I fail to see any real added risk here. Consider: Vacation can be executed
at
most once per incoming message, so the maximum number of database entries
the
vacation action can produce per incoming message is one. So, if the intent
is
to fill up the database, the simplest way to do it is set up regular
vacation
without a handle setting and send in a bunch of messages from different
sources. Note. however, that implementations are free to limit the number of
remembered responses, so this trick will only work if the implementation
allows
it.
The implementation may limit the number of remembered responses, but not
the number of databases. What's a reasonable lowest limit that scripts
should be able to rely on? 100?
I don't know if it's worth an entry under "security considerations", but
allowing the implementation to limit of number of databases sounds useful
to me. I never thought about a script using a large number of them.
Michael