The 5Mb project.json limit should be increased

Thethree13

undeterministic wrote:
skyistumbling wrote:
And we absolutely do not need anymore arbitrary limitations anymore, look again at turbowarp and you can see the spirit of scratch will always be maintained even with all it's limitations removed. It's petty to cling so hard to these “limitations” that can be summed up to a few simple if else checks in the JavaScript code of the Scratch VM. It's absurd.
What are you talking about?! Turbowarp doesn't have the 5 MB limit removed at all.

I also forgot to mention, I don't think they were saying Turbowarp specifically has removed the 5mb limit but that the spirit of scratch is still in turbowarp despite it removing limitations, and comparing that to this? From what I'm deciphering.

undeterministic

Robostew wrote:
undeterministic wrote:
Additionally, I should note that the backend handles this and the CDN may not be in a state to handle more then 5 MB of JSON without changes.
I don't understand what you're saying here. The CDN should only need to worry about entire sb3s. Why should it matter how large the JSON component of the project is if that isn't the limiting factor for project size? Again, the size of assets is !not checked!

Projects can already be very large, but there is an arbitrary 5 MB limit on the size of just the JSON component of the project.

The CDN doesn't store the sb3 in full, it stores each asset and also the project.json individually, this is to save storage space (it allows md5 caching). Like suppose two projects store the same asset twice, scratch has a clever system that puts the same asset in the same file.

Last edited by undeterministic (Oct. 28, 2025 22:45:45)

skyistumbling

undeterministic wrote:
The CDN doesn't store the sb3 in full, it stores each asset and also the project.json individually, this is to save storage space (it allows md5 caching). Like suppose two projects store the same asset twice, scratch has a clever system that puts the same asset in the same file.

So, what's the problem? That sounds even easier to change without any repercussions, you sound like you are just pandering to Scratch Team.

You should go try bruteforce uploading projects yourself, it's obvious their servers can handle it just fine and have already been vulnerable to even malicious payloads for years now. If their servers ever wanted to be abused by the community, it would have already been done quickly and swiftly; and in some past cases it already has.

Last edited by skyistumbling (Oct. 29, 2025 00:22:03)

redspacecat

skyistumbling wrote:
You should go try bruteforce uploading projects yourself, it's obvious their servers can handle it just fine and have already been vulnerable to even malicious payloads for years now.

What even is bruteforce uploading? How do you do it? Isn't the limit server side?

skyistumbling

redspacecat wrote:
skyistumbling wrote:
You should go try bruteforce uploading projects yourself, it's obvious their servers can handle it just fine and have already been vulnerable to even malicious payloads for years now.
What even is bruteforce uploading? How do you do it? Isn't the limit server side?

There's been a few tampermonkey scripts throughout the years that developed alongside the first addons and extensions, many of them let you upload any SB3 files onto their servers or set any image possible as a thumbnail. They were JS injection scripts.

I will try to find the project uploading scripts again, but the most common of these you may know are the original scripts to set project thumbnails as gifs.

CST1229

skyistumbling wrote:
(#163)
You should go try bruteforce uploading projects yourself, it's obvious their servers can handle it just fine and have already been vulnerable to even malicious payloads for years now. If their servers ever wanted to be abused by the community, it would have already been done quickly and swiftly; and in some past cases it already has.

well i know for sure that the current projects/assets uploading endpoints do enforce the current size limits, albeit in the case of project specifically the project.json can be zipped to decrease filesize. (it's different the 2.0 one though, that one is limited to 50mb)

Last edited by CST1229 (Oct. 29, 2025 12:09:50)

Discuss Scratch