getCoverArt.view unfiltered parameters can lead to DOS

[zapt0]

You can call the getCoverArt view and specify an arbitrarily large size parameter, which will generate a large image and tie up server resourced for up to a minute. The only upper limit seems to occur when the album art thread crashes from the excess memory usage.

Example call:
/rest/getCoverArt.view?v=1.6.0&c=subweb&f=json&size=9001&id=<album art id>

[ytechie]

You do realize though that you need to add the username and password to the url?

[zapt0]

You do realize though that you need to add the username and password to the url?

Absolutely, this only works if you already have access to an account on the server, but considering some servers are public it's still a problem.