If I need to fix up my question in any way please let me know, this is my first question on the site
So there's a game development website I use where you can develop with other people, and within the past few months they introduced a new feature where you can get into the editor with other people. Now, here's the thing. They heavily sandbox things, and for good reason, so in game you can't send http requests from a user's computer, but due to how the game creation tool works, there's a small bug that would allow you to do this.
The worst thing I've thought of being able to do with this is snag someone's IP, which isn't exactly a terrible thing, it's a public IP afterall, but I'm curious if it's possible to infect their computer, give them a virus, or anything else damaging, just by having them send a GET/POST request to a website, and if so how this would work?
I want to convince the creators/designers of the site and development tools to make a fix for this, and a real threat would help my argument a lot. But I can't make the claim without evidence. Is there any real threat to the person sending the request here?