UGC size bypass allows accessories that are thousands of studs wide

Bug Reports Catalog Asset Bugs
#24

This is actually because Roblox’s .mesh format reads every 3 vertices as a triangle, which means even if the edges are clipping together, it still counts as a face. Scaling the mesh will increase the face’s area (and thus the calculated mass) without actually make the mesh bigger.

big.obj (319 Bytes)

The fake limbs are meant to trick the transparency validator.
This is some evil genius stuff.

#25

Hey guys. Here’s some news for you:

image
image2194×1817 323 KB

Essentially, a check has been added that should hopefully prevent some, if not all of these massive UGC items from being uploaded from now.

I’m working with an engineer or two to resolve this vulnerability along with a few other ones involving crashing, massive avatars, etc. Hopefully these issues should all be resolved in the coming days and weeks.

3 Likes
#26

This is the worst check code ever. I optimized it, if it helps:

if FFlagUGCValidationPositionCheck then
	local maxBounds = 10000
	local axes = {"X", "Y", "Z"}
	for _, v in ipairs(axes) do
		local a1 = handle.Position[v]
		local a2 = boundsCF.Position[v]
		if math.abs(a1) > maxBounds or math.abs(a2) > maxBounds then
			return false, { "Position is outside of bounds" }
		end
	end
end
5 Likes