Exception)
+          e = e.original_exception
+        end
       end
       e
     end

data/lib/immunio/version.rb

@@ -1,5 +1,5 @@
 module Immunio
   AGENT_TYPE = "agent-ruby"
-  VERSION = "1.1.13"
+  VERSION = "1.1.15"
   VM_VERSION = "2.2.0"
 end

data/lua-hooks/Makefile

@@ -10,13 +10,18 @@ CXX_SRC :=
 
 SPECIAL_SRC :=
 
-LUA_SRC :=
+LUA_BASE_SRC :=
+
+LUA_PROTECT_SRC :=
 
 CLI_SRC := \
 	ext/luajit/src/luajit.c
 
-# Include module definitions
-include $(patsubst %,%/module.mk,$(MODULES))
+# Include lib module definitions if present
+# It will be missing from the agent public distribution
+-include lib/module.mk
+# Include extension module definitions
+include ext/module.mk
 
 OBJ := \
 	$(patsubst %.c,%.o,$(filter %.c,$(SRC))) \
@@ -41,7 +46,8 @@ A_OUT = libimmunio.a
 include options.mk
 
 INIT_HOOK = hooks/__init__.lua
-HOOK_SRCS := $(wildcard hooks/*.lua) hooks/__init__.lua
+INIT_NOPROTECT_HOOK = hooks/__init__noprotect.lua
+HOOK_SRCS := $(wildcard hooks/*.lua) hooks/__init__.lua hooks/__init__noprotect.lua
 MIN_SRCS = $(HOOK_SRCS:hooks/%.lua=build/%.lua)
 HOOKS_TARBALL = hooks.tgz
 HOOKS_SRCS_TARBALL = hooks_srcs.tgz
@@ -50,7 +56,7 @@ LUAJIT_OUT = libluajit.a
 LUAJIT_OBJ = ext/luajit/src/${LUAJIT_OUT}
 
 # Build lua, run tests, and create hooks archive
-all: ${CLI} ${INIT_HOOK} ${HOOKS_TARBALL} ${HOOKS_SRCS_TARBALL}
+all: ${CLI} ${INIT_HOOK} ${INIT_NOPROTECT_HOOK} ${HOOKS_TARBALL} ${HOOKS_SRCS_TARBALL}
 
 ${SO_OUT}: ${OBJ} ${SPECIAL_OBJ} ${LUAJIT_OBJ}
 	${CC} -shared ${CFLAGS} ${LIBS} -o $@ -lc $^
@@ -62,7 +68,11 @@ ${LUAJIT_OUT}: ${LUAJIT_OBJ}
 	cp $^ $@
 
 ${LUAJIT_OBJ}:
-	cd ext/luajit/src && MACOSX_DEPLOYMENT_TARGET="10.8" make CROSS="${CROSS}" CC=cc HOST_CC=cc XCFLAGS="${LUAJIT_XCFLAGS}" ${LUAJIT_OUT}
+ifneq (,$(TARGET_SYS))
+	cd ext/luajit/src && make CROSS="${CROSS}" CC=cc HOST_CC=cc TARGET_SYS=$(TARGET_SYS) XCFLAGS="${LUAJIT_XCFLAGS}" ${LUAJIT_OUT}
+else
+	cd ext/luajit/src && make XCFLAGS="${LUAJIT_XCFLAGS}" ${LUAJIT_OUT}
+endif
 
 # Build lua executable for testing and compilation
 # Seperate compilation as we need the LUA_UNSAFE_MODE flag set...
@@ -71,10 +81,14 @@ ${CLI}: CXXFLAGS += ${UNSAFE_FLAG}
 ${CLI}: ${CLI_SRC} ${SRC} ${SPECIAL_OBJ} ${CXX_OBJ} ${LUAJIT_OBJ}
 	${CC} ${CFLAGS} ${LDFLAGS} -o $@ $^ ${LIBS}
 
-# Concatenate init hooks into one __init__.lua hook with two newlines in between
-${INIT_HOOK}: ${LUA_SRC} ${CLI}
+# Concatenate init hooks into one __init__.lua
+${INIT_NOPROTECT_HOOK}: ${LUA_BASE_SRC} ${CLI}
+	rm -f hooks/__init__noprotect.lua
+	${CLI} ./luald.lua ${LUA_BASE_SRC} > hooks/__init__noprotect.lua
+
+${INIT_HOOK}: ${LUA_BASE_SRC} ${LUA_PROTECT_SRC} ${CLI}
 	rm -f hooks/__init__.lua
-	${CLI} ./luald.lua ${LUA_SRC} > hooks/__init__.lua
+	${CLI} ./luald.lua ${LUA_BASE_SRC} ${LUA_PROTECT_SRC} > hooks/__init__.lua
 
 build/%.lua: hooks/%.lua ${CLI}
 	@mkdir -p build
@@ -100,6 +114,7 @@ ${CLI_OBJ} ${OBJ} ${CXX_OBJ} ${LUAJIT_OBJ}: CFLAGS += ${OPTIMIZE_FULL}
 
 cleanhooks:
 	rm -f ${INIT_HOOK}
+	rm -f ${INIT_NOPROTECT_HOOK}
 	rm -f build/*.lua
 
 clean: cleanhooks
@@ -109,9 +124,14 @@ clean: cleanhooks
 	rm -rf build
 	find . -name \*.o -delete
 
-test: ${CLI} ${INIT_HOOK} lint ${MIN_SRCS}
+test: ${CLI} ${INIT_HOOK} ${INIT_NOPROTECT_HOOK} lint ${MIN_SRCS}
 	@rm -f test_failed
 	@for file in test/*_test.lua; do \
+		printf "\nRunning $$file\n"; \
+		TEST_NOPROTECT_HOOKS=1 TEST_BUILT_HOOKS=1 ${CLI} -e 'package.path="./LuaMinify/?.lua;" .. package.path' -l 'Strict' $$file || touch test_failed; \
+		TEST_BUILT_HOOKS=1 ${CLI} -e 'package.path="./LuaMinify/?.lua;" .. package.path' -l 'Strict' $$file || touch test_failed; \
+	done
+	@for file in test_protect/*_test.lua; do \
 		printf "\nRunning $$file\n"; \
 		TEST_BUILT_HOOKS=1 ${CLI} -e 'package.path="./LuaMinify/?.lua;" .. package.path' -l 'Strict' $$file || touch test_failed; \
 	done
@@ -122,7 +142,7 @@ enable-console: cleanhooks
 	cp lib/term.lua.dev lib/term.lua
 	make
 
-lint: ${INIT_HOOK}
+lint: ${INIT_HOOK} ${INIT_NOPROTECT_HOOK}
 	@# Scan all lua files for lines with trailing spaces
 	@# The leading `!` negates the logic, so this target fails if trailing
 	@# spaces are found in any Lua file.

data/lua-hooks/ext/all.c

@@ -48,8 +48,9 @@ static const luaL_Reg lj_lib_load[] = {
   { NULL,   NULL }
 };
 
-// In unsafe mode define these as NOPs when we build a .so
-#if !defined(LUA_UNSAFE_MODE)
+// Ruby agent requires these functions to be present.
+// In safe mode, where they are not, we provide a noop.
+#if !defined(LUA_UNSAFE_MODE) && !defined(LUA_NO_MOCK_UNSAFE)
 LUALIB_API int luaopen_io(lua_State *L) {
   return 0;
 }
@@ -66,4 +67,3 @@ LUALIB_API void luaL_openlibs(lua_State *L) {
     lua_call(L, 1, 0);
   }
 }
-

data/lua-hooks/ext/libinjection/libinjection_sqli.h

@@ -57,7 +57,7 @@ struct libinjection_sqli_token {
      */
     int  count;
 
-    char val[32];
+    char val[512];
 };
 
 typedef struct libinjection_sqli_token stoken_t;

data/lua-hooks/ext/libinjection/lualib.c

@@ -96,6 +96,18 @@ int sqli_tokenize(lua_State *L) {
     lua_pushlstring(L, &state.tokenvec[0].type, 1);
     lua_setfield(L, -2, "type");
 
+    if (state.tokenvec[0].str_open != '\0') {
+      /* Token.str_open = str_open */
+      lua_pushlstring(L, &state.tokenvec[0].str_open, 1);
+      lua_setfield(L, -2, "str_open");
+    }
+
+    if (state.tokenvec[0].str_close != '\0') {
+      /* Token.str_close = str_open */
+      lua_pushlstring(L, &state.tokenvec[0].str_close, 1);
+      lua_setfield(L, -2, "str_close");
+    }
+
     /* Token.var_symbol_count = count for variable tokens */
     if (state.tokenvec[0].type == 'v') {
       lua_pushinteger(L, state.tokenvec[0].count);
@@ -107,6 +119,10 @@ int sqli_tokenize(lua_State *L) {
         state.tokenvec[0].len);
     lua_setfield(L, -2, "value");
 
+    /* Token.pos = pos */
+    lua_pushinteger(L, state.tokenvec[0].pos);
+    lua_setfield(L, -2, "pos");
+
     /* Tokens.append(Token) */
     lua_pushinteger(L, token_cnt++);
     lua_insert(L, -2); /* [..., token, index] --> [..., index, token] */

data/lua-hooks/ext/lpeg/HISTORY

@@ -1,4 +1,10 @@
-HISTORY for LPeg 0.12
+HISTORY for LPeg 1.0
+
+* Changes from version 0.12 to 1.0
+  ---------------------------------
+  + group "names" can be any Lua value
+  + some bugs fixed
+  + other small improvements
 
 * Changes from version 0.11 to 0.12
   ---------------------------------

data/lua-hooks/ext/lpeg/lpcap.c

@@ -1,5 +1,5 @@
 /*
-** $Id: lpcap.c,v 1.5 2014/12/12 16:58:47 roberto Exp $
+** $Id: lpcap.c,v 1.6 2015/06/15 16:09:57 roberto Exp $
 ** Copyright 2007, Lua.org & PUC-Rio  (see 'lpeg.html' for license)
 */
 
@@ -126,7 +126,7 @@ static Capture *findback (CapState *cs, Capture *cap) {
       continue; /* opening an enclosing capture: skip and get previous */
     if (captype(cap) == Cgroup) {
       getfromktable(cs, cap->idx);  /* get group name */
-      if (lua_equal(L, -2, -1)) {  /* right group? */
+      if (lp_equal(L, -2, -1)) {  /* right group? */
         lua_pop(L, 2);  /* remove reference name and group name */
         return cap;
       }

data/lua-hooks/ext/lpeg/lpcap.h

@@ -1,5 +1,5 @@
 /*
-** $Id: lpcap.h,v 1.1 2013/03/21 20:25:12 roberto Exp $
+** $Id: lpcap.h,v 1.3 2016/09/13 17:45:58 roberto Exp $
 */
 
 #if !defined(lpcap_h)
@@ -11,14 +11,27 @@
 
 /* kinds of captures */
 typedef enum CapKind {
-  Cclose, Cposition, Cconst, Cbackref, Carg, Csimple, Ctable, Cfunction,
-  Cquery, Cstring, Cnum, Csubst, Cfold, Cruntime, Cgroup
+  Cclose,  /* not used in trees */
+  Cposition,
+  Cconst,  /* ktable[key] is Lua constant */
+  Cbackref,  /* ktable[key] is "name" of group to get capture */
+  Carg,  /* 'key' is arg's number */
+  Csimple,  /* next node is pattern */
+  Ctable,  /* next node is pattern */
+  Cfunction,  /* ktable[key] is function; next node is pattern */
+  Cquery,  /* ktable[key] is table; next node is pattern */
+  Cstring,  /* ktable[key] is string; next node is pattern */
+  Cnum,  /* numbered capture; 'key' is number of value to return */
+  Csubst,  /* substitution capture; next node is pattern */
+  Cfold,  /* ktable[key] is function; next node is pattern */
+  Cruntime,  /* not used in trees (is uses another type for tree) */
+  Cgroup  /* ktable[key] is group's "name" */
 } CapKind;
 
 
 typedef struct Capture {
   const char *s;  /* subject position */
-  short idx;  /* extra info about capture (group name, arg index, etc.) */
+  unsigned short idx;  /* extra info (group name, arg index, etc.) */
   byte kind;  /* kind of capture */
   byte siz;  /* size of full capture + 1 (0 = not a full capture) */
 } Capture;

data/lua-hooks/ext/lpeg/lpcode.c

@@ -1,5 +1,5 @@
 /*
-** $Id: lpcode.c,v 1.21 2014/12/12 17:01:29 roberto Exp $
+** $Id: lpcode.c,v 1.24 2016/09/15 17:46:13 roberto Exp $
 ** Copyright 2007, Lua.org & PUC-Rio  (see 'lpeg.html' for license)
 */
 
@@ -13,7 +13,7 @@
 #include "lpcode.h"
 
 
-/* signals a "no-LpegInstruction */
+/* signals a "no-instruction */
 #define NOINST		-1
 
 
@@ -125,6 +125,27 @@ int tocharset (TTree *tree, Charset *cs) {
 }
 
 
+/*
+** Visit a TCall node taking care to stop recursion. If node not yet
+** visited, return 'f(sib2(tree))', otherwise return 'def' (default
+** value)
+*/
+static int callrecursive (TTree *tree, int f (TTree *t), int def) {
+  int key = tree->key;
+  assert(tree->tag == TCall);
+  assert(sib2(tree)->tag == TRule);
+  if (key == 0)  /* node already visited? */
+    return def;  /* return default value */
+  else {  /* first visit */
+    int result;
+    tree->key = 0;  /* mark call as already visited */
+    result = f(sib2(tree));  /* go to called rule */
+    tree->key = key;  /* restore tree */
+    return result;
+  }
+}
+
+
 /*
 ** Check whether a pattern tree has captures
 */
@@ -134,14 +155,17 @@ int hascaptures (TTree *tree) {
     case TCapture: case TRunTime:
       return 1;
     case TCall:
-      tree = sib2(tree); goto tailcall;  /* return hascaptures(sib2(tree)); */
+      return callrecursive(tree, hascaptures, 0);
+    case TRule:  /* do not follow siblings */
+      tree = sib1(tree); goto tailcall;
     case TOpenCall: assert(0);
     default: {
       switch (numsiblings[tree->tag]) {
         case 1:  /* return hascaptures(sib1(tree)); */
           tree = sib1(tree); goto tailcall;
         case 2:
-          if (hascaptures(sib1(tree))) return 1;
+          if (hascaptures(sib1(tree)))
+            return 1;
           /* else return hascaptures(sib2(tree)); */
           tree = sib2(tree); goto tailcall;
         default: assert(numsiblings[tree->tag] == 0); return 0;
@@ -208,9 +232,9 @@ int checkaux (TTree *tree, int pred) {
 
 /*
 ** number of characters to match a pattern (or -1 if variable)
-** ('count' avoids infinite loops for grammars)
 */
-int fixedlenx (TTree *tree, int count, int len) {
+int fixedlen (TTree *tree) {
+  int len = 0;  /* to accumulate in tail calls */
  tailcall:
   switch (tree->tag) {
     case TChar: case TSet: case TAny:
@@ -220,26 +244,29 @@ int fixedlenx (TTree *tree, int count, int len) {
     case TRep: case TRunTime: case TOpenCall:
       return -1;
     case TCapture: case TRule: case TGrammar:
-      /* return fixedlenx(sib1(tree), count); */
+      /* return fixedlen(sib1(tree)); */
       tree = sib1(tree); goto tailcall;
-    case TCall:
-      if (count++ >= MAXRULES)
-        return -1;  /* may be a loop */
-      /* else return fixedlenx(sib2(tree), count); */
-      tree = sib2(tree); goto tailcall;
+    case TCall: {
+      int n1 = callrecursive(tree, fixedlen, -1);
+      if (n1 < 0)
+        return -1;
+      else
+        return len + n1;
+    }
     case TSeq: {
-      len = fixedlenx(sib1(tree), count, len);
-      if (len < 0) return -1;
-      /* else return fixedlenx(sib2(tree), count, len); */
-      tree = sib2(tree); goto tailcall;
+      int n1 = fixedlen(sib1(tree));
+      if (n1 < 0)
+        return -1;
+      /* else return fixedlen(sib2(tree)) + len; */
+      len += n1; tree = sib2(tree); goto tailcall;
     }
     case TChoice: {
-      int n1, n2;
-      n1 = fixedlenx(sib1(tree), count, len);
-      if (n1 < 0) return -1;
-      n2 = fixedlenx(sib2(tree), count, len);
-      if (n1 == n2) return n1;
-      else return -1;
+      int n1 = fixedlen(sib1(tree));
+      int n2 = fixedlen(sib2(tree));
+      if (n1 != n2 || n1 < 0)
+        return -1;
+      else
+        return len + n1;
     }
     default: assert(0); return 0;
   };
@@ -257,7 +284,7 @@ int fixedlenx (TTree *tree, int count, int len) {
 ** pattern (full set if nothing follows it).
 **
 ** The function returns 0 when this resulting set can be used for
-** test LpegInstructions that avoid the pattern altogether.
+** test instructions that avoid the pattern altogether.
 ** A non-zero return can happen for two reasons:
 ** 1) match p '' -> ''            ==> return has bit 1 set
 ** (tests cannot be used because they would always fail for an empty input);
@@ -332,7 +359,7 @@ static int getfirst (TTree *tree, const Charset *follow, Charset *firstset) {
       }
       /* else go through */
     }
-    case TBehind: {  /* LpegInstruction gives no new information */
+    case TBehind: {  /* instruction gives no new information */
       /* call 'getfirst' only to check for math-time captures */
       int e = getfirst(sib1(tree), follow, firstset);
       loopset(i, firstset->cs[i] = follow->cs[i]);  /* uses follow */
@@ -406,9 +433,9 @@ static int needfollow (TTree *tree) {
 
 
 /*
-** size of an LpegInstruction
+** size of an instruction
 */
-int sizei (const LpegInstruction *i) {
+int sizei (const Instruction *i) {
   switch((Opcode)i->i.code) {
     case ISet: case ISpan: return CHARSETINSTSIZE;
     case ITestSet: return CHARSETINSTSIZE + 1;
@@ -431,11 +458,11 @@ typedef struct CompileState {
 
 
 /*
-** code generation is recursive; 'opt' indicates that the code is
-** being generated under a 'IChoice' operator jumping to its end
-** (that is, the match is "optional").
-** 'tt' points to a previous test protecting this code. 'fl' is
-** the follow set of the pattern.
+** code generation is recursive; 'opt' indicates that the code is being
+** generated as the last thing inside an optional pattern (so, if that
+** code is optional too, it can reuse the 'IChoice' already in place for
+** the outer pattern). 'tt' points to a previous test protecting this
+** code (or NOINST). 'fl' is the follow set of the pattern.
 */
 static void codegen (CompileState *compst, TTree *tree, int opt, int tt,
                      const Charset *fl);
@@ -444,16 +471,16 @@ static void codegen (CompileState *compst, TTree *tree, int opt, int tt,
 void realloccode (lua_State *L, Pattern *p, int nsize) {
   void *ud;
   lua_Alloc f = lua_getallocf(L, &ud);
-  void *newblock = f(ud, p->code, p->codesize * sizeof(LpegInstruction),
-                                  nsize * sizeof(LpegInstruction));
+  void *newblock = f(ud, p->code, p->codesize * sizeof(Instruction),
+                                  nsize * sizeof(Instruction));
   if (newblock == NULL && nsize > 0)
     luaL_error(L, "not enough memory");
-  p->code = (LpegInstruction *)newblock;
+  p->code = (Instruction *)newblock;
   p->codesize = nsize;
 }
 
 
-static int nextLpegInstruction (CompileState *compst) {
+static int nextinstruction (CompileState *compst) {
   int size = compst->p->codesize;
   if (compst->ncode >= size)
     realloccode(compst->L, compst->p, size * 2);
@@ -464,8 +491,8 @@ static int nextLpegInstruction (CompileState *compst) {
 #define getinstr(cs,i)		((cs)->p->code[i])
 
 
-static int addLpegInstruction (CompileState *compst, Opcode op, int aux) {
-  int i = nextLpegInstruction(compst);
+static int addinstruction (CompileState *compst, Opcode op, int aux) {
+  int i = nextinstruction(compst);
   getinstr(compst, i).i.code = op;
   getinstr(compst, i).i.aux = aux;
   return i;
@@ -473,33 +500,33 @@ static int addLpegInstruction (CompileState *compst, Opcode op, int aux) {
 
 
 /*
-** Add an LpegInstruction followed by space for an offset (to be set later)
+** Add an instruction followed by space for an offset (to be set later)
 */
 static int addoffsetinst (CompileState *compst, Opcode op) {
-  int i = addLpegInstruction(compst, op, 0);  /* LpegInstruction */
-  addLpegInstruction(compst, (Opcode)0, 0);  /* open space for offset */
+  int i = addinstruction(compst, op, 0);  /* instruction */
+  addinstruction(compst, (Opcode)0, 0);  /* open space for offset */
   assert(op == ITestSet || sizei(&getinstr(compst, i)) == 2);
   return i;
 }
 
 
 /*
-** Set the offset of an LpegInstruction
+** Set the offset of an instruction
 */
-static void setoffset (CompileState *compst, int LpegInstruction, int offset) {
-  getinstr(compst, LpegInstruction + 1).offset = offset;
+static void setoffset (CompileState *compst, int instruction, int offset) {
+  getinstr(compst, instruction + 1).offset = offset;
 }
 
 
 /*
-** Add a capture LpegInstruction:
-** 'op' is the capture LpegInstruction; 'cap' the capture kind;
+** Add a capture instruction:
+** 'op' is the capture instruction; 'cap' the capture kind;
 ** 'key' the key into ktable; 'aux' is the optional capture offset
 **
 */
 static int addinstcap (CompileState *compst, Opcode op, int cap, int key,
                        int aux) {
-  int i = addLpegInstruction(compst, op, joinkindoff(cap, aux));
+  int i = addinstruction(compst, op, joinkindoff(cap, aux));
   getinstr(compst, i).i.key = key;
   return i;
 }
@@ -511,43 +538,43 @@ static int addinstcap (CompileState *compst, Opcode op, int cap, int key,
 
 
 /*
-** Patch 'LpegInstruction' to jump to 'target'
+** Patch 'instruction' to jump to 'target'
 */
-static void jumptothere (CompileState *compst, int LpegInstruction, int target) {
-  if (LpegInstruction >= 0)
-    setoffset(compst, LpegInstruction, target - LpegInstruction);
+static void jumptothere (CompileState *compst, int instruction, int target) {
+  if (instruction >= 0)
+    setoffset(compst, instruction, target - instruction);
 }
 
 
 /*
-** Patch 'LpegInstruction' to jump to current position
+** Patch 'instruction' to jump to current position
 */
-static void jumptohere (CompileState *compst, int LpegInstruction) {
-  jumptothere(compst, LpegInstruction, gethere(compst));
+static void jumptohere (CompileState *compst, int instruction) {
+  jumptothere(compst, instruction, gethere(compst));
 }
 
 
 /*
-** Code an IChar LpegInstruction, or IAny if there is an equivalent
+** Code an IChar instruction, or IAny if there is an equivalent
 ** test dominating it
 */
 static void codechar (CompileState *compst, int c, int tt) {
   if (tt >= 0 && getinstr(compst, tt).i.code == ITestChar &&
                  getinstr(compst, tt).i.aux == c)
-    addLpegInstruction(compst, IAny, 0);
+    addinstruction(compst, IAny, 0);
   else
-    addLpegInstruction(compst, IChar, c);
+    addinstruction(compst, IChar, c);
 }
 
 
 /*
-** Add a charset posfix to an LpegInstruction
+** Add a charset posfix to an instruction
 */
 static void addcharset (CompileState *compst, const byte *cs) {
   int p = gethere(compst);
   int i;
   for (i = 0; i < (int)CHARSETINSTSIZE - 1; i++)
-    nextLpegInstruction(compst);  /* space for buffer */
+    nextinstruction(compst);  /* space for buffer */
   /* fill buffer with charset */
   loopset(j, getinstr(compst, p).buff[j] = cs[j]);
 }
@@ -556,7 +583,7 @@ static void addcharset (CompileState *compst, const byte *cs) {
 /*
 ** code a char set, optimizing unit sets for IChar, "complete"
 ** sets for IAny, and empty sets for IFail; also use an IAny
-** when LpegInstruction is dominated by an equivalent test.
+** when instruction is dominated by an equivalent test.
 */
 static void codecharset (CompileState *compst, const byte *cs, int tt) {
   int c = 0;  /* (=) to avoid warnings */
@@ -566,14 +593,14 @@ static void codecharset (CompileState *compst, const byte *cs, int tt) {
     case ISet: {  /* non-trivial set? */
       if (tt >= 0 && getinstr(compst, tt).i.code == ITestSet &&
           cs_equal(cs, getinstr(compst, tt + 2).buff))
-        addLpegInstruction(compst, IAny, 0);
+        addinstruction(compst, IAny, 0);
       else {
-        addLpegInstruction(compst, ISet, 0);
+        addinstruction(compst, ISet, 0);
         addcharset(compst, cs);
       }
       break;
     }
-    default: addLpegInstruction(compst, op, c); break;
+    default: addinstruction(compst, op, c); break;
   }
 }
 
@@ -582,7 +609,7 @@ static void codecharset (CompileState *compst, const byte *cs, int tt) {
 ** code a test set, optimizing unit sets for ITestChar, "complete"
 ** sets for ITestAny, and empty sets for IJmp (always fails).
 ** 'e' is true iff test should accept the empty string. (Test
-** LpegInstructions in the current VM never accept the empty string.)
+** instructions in the current VM never accept the empty string.)
 */
 static int codetestset (CompileState *compst, Charset *cs, int e) {
   if (e) return NOINST;  /* no test */
@@ -611,7 +638,7 @@ static int codetestset (CompileState *compst, Charset *cs, int e) {
 /*
 ** Find the final destination of a sequence of jumps
 */
-static int finaltarget (LpegInstruction *code, int i) {
+static int finaltarget (Instruction *code, int i) {
   while (code[i].i.code == IJmp)
     i = target(code, i);
   return i;
@@ -621,7 +648,7 @@ static int finaltarget (LpegInstruction *code, int i) {
 /*
 ** final label (after traversing any jumps)
 */
-static int finallabel (LpegInstruction *code, int i) {
+static int finallabel (Instruction *code, int i) {
   return finaltarget(code, target(code, i));
 }
 
@@ -631,20 +658,20 @@ static int finallabel (LpegInstruction *code, int i) {
 */
 static void codebehind (CompileState *compst, TTree *tree) {
   if (tree->u.n > 0)
-    addLpegInstruction(compst, IBehind, tree->u.n);
+    addinstruction(compst, IBehind, tree->u.n);
   codegen(compst, sib1(tree), 0, NOINST, fullset);
 }
 
 
 /*
 ** Choice; optimizations:
-** - when p1 is headfail
-** - when first(p1) and first(p2) are disjoint; than
+** - when p1 is headfail or
+** when first(p1) and first(p2) are disjoint, than
 ** a character not in first(p1) cannot go to p1, and a character
 ** in first(p1) cannot go to p2 (at it is not in first(p2)).
 ** (The optimization is not valid if p1 accepts the empty string,
 ** as then there is no character at all...)
-** - when p2 is empty and opt is true; a IPartialCommit can resuse
+** - when p2 is empty and opt is true; a IPartialCommit can reuse
 ** the Choice already active in the stack.
 */
 static void codechoice (CompileState *compst, TTree *p1, TTree *p2, int opt,
@@ -671,7 +698,7 @@ static void codechoice (CompileState *compst, TTree *p1, TTree *p2, int opt,
   }
   else {
     /* <p1 / p2> == 
-        test(fail(p1)) -> L1; choice L1; <p1>; commit L2; L1: <p2>; L2: */
+        test(first(p1)) -> L1; choice L1; <p1>; commit L2; L1: <p2>; L2: */
     int pcommit;
     int test = codetestset(compst, &cs1, e1);
     int pchoice = addoffsetinst(compst, IChoice);
@@ -695,7 +722,7 @@ static void codeand (CompileState *compst, TTree *tree, int tt) {
   if (n >= 0 && n <= MAXBEHIND && !hascaptures(tree)) {
     codegen(compst, tree, 0, tt, fullset);
     if (n > 0)
-      addLpegInstruction(compst, IBehind, n);
+      addinstruction(compst, IBehind, n);
   }
   else {  /* default: Choice L1; p1; BackCommit L2; L1: Fail; L2: */
     int pcommit;
@@ -703,16 +730,17 @@ static void codeand (CompileState *compst, TTree *tree, int tt) {
     codegen(compst, tree, 0, tt, fullset);
     pcommit = addoffsetinst(compst, IBackCommit);
     jumptohere(compst, pchoice);
-    addLpegInstruction(compst, IFail, 0);
+    addinstruction(compst, IFail, 0);
     jumptohere(compst, pcommit);
   }
 }
 
 
 /*
-** Captures: if pattern has fixed (and not too big) length, use
-** a single IFullCapture LpegInstruction after the match; otherwise,
-** enclose the pattern with OpenCapture - CloseCapture.
+** Captures: if pattern has fixed (and not too big) length, and it
+** has no nested captures, use a single IFullCapture instruction
+** after the match; otherwise, enclose the pattern with OpenCapture -
+** CloseCapture.
 */
 static void codecapture (CompileState *compst, TTree *tree, int tt,
                          const Charset *fl) {
@@ -738,7 +766,7 @@ static void coderuntime (CompileState *compst, TTree *tree, int tt) {
 
 /*
 ** Repetion; optimizations:
-** When pattern is a charset, can use special LpegInstruction ISpan.
+** When pattern is a charset, can use special instruction ISpan.
 ** When pattern is head fail, or if it starts with characters that
 ** are disjoint from what follows the repetions, a simple test
 ** is enough (a fail inside the repetition would backtrack to fail
@@ -750,7 +778,7 @@ static void coderep (CompileState *compst, TTree *tree, int opt,
                      const Charset *fl) {
   Charset st;
   if (tocharset(tree, &st)) {
-    addLpegInstruction(compst, ISpan, 0);
+    addinstruction(compst, ISpan, 0);
     addcharset(compst, st.cs);
   }
   else {
@@ -759,7 +787,7 @@ static void coderep (CompileState *compst, TTree *tree, int opt,
       /* L1: test (fail(p1)) -> L2; <p>; jmp L1; L2: */
       int jmp;
       int test = codetestset(compst, &st, 0);
-      codegen(compst, tree, opt, test, fullset);
+      codegen(compst, tree, 0, test, fullset);
       jmp = addoffsetinst(compst, IJmp);
       jumptohere(compst, test);
       jumptothere(compst, jmp, test);
@@ -797,12 +825,12 @@ static void codenot (CompileState *compst, TTree *tree) {
   int e = getfirst(tree, fullset, &st);
   int test = codetestset(compst, &st, e);
   if (headfail(tree))  /* test (fail(p1)) -> L1; fail; L1:  */
-    addLpegInstruction(compst, IFail, 0);
+    addinstruction(compst, IFail, 0);
   else {
     /* test(fail(p))-> L1; choice L1; <p>; failtwice; L1:  */
     int pchoice = addoffsetinst(compst, IChoice);
     codegen(compst, tree, 0, NOINST, fullset);
-    addLpegInstruction(compst, IFailTwice, 0);
+    addinstruction(compst, IFailTwice, 0);
     jumptohere(compst, pchoice);
   }
   jumptohere(compst, test);
@@ -816,7 +844,7 @@ static void codenot (CompileState *compst, TTree *tree) {
 static void correctcalls (CompileState *compst, int *positions,
                           int from, int to) {
   int i;
-  LpegInstruction *code = compst->p->code;
+  Instruction *code = compst->p->code;
   for (i = from; i < to; i += sizei(&code[i])) {
     if (code[i].i.code == IOpenCall) {
       int n = code[i].i.key;  /* rule number */
@@ -848,7 +876,7 @@ static void codegrammar (CompileState *compst, TTree *grammar) {
   for (rule = sib1(grammar); rule->tag == TRule; rule = sib2(rule)) {
     positions[rulenumber++] = gethere(compst);  /* save rule position */
     codegen(compst, sib1(rule), 0, NOINST, fullset);  /* code rule */
-    addLpegInstruction(compst, IRet, 0);
+    addinstruction(compst, IRet, 0);
   }
   assert(rule->tag == TTrue);
   jumptohere(compst, jumptoend);
@@ -893,10 +921,10 @@ static void codegen (CompileState *compst, TTree *tree, int opt, int tt,
  tailcall:
   switch (tree->tag) {
     case TChar: codechar(compst, tree->u.n, tt); break;
-    case TAny: addLpegInstruction(compst, IAny, 0); break;
+    case TAny: addinstruction(compst, IAny, 0); break;
     case TSet: codecharset(compst, treebuffer(tree), tt); break;
     case TTrue: break;
-    case TFalse: addLpegInstruction(compst, IFail, 0); break;
+    case TFalse: addinstruction(compst, IFail, 0); break;
     case TChoice: codechoice(compst, sib1(tree), sib2(tree), opt, fl); break;
     case TRep: coderep(compst, sib1(tree), opt, fl); break;
     case TBehind: codebehind(compst, tree); break;
@@ -917,23 +945,23 @@ static void codegen (CompileState *compst, TTree *tree, int opt, int tt,
 
 
 /*
-** Optimize jumps and other jump-like LpegInstructions.
-** * Update labels of LpegInstructions with labels to their final
+** Optimize jumps and other jump-like instructions.
+** * Update labels of instructions with labels to their final
 ** destinations (e.g., choice L1; ... L1: jmp L2: becomes
 ** choice L2)
-** * Jumps to other LpegInstructions that do jumps become those
-** LpegInstructions (e.g., jump to return becomes a return; jump
+** * Jumps to other instructions that do jumps become those
+** instructions (e.g., jump to return becomes a return; jump
 ** to commit becomes a commit)
 */
 static void peephole (CompileState *compst) {
-  LpegInstruction *code = compst->p->code;
+  Instruction *code = compst->p->code;
   int i;
   for (i = 0; i < compst->ncode; i += sizei(&code[i])) {
    redo:
     switch (code[i].i.code) {
       case IChoice: case ICall: case ICommit: case IPartialCommit:
       case IBackCommit: case ITestChar: case ITestSet:
-      case ITestAny: {  /* LpegInstructions with labels */
+      case ITestAny: {  /* instructions with labels */
         jumptothere(compst, i, finallabel(code, i));  /* optimize label */
         break;
       }
@@ -941,15 +969,15 @@ static void peephole (CompileState *compst) {
         int ft = finaltarget(code, i);
         switch (code[ft].i.code) {  /* jumping to what? */
           case IRet: case IFail: case IFailTwice:
-          case IEnd: {  /* LpegInstructions with unconditional implicit jumps */
-            code[i] = code[ft];  /* jump becomes that LpegInstruction */
+          case IEnd: {  /* instructions with unconditional implicit jumps */
+            code[i] = code[ft];  /* jump becomes that instruction */
             code[i + 1].i.code = IAny;  /* 'no-op' for target position */
             break;
           }
           case ICommit: case IPartialCommit:
           case IBackCommit: {  /* inst. with unconditional explicit jumps */
             int fft = finallabel(code, ft);
-            code[i] = code[ft];  /* jump becomes that LpegInstruction... */
+            code[i] = code[ft];  /* jump becomes that instruction... */
             jumptothere(compst, i, fft);  /* but must correct its offset */
             goto redo;  /* reoptimize its label */
           }
@@ -970,12 +998,12 @@ static void peephole (CompileState *compst) {
 /*
 ** Compile a pattern
 */
-LpegInstruction *compile (lua_State *L, Pattern *p) {
+Instruction *compile (lua_State *L, Pattern *p) {
   CompileState compst;
   compst.p = p;  compst.ncode = 0;  compst.L = L;
   realloccode(L, p, 2);  /* minimum initial size */
   codegen(&compst, p->tree, 0, NOINST, fullset);
-  addLpegInstruction(&compst, IEnd, 0);
+  addinstruction(&compst, IEnd, 0);
   realloccode(L, p, compst.ncode);  /* set final size */
   peephole(&compst);
   return p->code;