How to Safely Validate Client-Sent HumanoidDescription Data for Custom Avatar Rigs?

Help and Feedback Scripting Support
, , ,
1

Hi everyone

In my game I am working on a feature where players can spawn or create custom rigs using an avatar shop interface.
Everything works on the client side but I am unsure about the safest and most efficient way to sanitize and validate the data before applying it on the server.

Currently the client sends a table containing relevant HumanoidDescription
properties for example

{
	Accessories = HumanoidDescription:GetAccessories(true),
	HumanoidRigType = Selected == R15 and Enum.HumanoidRigType.R15 or Enum.HumanoidRigType.R6,

	Scale = {
		BodyTypeScale = HumanoidDescription.BodyTypeScale,
		ProportionScale = HumanoidDescription.ProportionScale,
		HeadScale = HumanoidDescription.HeadScale,
		HeightScale = HumanoidDescription.HeightScale,
		WidthScale = HumanoidDescription.WidthScale,
		DepthScale = HumanoidDescription.DepthScale,
	},

	BodyColors = {
		HeadColor = HumanoidDescription.HeadColor,
		TorsoColor = HumanoidDescription.TorsoColor,
		LeftArmColor = HumanoidDescription.LeftArmColor,
		RightArmColor = HumanoidDescription.RightArmColor,
		LeftLegColor = HumanoidDescription.LeftLegColor,
		RightLegColor = HumanoidDescription.RightLegColor,
	},

	BodyParts = {
		Head = HumanoidDescription.Head,
		Face = HumanoidDescription.Face,
		Torso = HumanoidDescription.Torso,
		RightArm = HumanoidDescription.RightArm,
		LeftArm = HumanoidDescription.LeftArm,
		RightLeg = HumanoidDescription.RightLeg,
		LeftLeg = HumanoidDescription.LeftLeg,
	},

	Clothes = {
		GraphicTShirt = HumanoidDescription.GraphicTShirt,
		Shirt = HumanoidDescription.Shirt,
		Pants = HumanoidDescription.Pants,
	}
}

The problem is I am not sure what the best approach is for validating this data once it reaches the server

My first idea was to use AvatarEditorService:GetBatchItemDetails to check all asset IDs at once instead of MarketplaceService:GetProductInfo or AvatarEditorService:GetItemDetails repeatedly but I have read that AvatarEditorService:GetBatchItemDetails has strict throttling limits

I also considered using Enum.AssetTypeVerification with Always when applying the description, but during testing I noticed it can occasionally throw errors and it also makes managing accessory refinement more difficult.

1 Like
2

for validation you can use early returns/typeof/type.

If something needs to be validated for being a table/string/number its better to use type() over typeof() for optimization.

You can use MarketplaceService for checking existance of asset.

1 Like
3

I make sure to check the type of things and only use typeof when type is not enough, but my problem is deciding which method to use for validating assets like ProductInfo or BatchItemDetails, or simply relying on Enum.AssetTypeVerification.

1 Like