The weaknesses and problems with loadstring

[rgonhplib46359]

what are the weaknesses of loadstring because my map system runs code from a string value

I had a warning that loadstring can be exploited, but my map system gets the string from a certain string value and the string as code.

[spvp1234 (Thug)]

Just don’t use loadstring at all. I would avoid it at all costs. Can’t you import the code or is it just build in to that string value?
Here is a pretty helpful reply and check out the full post too:

Wut is loadstring?

loadstring in its heyday presented a bevy security issues, especially back before the implementation of the client-server division. Disabling the feature by default is more to protect developers who don’t know about it or how to protect themselves from it, especially due to its prevalence in malicious code that those developers may not understand or even know how to detect. It in and of itself is not a bad thing, and using it with bytecode strings was once a reasonable way to obfuscate one’s co…

EDIT: I don’t mean like avoid at ALL costs, if you really need it go for it. It can be used to playtest and run servers like ykyk. But here’s the thing, you should only run LoadString() on the Server as that’s trusted more than the client.

[rgonhplib46359]

Maybe that is a alternative to just import a code from a disabled script than running code from a string value.

But What are the problems and weaknesses of “loadstring” though?

How many of those Lua functions are there?

[spvp1234 (Thug)]

I’m not the one to answer that, but here is another helpful page for this about bad practices:
https://devforum.roblox.com/t/what-are-your-roblox-specific-code-smells/427709/10

This also a funny one:

How would I find a list of dangerous functions?

Well if the script is obfuscated, that’s a good indicator that the script is malicious. But you can probably just do ctrl + shift + f and search for key words. Here are some I can think of off of the top of my head: getfenv (biggest one, there is no reason to be modifying the script’s environment) require (inspect the required asset’s source to be safe. Some known, reputable models like HD admin use it to load modules that need to be updated in near-realtime which isn’t malicious.) \ (for wri…

You get the idea, usually these functions will be very rarely seen. I mean not even myself I’m familiar with these functions, like idk what Getfenv() does or what is string.reverse(). A lot of these have to do with degraded performance in scripting and exploiting using executers externally.

Thanks