OpenLoco / ObjectEditor

A modern implementation of 'LocoTool' for dat file parsing
7 stars 2 forks source link

Potential DoS when requesting vanilla object information #74

Open LeftofZen opened 1 month ago

LeftofZen commented 1 month ago

The web client in the editor caches successful downloads it receives from the object repository, but since the object repository doesn't send vanilla object data (but it does index/list them) then the user can repeatedly query for these objects until the rate limiter kicks in, which is a global service and will deny any other users access for the period until tokens are replenished.