For cases where the bots are able to run JS, nailpit should support the ability to fingerprint this capability so that when the rate-limit is reached, we can unleash a JS script bomb instead of a zip bomb in order to freeze/OOM the bot. Users should be able to configure nailpit to serve a spicy page instead of a zip bomb for these types of bots.
The idea is to go OOM & max the CPU as much as possible by:
- Continuously create and add new DOM nodes.
- Loop forever on something that is CPU/Memory intensive, so that it leaks memory.