Place access list deserialization guards

[LukaszRozmej]

Changes

• Custom AccessListForRpc deserialization
• Guards memory usage when spammed with huge request to eth_sendTransaction

Types of changes

What types of changes does your code introduce?

• Other: input parsing hardening

Testing

Requires testing

• Yes

If yes, did you write tests?

• No

Notes on testing

Existing tests should cover it.

Documentation

Requires documentation update

• No

Requires explanation in Release Notes

• No

[benaadams]

Tests?

[Copilot]

Pull Request Overview

This PR adds security hardening to the AccessListForRpc deserialization to prevent memory exhaustion attacks when processing large or malicious requests to eth_sendTransaction. The implementation replaces automatic JSON deserialization with manual parsing that enforces strict limits on the number of access list items and storage keys.

Key Changes:

• Implemented custom JSON deserialization with memory usage guards
• Added configurable limits: max 1000 items per access list, max 1000 storage keys per item, max 10000 total storage keys
• Enhanced input validation with explicit checks for expected JSON token types

[Copilot]

[nitpick] The variable keyCount tracks storage keys per item while storageItemsCount tracks total storage keys across all items. Consider renaming keyCount to itemStorageKeyCount or keysInCurrentItem to clarify the distinction and improve code readability.

[benaadams]

Existing tests should cover it.

Shouldn't they be failing now if they covered? Since you are throwing new exceptions

[LukaszRozmej]

Tests?

There are standard tests for this endpoint, they still work (and helped me to fix a bug).

I generated base for this code with ChatGPT and didn't have to do much changes, so AI: