[SOLVED] The word "require" made any model not distributed on Creator Store

Help and Feedback Scripting Support
1

Edit: as of November 7, 12:27 PM, this issue has been fixed.

Roblox’s Creator Store automatically moderates any assets if you attempt to publish them.
This automated system flags any content that may obscure engine features, such as getfenv and setfenv, script execution, including Custom Lua Virtual Machines, and the requirement of remote assets.

Since requiring remote assets was flagged in free models, the solution Roblox used was to moderate require(assetId), loadstring, InsertService:LoadAsset(), and ModuleScript.LinkedSource.

This solution worked decently at preventing free models from having backdoors, along with the human moderation, the issue was effectively dead. Years ago, importing any free model with a script carried a significant risk of your game being infected with malicious code; nowadays, that risk is nearly eliminated, especially with the implementation of verified creators.

However, as of today, Roblox has changed this moderation system. They haven’t announced this at all, and even the documentation for the Creator Store Asset moderation states that require(assetId) is what causes a model to not be allowed to be distributed on the Creator Store. Now, any mention of the word “require” results in a model not being allowed to be published on the creator store.

For example, this script:

print("require")

Results in a violation of the Roblox Community Standards, resulting in your model not being distributed on the Creator Store.

3 Likes
2

So basically they’re encouraging monolithic scripts? Cool.

3

this is what happens when a company doesnt have internal communication, the asset moderation team mustve thought “require is can be used for bad, so lets just ban all mentions of it”.

i made this post and an actual bug report, but i doubt anything will be done until they get flooded with appeals for falsely banned assets.

4

Roblox when

function require(x)
    if typeof(x)=="number" then print("Malicious!") end
end

On a more serious note, I’m developing a tool that scans require chains/trees. Hopefully Roblox uses something similar instead of a regex filter without parsing.

Seriously, they had access to bytecode, they had access to an AST, and a regex filter is what they come up with?

Malicious scripts can still get around this!

1 Like
5

what if you do

getfenv()['req'..'uire']
6

getfenv is flagged so you cant use that

1 Like
7

This bug has been fixed.