Provide a better mechnanism for running user-created in-experience Luau code

Feature Requests Engine Features
1

As a Roblox developer, it is currently unperformant to run Luau code within an experience that users create in those experiences.

Capabilities was a step in the right direction, but theres issues with loadstring besides just isolating the environment.

Most notably, performance. Luau has a mechanism to deoptimise certain bytecode operations if the environment is tampered with, loadstring is considered to be a function that tampers with said environment (somehow). One of the major losses to this is fastcalling.

If Roblox were to address this issue, it would improve my development experience as I could create educational experiences, or puzzle games involving Luau as a language, without needing to worry about a major performance loss caused by the lack of FASTCALL functionality.

4 Likes
2

With improvements to sandboxing coming, there’s some HUGE possibilities for user-generated content to be inserted and ran inside games (given proper precautions, of course). Would love to see this loosened up; I personally have long-time plans that can finally be realized once sandboxing has matured.

4

This request asked for a way to run Luau code in the engine while the game is running thats more reliable than loadstring, not a new feature to Luau itself.

5

My response was intended for a different thread. Sorry about that!

For this particular feature request I would like to understand more about the specific use-case you had in mind when making this thread.

6

I was theory crafting a Luau education experience that allowed the user to step through code while keeping the environment safe. Manually tampering with the environment through setfenv is extremely dangerous and has a lot of pitfalls, I get SecurityCapabilities exist to fix this issue, which is what I’d prefer to use here.

The problem is it’s not very obvious how to apply said capabilities to a function spawned through loadstring, let alone all the performance issues (because the environment can be tampered with). I haven’t found a reliable method that both allows me to disable most DataModel operations and also run code in a way users can interface with (If I disable RemoteEvent, there’s no reliable way of sending the code to the script, and its also likely I’d disable LoadString as well, which means we’re back to square one unless I tamper with the function env).

It should be possible to just call a method in a service to run arbitrary code like this, while passing in a SecurityCapabilities object, without needing to rely on hacks or needing to tamper the function environment.