No character limit for player nicknames, leads to memory issues and crashing

Introductory Description There is no apparent character limit for player nicknames. By abusing this it is possible to render a roll20 game completely unusable as this allows you to get around any chat character limit. This was first tested using the famous "Navy Seals" copy pasta, after which a player added a few thousand "i"s to their name, and then another (Me) changed their name to this word list&nbsp; <a href="http://www.mieliestronk.com/wordlist.html" rel="nofollow">http://www.mieliestronk.com/wordlist.html</a> &nbsp;and typed in chat, causing severe lag leading to chrome terminating the webpage. We then went on to do a few tests to reproduce the issue. Here are our findings. Credit to my fellow users, UnoriginalName and Servana for assistance with testing. How to Reproduce &amp; Solution Make a new game in roll20. Invite a friend. Open the settings tab, and change your nickname to something absurdly long (for testing I used this list of 58,000+ words&nbsp; <a href="http://www.mieliestronk.com/wordlist.html" rel="nofollow">http://www.mieliestronk.com/wordlist.html</a> &nbsp;) Type a message in chat, alternating between normal messages and /me for maximum effect The browser (Chrome) will now often fail to load the webpage as it exceeds the memory limit. Solution was achieved by the GM kicking and reinviting the players who had the absurdly long names and purging the chatlog and cache. A permanent solution on roll20's side could be achieved by adding a character limit to player's nicknames. I would recommend&nbsp;1000 characters, as that's enough for players to still use it for jokes but not get to the point it starts causing genuine memory issues. Description of setup Chrome, Latest as of 9/26/2020 Tried both with and without extensions/addons. Effects are more pronounced with extensions.&nbsp; Windows 10 64bit, 8gb of RAM (Caused extreme lag for Unoriginal with 32gb but not a crash, hence the concept of this being a memory issue) Javascript enabled.&nbsp; Antivirus completely disabled for this test. Supplemental &nbsp;Information This can have very bizarre&nbsp;side effects, including: Unable to change nickname for several minutes afterward (experienced by Unoriginal only, as they were the only one who was able to load in for a long time) Extreme lag leading to many, many desync issues that would normally not occur (Experienced by all) Freezing of the browser (seen by me and Servana) Severe lag on unrelated roll20 sessions until the user resorts to purging the cache (Seen by me only) Absurd load times for a roll20 session (10+ minutes for my setup, longer for Servana) We were sadly unable to obtain anything in the way of console logs thanks to performance issues and chrome itself managing to freeze.&nbsp; Attached Images (Sidenote: Why is there no support for spoilers? That would be great with large images like the first one here)

I was going to ask why anyone would want to do this. (i.e "don't do this"). But then I realized that a malicious person could use this to sabotage a game. It does seem like a reasonable bug to quash.

keithcurtis said: I was going to ask why anyone would want to do this. (i.e "don't do this"). But then I realized that a malicious person could use this to sabotage a game.&nbsp; Internet being what it is, nothing surprises me anymore. :) Good catch, Kellen.

Thanks folks! Me and my friends just figured it out while we were messing around pre-session, and me being in college for cybersec it came to mind as something easily exploitable, so I thought I'd report the issue. I'll be keeping a eye on this thread incase anything else comes up.&nbsp;

Kellen.&nbsp; I am sure this will not be a high priority since they are embroiled in their UDL Debacle so I wouldn't hold my breath on this getting fixed within the next decade.

They don't read the bug forums that intensly, and encourage reporting bugs through the ticket system, so doing that is the bet best something gets done and registered: <a href="https://roll20.zendesk.com/hc/en-us/requests/new" rel="nofollow">https://roll20.zendesk.com/hc/en-us/requests/new</a>