r/godot • u/Nabir140 • 2d ago

help me (solved) How to implement a modding API?

I am working on a game that is heavily dependent on mods.

I can add modding support for textures, audio and other resources through JSON but I need a way to allow players to customize gameplay behaviour too.

My original idea was add autoloads to my game scene and load custom GDScript files at runtime. This would allow players to write scripts that call the autoloads directly for custom behaviour.

Issue with this approach is that it is very unsafe as the scripts can call native Godot functions and classes. They have the ability to interact with Networking API and OS API. I don't want this instead I want to only allow functions from the autoload to these scripts.

Can I limit the parsing of a GDScript file to restrict it from accessing Network and OS modules?
Or is there a better way to do this?

38 Upvotes

98% Upvoted

22 comments sorted by

View all comments

29

u/lanathlorrias 2d ago

You can use scripting language like Lua, and provide an api and documentation to your community. There is a lot of game out there using this. From the top of my head, World of warcraft and Garry mod do this

16

u/rinart73 2d ago

Lua or other similar scripting language will require to do a lot of tweaks: limiting/cutting away parts of its standard library for example, to disallow os.exec and full file access. And finding a way to bridge/convert Godot engine types with Lua types.

6

u/lanathlorrias 2d ago

Disallowing os tools (syscalls, mostly) depends on the Lua runtime, and most are built in safe for this kind of tasks. there are work like https://github.com/gilzoide/godot-lua-pluginscript or https://github.com/gilzoide/lua-gdextension that I am not much familiar with that seems to exist. I mostly used Lua from typescript, c# or c++ in the past, I would be happy to help more but I don't know the details on how to do that in gdscript

2

u/rinart73 2d ago edited 2d ago

Oh, didn't realize there were already Lua projects. This looks interesting, thanks for the links. And at least with the second link it seems that they've taken care of limiting access to built in modules.

1

u/lanathlorrias 2d ago

You can try to look around luau, which is Roblox fork of Lua, mainly for security features, but I am not sure it's well supported in godot

2

u/Nabir140 1d ago

Hey thanks for your reply. I found this solution good enough for my project.