Integer overflow attack mitigation in Spring Rest API
Solution 1:
This has nothing to do with converting the string to a valid integer. That is already taken care of by Spring.
The actual issue is described on the OWASP ZAP page. A very large page number may overflow to a negative number after addition, resulting in possible unexpected behaviour in your application. Consider, for example,
https:/...?pageNumber=2147483646&pageSize=100
The pageNumber
is a perfectly valid int, with value Integer.MAX_VALUE - 1
. But if your application then adds pageSize
to it, it will overflow. You can mitigate by validating pageNumber
and pageSize
to be within ranges of sensible values, e.g. pageNumber between 1 and 1000000, pageSize between 1 and 10000.