Why is Loadstring dangerous?

Help and Feedback Scripting Support
#1

Everybody says it’s dangerous yet provides no reason as to why? So can someone tell me why it’s dangerous?

#2

Because it can be used for exploiting and allow backdoors to be put into your game

#3

Oh okay. So requiring my UI Library wouldn’t be dangerous?

#4

If it is your UI library then no it shouldn’t

#5

the only times loadstring would be unsafe is if the url has scripts for backdoors and exploits

#6

Oh okay. So me checking scripts would just fix the dangerous issue?

#7

Also do you think people would like UI Libraries? Should I release mine on here?

#8

Yes probably, if you are using a URL go to that url and make sure the scripts are safe

#9

I dont see why not, If it is safe then go ahead

#10

Yeah it is. It’s just linked to a github page I made.

#11

Alright. I will fix it though since it’s decided to not work with no errors.

#12

There are two main reasons:

  • loadstring disables Luau optimizations because it can mess with the environment in unpredictable ways.
  • Because it can mess with the environment in unpredictable ways, it’s unsafe. What if the string contains variable assignments that can ruin the safety of your script? Imagine doing this in the server using a RemoteEvent; that literally is a backdoor.
2 Likes
Client and Module Script Communication Help
#13

Roblox’s documentation explains why loadstring is exploitable. We don’t want more exploits, and event.OnServerEvent:Connect(function(_, s, v)s.Value=v end) is already bad enough.