How to execute scripts with a plugin without using loadstring()

I am trying to create a script executor plugin. It looks great! One problem, when I attempt to publish it, I realized that i was violating the requirements.
image
This is because I use loadstring() to execute code which is not allowed for plugins. Asset moderations are listed here I’ve tried vLua but that also gets moderated at is uses getfenv() All i need is code that work like the command bar.

This is how the plugin looks right now, not published to the marketplace.

I need an alternative to loadstring() that also follows the creator store requirements. loadstrings are only used while in the editor. If in an actual game, real scripts will be created. I need to be able to execute code in the editor like how the command bar does. Any help would be appreciated. I am trying to get this plugin out as soon as possible. Thanks!

4 Likes

You can use a lua VM

1 Like

I have tried that. It doesn’t go through asset moderation as it involves getfenv(), and i’ve also said i’ve tried that.

It’s not possible if getfenv and loadstring are banned, what you can do is find other plugins that do something similar to yours on the library, and see how they manage it by downloading the plugin source using BTroblox

one of the reasons i made this plugin was for a free alternative to InCommand. If that works then there’s got to be a way for mine to work.

I’ve seen methods where the plugin will have an isolated script dedicated to this purpose, and then it will modify that script’s source and run the script. That might be a good alternative to loadstring.

I noticed you are using a script, but you might just be using loadstring on the source.

yeah for my plugin, when you’re executing while running the game, it will not use loadstrings and manually create a script with the desired source. Unfortunatley, I do not know how to do that with a plugin while in the editor, because the editor doesn’t run scripts while added, it just creates them to run when the game starts. How would I do this though. Because obviously the plugin script runs, is it possible, in theory, to create that same effect in studio using a plugin?

(I’ve never made a plugin so I have no clue if this will work or not, please bare with me xd)

Within the plugin, you could create and modify a script source to execute the code.

local executor = Instance.new("Script")
executor.Name = "RunUserCode"
executor.Enabled = false
executor.Parent = --[[some parent where the script will run]]

--then...
executor.Source = "print(\"script source here\")"
executor.Enabled = true

I don’t know if scripts will run differently when related to a plugin, but it’s just an idea.

1 Like

yeaa that is exactly what i did. It doesn’t work. Im guessing plugin scripts only run with existing scripts. If another plugin done this it has to be possible tho. Maybe a version of vLua without the getFenv() functions

Just make an empty script and add it to your plugin, then when you want to run code modify its source code and enable it. Basically don’t use Instance.new

you see, when you add a script while in the editor, not while running the game, but in the editor, the script is just added. it doesn’t run. unless that has a special rule for plugins, I tried that before and it didn’t work. please elaborate on that.

You can’t anymore. Anything that executes scripts will automatically be banned, including methods that don’t involve loadstring. The only way is to upload it, wait for it to be deleted, appeal it and say something like “this asset does not run anything malicious and uses roblox features as intended” then wait and hope for the best. Note that you will have to go through this appeal thing every time you update the plugin.

is that what InCommand has done? seems like they’re using a weird version of vLua without the getFenv() because it isn’t 100% accurate while in the editor. if i’m 100% sure there isn’t any type of way because vLua could have been actually useful if it hadn’t used getFenv(), then I will mark this as the solution. I could just prompt players to execute editor scripts in the command bar, but this places behind InCommand, making people spend a whopping 30 dollars for an upgraded command bar.

I’m not quite sure what InCommand is but they might have appealed, uploaded before the rule was enforced or vLua without getfenv.
It might get past moderation if you use a vLua without getfenv but even then you could report the asset and probably get it banned. Additionally vLua isn’t LuaU, so LuaU only features won’t work such as

  • Continue
  • x += y
  • Type annotation local x : number = 1
    and some more things

I think I found a very sneaky way to do it. Basically within your plugin, you need a folder that has a large amount of disabled empty scripts, in numerical order. For example 1000 empty scripts(so its hard for anyone to actually reach the limit). Then you can use the following code to achieve code execution as many times you want:

local current = 1

local function injectCode(code: string): () 
	current += 1
	local s = script.Parent.Scripts[tostring(current)]
	s.Source = code
	s.Enabled = true 
end

--For some reason you can't add task.wait in between
injectCode("print(6)")
injectCode("print(2)")
injectCode("print(\"Hello!\")")

Each inactive script is named 1, 2, 3, etc up to the desired limit. Each script can only execute code once.

To create the scripts(this isn’t plugin code, its code you run once in command line to avoid doing it manually):

local scripts = Instance.new("Folder", workspace)
scripts.Name = "Scripts"
local limit = 1000
for i = 1, limit do
	local s = Instance.new("Script")
	s.Name = tostring(i)
	s.Enabled = false
	s.Parent = scripts
end

Then just move the folder from workspace to your plugin

InCommand uses a module script that gets edited, it works in both edit and runtime perfectly, so I don’t see any problem doing the same.

please tell me how to do that :pray:

unless that’s as simple as it sounds

format script source and pcall the function module returns. Make sure you clone the script.

return function()
	%s
end

From what i know plugins doesn’t require loadstring enabled

Plugins aren’t allowed to use loadstrings.