Integer overflow attack mitigation in Spring Rest API

Solution 1:

This has nothing to do with converting the string to a valid integer. That is already taken care of by Spring.

The actual issue is described on the OWASP ZAP page. A very large page number may overflow to a negative number after addition, resulting in possible unexpected behaviour in your application. Consider, for example,

https:/...?pageNumber=2147483646&pageSize=100

The pageNumber is a perfectly valid int, with value Integer.MAX_VALUE - 1. But if your application then adds pageSize to it, it will overflow. You can mitigate by validating pageNumber and pageSize to be within ranges of sensible values, e.g. pageNumber between 1 and 1000000, pageSize between 1 and 10000.