[Security] Unbounded WebSocket message size allows memory exhaustion DoS

[coderabbitai]

Summary

No maximum payload size configured on WebSocket servers, allowing memory exhaustion attacks.

Affected Code

• server-services/start-services.js Line 173
• server-game/start-game.js Line 47

Vulnerability

The ws library by default has no hard cap. Single huge messages can OOM the process.

Impact

• Crash services or game servers
• Exhaust memory with single connection

Recommended Fix

Set maxPayload: 1048576 (1 MB) on WebSocketServer instantiation.

References

• PR: New Blocks & Ported fancyMuzzle flash #43