TextChatService misuse via SendAsync leads to Account Terminations / IP bans

Bug Reports Roblox Application and Website Bugs
,
1 
local TextBox = script.Parent

TextBox.FocusLost:Connect(function(__)
    if __ then
        game:GetService("TextChatService").TextChannels:WaitForChild("RBXGeneral"):SendAsync(TextBox.Text) -- > you can put any string here
    end
end)

someone abusing this could, for instance, lure you into a game and make you paste a “code” for example, to join a “private server” or a “lobby” into a TextBox. that “code” could then be decoded into an extremely racist / exploitative message, which then gets forcibly sent into chat under your account. Then all somebody has to do is report your message via the UI, and you will be unknowingly and unfairly banned or terminated.

heres what an example looks like if you become a victim to this;

TrF5lPt
TrF5lPt431×263 50.6 KB

A private message is associated with this bug report

5 Likes
4

I am appalled that this issue is still running rampant on this platform. Roblox Developers should not be allowed to alternate the text contents of someones message, and if they do, it shouldn’t be treated as the end user that inputted that message.

Surely there is some way for Roblox to distinguish Developer made messages from Player ones?

5

Oh what’s that TextChatService isn’t foolproof and it doesn’t resolve safety vulnerabilities that LegacyChatService had? That is not surprising at all

It’s incredibly disappointing how roblox doesn’t have a feature to detect and stop message hijacking like this

3 Likes
6

And the fun fact that they tried to fix the problem by wiping the legacy chat from the entire platform :smile:

1 Like
7

I think this public method “:SendAsync” (for players) was added to make sure that any custom chat systems are regulated with Roblox’s backend and not just a simple string filter, making it possible to report people that say wrong things in chat (which iirc simple text filtering does not). I don’t really see any other regular uses for it.

This will obviously create some problems here, the best bet Roblox has is to not take into consideration those strings sent to the server in reports, and only filter them.