Our homemade RPC implementation, jsonrpc, allows users to invoke multiple RCP methods using a single request, using batching. While this is not a problem, it may constitute a form of attack vector.

By investigating the code, batching is implemented by this method:

Not sure if this is the only method implementing batched requests, but this one was identified by running a test client.

We should consider adding a configuration parameter to limit the size/length of batched RPC requests submitted to Comet. To preserve backwards compatibility, the default value for this parameter can be 0, meaning no limit.