unbounded room creation problem - app DoS mitigation #26

New issue

Closed

opened 2026-05-24 23:31:50 +00:00 by cf7 · 0 comments

cf7 commented

2026-05-24 23:31:50 +00:00

Owner

Might be breaking-

limits pad_ids to 64 characters
default limit to 10000 rooms

Currently any /get request allows the creation of a pad while blocking the RAM which allows a fairly simple DoS.

Kinda difficult to understand atm.

Example: /ws/<1MB-of-random-data> request makes the server save this key which allows to flood the server fairly quickly as there is no limit - same for /get requests.

Might be breaking- - limits pad_ids to 64 characters - default limit to 10000 rooms Currently any /get request allows the creation of a pad while blocking the RAM which allows a fairly simple DoS. Kinda difficult to understand atm. Example: `/ws/<1MB-of-random-data>` request makes the server save this key which allows to flood the server fairly quickly as there is no limit - same for `/get` requests.