Best practices for preventing common exploits?

Help and Feedback Scripting Support
15

Untrusted data should go through a few steps:

  1. Rate limiting
  2. Schema validation
    • e.g. type assertions
  3. Sanity checks
    • e.g. discarding OOB or nonfinite values
  4. Optional: Turing tests
    • e.g. calling out aimbots

A cool problem that @0xBAADF00D and I ran into yesterday is NaN poisoning. If a malicious user can introduce a NaN into your game’s economy, they might be able to get infinite items for free depending on how your code is structured:

-- Unsafe: NaN balance will award item
if player.balance < price then
    print("not enough money!")
else
    awardItem()
end

-- Safe: NaN balance won't award item
if player.balance >= price then
    awardItem()
else
    print("not enough money!")
end
23 Likes