🛡️ Insufficient Input Validation in Objectarium Bucket Instantiation about contracts HOT 3 CLOSED

My 2 cents:

Restricting the character sets for bucket names in our smart contract is irrelevant to me. Front-end applications typically sanitize input to mitigate security risks (such as XSS), making the risk of security issues from uncleaned names practically non-existent. Furthermore, imposing such restrictions could prevent users from using international characters or special symbols, which might be essential for their needs.

Additionally, in blockchains, the larger the data, the higher the cost, creating a natural deterrent against abuses such as entering extremely long strings. In my sense, this cost-based deterrent is an effective and direct way to discourage abuse without needing additional restrictions.

Important to note that if the security analysis recommendation were implemented, it would need to apply to all textual fields across all our smart contracts, including the cognitarium, making the implementation extremely significant and impactful.

from contracts.

I totally agree with you @ccamel, this would bring an opinionated API on matters that are in the scope of the network's token model & the client's responsibility.

I'd be in favour of closing this one.

from contracts.

The team has reviewed this issue and agreed to decline it.

from contracts.