Is there a way to prevent people from inserting kick() scripts

Help and Feedback Scripting Support
1

is there a way to prevent this from happening? (It’s inserted using InsertService)

Client 
local Player = game.Players.LocalPlayer
local GoToServerEvent = game:GetService("ReplicatedStorage"):WaitForChild("Events"):WaitForChild("GoToServerEvent")

script.Parent.FocusLost:Connect(function()
	local requireid = script.Parent.Text
	
	if tonumber(requireid) then
	     GoToServerEvent:FireServer(requireid)
	else
	     script.Parent.Text = "Ids"
	end
end)
Server 
local GoToServerEvent = game:GetService("ReplicatedStorage"):WaitForChild("Events"):WaitForChild("GoToServerEvent")
local InsertService = game:GetService("InsertService")

GoToServerEvent.OnServerEvent:Connect(function(Player, requireid)
	if tonumber(requireid) then		
		local Asset = InsertService:LoadAsset(requireid):GetChildren()[1]
	
		local loaded, asset = pcall(function()
		    return Asset
		end)
		
		if loaded then
		    asset.Parent = workspace
		end
	end
end)
2

You shouldn’t trust InsertService as a source of assets, as any user can control what is inserted this way. Scripts inside inserted models are not run until they are parented to somewhere which allows script execution, so my suggestion is before you parent an asset, use GetDescendants and remove every Script from the asset, something along the lines of:

for _, descendant in pairs(asset:GetDescendants()) do
if descendant:IsA("Script") then
descendant:Destroy()
end
end

There’s a load of other attacks to think about, such as someone destroying ingame physics with a huge mess, spawning explosions that kill everyone, etc, be very careful with user generated assets.

4 Likes
3

Adding on to what @IntegerUnderflow said, if you absolutely need a way to run third-party code, you should look into implementing a sandboxed Lua-in-Lua VM where you can choose what that code is allowed to do.

2 Likes