`plugin:SetSetting` silently fails if the key includes `.` or `\`

plugin:SetSetting silently fails to set if the key has a period in it.

Reproduction:

This should be ran as a plugin. A public plugin and local plugin both do the same thing.

-- Modified example from
-- https://create.roblox.com/docs/reference/engine/classes/Plugin#SetSetting

local ShouldBreak = true
local key = ShouldBreak and "Ke.y" or "Key"

local times = plugin:GetSetting(key) or 0
times += 1
plugin:SetSetting(key, times)

if times == 1 then
	print("This is your first time!")
else
	print(`Ran {times} times so far!`)
end

warn("After SetSetting:", plugin:GetSetting(key))

--[[
	The warning will print a number if ShouldBreak is false.
	If ShouldBreak is true, it is nil with seemingly no reason.
]]

Now we know not to put periods in the key. Here’s a quick tester to see which keys worked and which failed!

local function test(char: string): boolean
	local tests = {
		`{char}AB`,
		`A{char}B`,
		`AB{char}`,
		char,
	}
	
	for _, str in pairs(tests) do
		plugin:SetSetting(str, true)
		if not plugin:GetSetting(str) then
			return false
		end
	end
	
	return true
end

local tests = {
	"A",
	"!", ".", ",", "?", "_", ";",
	"1", "9", "0",
	"(", ")", "[", "]",
	" ", "<", ">",
}

for _, v in pairs(tests) do
	local result = test(v)
	if result then
		print(v, "passed.")
	else
		warn(v, "failed.")
	end
end

image

The output of this shows that ONLY the period has failed. Every other character passes the test.

Specifications:

OS: Windows 11
Version: 0.622.0.6220470
Relevant Settings: Plugin Debugging, Show CoreGui, Show PluginGuiService, Autocomplete Plugin-Security
Beta Features: Video attached.

PS: I have wasted a few hours trying to fix my code. It took a while, but I finally suspected it wasn’t my fault! I used the key v1.0.0, which of course had a period. :sweat_smile:

Expected behavior

I expect all keys to work. If they don’t, I expect an error saying it cannot save the setting.

6 Likes

Interestingly, the \ character has failed as well.

image

It also starts complaining with asynchronous errors when you test that character. I suspect that an engineer has patched some file system vulnerability by blocking these characters. The solution would be to throw an informative error like `Failed to set setting. Try only using alphanumeric characters!

3 Likes

Must be why my save system isn’t working. This should at least be documented or fixed

3 Likes

That’s because . and \ are special characters in .json files.

  • . is used as a separator for object keys
  • \ is an escape character

Read more about it here:

4 Likes

What’s happening here is that the settings serializer replaces the dots (.) with an underscore (_). It’s recommended not to use dots though, or replace them yourself.

I’ll update the docs to reflect this.

If it does that, how come it still fails to set? :thinking:

Isn’t the GetSetting() failing?

I think if you try SetSetting("A.B", true) then GetSetting("A_B") should succeed…

I see. I believe it should replace the . with a _ in both SetSetting and GetSetting then?

That would work as long as you only use either. If you have a key “a.b” and also “a_b” then auto replace might get confusing…

I updated the docs for now: Plugin | Documentation - Roblox Creator Hub – the proper fix might take a bit more.

1 Like