feat: add deserde check for JsonStorageKey

crates/serde/src/storage.rs

@@ -1,5 +1,8 @@
 use alloc::collections::BTreeMap;
-use alloy_primitives::{ruint::ParseError, Bytes, B256, U256};
+use alloy_primitives::{
+    ruint::{BaseConvertError, ParseError},
+    Bytes, B256, U256,
+};
 use core::{fmt, str::FromStr};
 use serde::{Deserialize, Deserializer, Serialize};
 
@@ -70,6 +73,10 @@ impl FromStr for JsonStorageKey {
     type Err = ParseError;
 
     fn from_str(s: &str) -> Result<Self, Self::Err> {
+        if s.len() > 64 && !(s.len() == 66 && s.starts_with("0x")) {
+            return Err(ParseError::BaseConvertError(BaseConvertError::Overflow));
+        }
+
         if let Ok(hash) = B256::from_str(s) {
             return Ok(Self::Hash(hash));
         }
@@ -236,10 +243,14 @@ mod tests {
         let hex_str = "0x0101010101010101010101010101010101010101010101010101010101010101";
         let key = JsonStorageKey::from_str(hex_str).unwrap();
         assert_eq!(key, JsonStorageKey::Hash(B256::from_str(hex_str).unwrap()));
+    }
+
+    #[test]
+    fn test_from_str_with_too_long_hex_string() {
+        let long_hex_str = "0x".to_string() + &"1".repeat(65);
+        let result = JsonStorageKey::from_str(&long_hex_str);
 
-        let num_str = "42";
-        let key = JsonStorageKey::from_str(num_str).unwrap();
-        assert_eq!(key, JsonStorageKey::Number(U256::from(42)));
+        assert!(matches!(result, Err(ParseError::BaseConvertError(BaseConvertError::Overflow))));
     }
 
     #[test]