Script/metadata relay ignores receiveAudio/receiveVideo enabling bandwidth DoS

[cursor]

Summary

A publisher can flood Script/Metadata frames to players who explicitly disabled audio and video via receiveAudio(false) / receiveVideo(false).

Attacker

Any RTMP publisher authorized (or unauthenticated on the built-in relay) for a route.

Controlled input

RTMP_MSG_AMF0_DATA / Script frames (onMetaData, @setDataFrame, etc.), up to DEFAULT_MAX_MSG_LENGTH (4 MiB) per message.

Attack path

1. Player connects and plays a stream, then sends receiveVideo(false) and receiveAudio(false).
2. Stream.receive_video / receive_audio are set to false in handle_command.
3. Live relay: conn_will_receive_relay_frame() only gates FrameType::Audio and FrameType::Video; FrameType::Script / FrameType::Metadata always pass.
4. Init-cache replay: metadata is sent unconditionally before the receive_video / receive_audio checks.

Impact

Bandwidth and CPU amplification against players that opted out of A/V. A publisher can push multi-megabyte script/metadata frames to every player on the route regardless of their receiveAudio/receiveVideo settings.

Location

src/server/mod.rs

Remediation

Gate Script/Metadata relay (live and init-cache replay) when both receive_audio and receive_video are false, consistent with the intent of the receive toggles.