The new validators already solve this problem, but as a second layer of defence, the generators should also be secured. Issue #2637
This is based on the JS generator, with a lot of inspiration from Ellen Spertus's blockly-lua: https://github.com/espertus/blockly-lua All unit tests pass with Lua 5.3.2.