Project-Pandora-Game / pandora

https://project-pandora.com
Other
11 stars 3 forks source link

Limit all user inputs to reasonable values #432

Open ClaudiaMia opened 11 months ago

ClaudiaMia commented 11 months ago

The goal is to prevent the scenario that someone can flood the database by being able to write huge amounts of data to it.

To that end, all input fields of the client shall be limtied to reasonable character limits and validated on the server-side.

That includes:

I believe we can be generous with room description, item name and description and biographies, allowing maybe up to 10000 characters, as both character and rooms per account are limited.

For item templates we can also be generous and allow something like up to 2000 characters if we limit the amount of item templates that can be stored in the database per asset and make this not character, but account specific. For more, users will have export/import. Same for room templates in the future.

Sekkmer commented 11 months ago

Since DMs are encrypted using AES-GCM 256, and then Base64 encoded, whatever character limit we set should be increased by roughly 35-40% at least when checked by directory.