Script Capabilities Preview [Client Beta]

Giving access to folder-like services via AccessOutsideWrites would essentially bring back a game I previously had to shut down due to scripting vulnerabilities (Abuse of Ban API, InsertService etc) without having to tell hundreds of its creators (most who will have moved on) to update their maps.

Please make this happen :pray:

7 Likes

Modules required with require(id) seem to escape the sandbox of the requiring script’s container.

I was able to ban myself with Players:BanAsync() using only the RunServerScript and AssetRequire capabilities.

5 Likes

Using getfenv or setfenv is entirely broken when sandboxed even when allowing all permissions, is this intentional due to its enviornment changing nature? Because I had the enviornment sandbox option turned on.

The current thread cannot call 'getfenv' (lacking capability Unassigned)

I had 100% permissions on this localscript, but I couldn’t use any services, including Players.

1 Like

Yes, getfenv and setfenv are not available because they break out of our Sandbox.

1 Like

Will this prevent exploiters from inserting scripts into places like CoreGui?

Hey there, I was acc reading about this lol :slight_smile:
So does this exactly prevent exploiters fully?

This feature has nothing to do with exploits

2 Likes

Noticed I can no longer call game:getdescendants() without an error.

“The current thread cannot access ‘StreamingService’ (lacking capability Assistant)”

I currently do this to iterate through all parts of the game in order to properly setup sounds, clean up some welds etc. Feel like this behavior doesnt need to break, rather it should just not iterate over stuff like StreamingService

Still a problem! When’s the next update?

StreamingService issue is not exactly related to this feature, that issue should now be fixed.

1 Like