graphql: don't allocate greedily

[holiman]

The graphql code greedily allocated for the response. A query such as

{ "query": " { blocks(from:-2147483647 to:2147483647) {number hash parent { number hash } }}" }

Would thus instantly allocate space for 4 Bn pointers, going out of memory.
With this change, it will still go out of memory, but much slower.

A more rigorous fix requires us to add limits, so that anything which returns a list of things is capped at some point.

---

PSA: Graphql is not secure, it should not be exposed in untrusted environments, such as the internet. This has been said before, and apparently cannot be said too often.

[s1na]

LGTM, will merge on green

[gln7]

I thought my issue is invalid and wont be fixed.
Some project believe it is safe to expose graphql https://wiki.polygon.technology/docs/pos/reference/default-ports/ , graphql has can-be-public status.

[jsvisa]

@gln7 what's your issue? You can submit an issue and then refer to this PR if you think it's relevant

[gln7]

@gln7 what's your issue? You can submit an issue and then refer to this PR if you think it's relevant

I reported it to your bug bounty program on Monday, got a response that the bug is invalid. Anyway, i was glad to help.

[holiman]

@gln7 Thank you for reporting!
I received your report indirectly, and did not answer you directly -- I am not sure what the exact phrasing was on the response you got.

We never meant that "the bug is invalid". Indeed, it is a valid bug -- what we wanted to convey was that the bug was not in scope for a bounty, because we already consider the graphql surface to be privileged. That is: if an attacker can access the graphql endpoint, the attacker can probably somehow bring the machine down or make it consume resources to make it no longer able to keep up with the chain. Hence why I posted this bug so openly.

See also the bounty rules

Vulnerabilities requiring the user to have publicly exposed an API, such as JSON-RPC or the Beacon API, is out of scope of the bug bounty program.

Sorry for not crediting you in the PR description / commit message. Now that I look closer, I see that I could have found your github-handle via the supplied gist.

[gln7]

@holiman Thanks for the answer!