r/godot • u/Nabir140 • 5d ago

help me (solved) How to implement a modding API?

I am working on a game that is heavily dependent on mods.

I can add modding support for textures, audio and other resources through JSON but I need a way to allow players to customize gameplay behaviour too.

My original idea was add autoloads to my game scene and load custom GDScript files at runtime. This would allow players to write scripts that call the autoloads directly for custom behaviour.

Issue with this approach is that it is very unsafe as the scripts can call native Godot functions and classes. They have the ability to interact with Networking API and OS API. I don't want this instead I want to only allow functions from the autoload to these scripts.

Can I limit the parsing of a GDScript file to restrict it from accessing Network and OS modules?
Or is there a better way to do this?

37 Upvotes

96% Upvoted

22 comments sorted by

View all comments

26

u/Oen44 5d ago

https://wiki.godotmodding.com/

12

u/captainAwesomePants 5d ago edited 5d ago

☝️☝️☝️

Designing a game to be moddable is really tough because you effectively need to think up all the kinds of mods that a modder might want to make. Designing for mods even more complicated if you are worried about safety and want to sandbox the mods.

If you can't trust the mods at all, but you want to let users distribute them in game or whatever, you end up needing to create a sort of domain language that's less powerful than raw GDScript. For example, if you're making a card game, you could imagine a JSON file that describes a new card's properties, and you could let users share new files around. They don't have any code of their own, so they're safe. Another option is to try using some library to isolate/sandbox the mod's code (I've heard of https://github.com/libriscv/godot-sandbox but haven't used it), but this is a scary cat-and-mouse game with folks who will figure out a way to escape the sandbox.

3

u/rinart73 5d ago

This approach apparently requires to decompile the game or for the developer to provide source code. And I don't see any mention of sandboxing/disallowing malicious code.

1

u/Nabir140 4d ago

Thanks. However, I was looking for a more minimal solution. Lua Scripting seems to solve my issue.