fix: Close integer validation bypass and query parser differential

Two validation bypasses surfaced in a security review of the request
pipeline:

- checkInteger narrowed numbers with longValue() before bound-checking,
  so a fractional Double (4.9) satisfied `type: integer` and a value above
  2^64 wrapped past a declared maximum. It now rejects non-integral numbers
  and compares the full magnitude, keeping an allocation-free long path for
  the common case and falling back to BigDecimal/BigInteger otherwise.
- Query parameters were validated from the already-decoded URI.getQuery()
  but delivered to handlers from getRawQuery(), so an encoded separator
  (%26) could smuggle a value past a schema constraint. Both paths now
  share QueryParams.parse over the raw query, so the value validated is the
  value the handler receives.

Adds exploit tests asserting both are rejected.

Author: thced

src/main/java/com/retailsvc/http/Request.java

@@ -1,11 +1,9 @@
 package com.retailsvc.http;
 
+import com.retailsvc.http.internal.QueryParams;
 import com.retailsvc.http.spec.HttpMethod;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -265,7 +263,7 @@ public String rawQuery() {
    */
   public Map<String, String> queryParams() {
     if (queryParamCache == null) {
-      queryParamCache = parseQuery(rawQuery);
+      queryParamCache = QueryParams.parse(rawQuery);
     }
     return queryParamCache;
   }
@@ -345,23 +343,4 @@ public void afterResponse(Runnable runnable) {
   public List<Runnable> afterHooks() {
     return Collections.unmodifiableList(afterHooks);
   }
-
-  private static Map<String, String> parseQuery(String query) {
-    if (query == null || query.isBlank()) {
-      return Map.of();
-    }
-    Map<String, String> out = new LinkedHashMap<>();
-    for (String pair : query.split("&")) {
-      if (pair.isEmpty()) {
-        continue;
-      }
-      int eq = pair.indexOf('=');
-      String rawKey = eq < 0 ? pair : pair.substring(0, eq);
-      String rawValue = eq < 0 ? "" : pair.substring(eq + 1);
-      out.putIfAbsent(
-          URLDecoder.decode(rawKey, StandardCharsets.UTF_8),
-          URLDecoder.decode(rawValue, StandardCharsets.UTF_8));
-    }
-    return out;
-  }
 }

src/main/java/com/retailsvc/http/internal/QueryParams.java

@@ -0,0 +1,42 @@
+package com.retailsvc.http.internal;
+
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Parses a raw (percent-encoded) URI query string into decoded parameters. Splitting on {@code &}
+ * and {@code =} happens <em>before</em> per-component decoding, so a percent-encoded separator
+ * ({@code %26}, {@code %3D}) stays inside a value instead of becoming a delimiter. Request
+ * validation and handler consumption both parse through here, so the value validated is exactly the
+ * value the handler receives.
+ */
+public final class QueryParams {
+
+  private QueryParams() {}
+
+  /**
+   * Parses {@code rawQuery} (the undecoded query component, e.g. {@code URI.getRawQuery()}) into a
+   * name→value map. Values are URL-decoded with UTF-8. For repeated names the first occurrence
+   * wins.
+   */
+  public static Map<String, String> parse(String rawQuery) {
+    if (rawQuery == null || rawQuery.isBlank()) {
+      return Map.of();
+    }
+    Map<String, String> out = new LinkedHashMap<>();
+    for (String pair : rawQuery.split("&")) {
+      if (pair.isEmpty()) {
+        continue;
+      }
+      int eq = pair.indexOf('=');
+      String rawKey = eq < 0 ? pair : pair.substring(0, eq);
+      String rawValue = eq < 0 ? "" : pair.substring(eq + 1);
+      out.putIfAbsent(
+          URLDecoder.decode(rawKey, StandardCharsets.UTF_8),
+          URLDecoder.decode(rawValue, StandardCharsets.UTF_8));
+    }
+    return out;
+  }
+}

src/main/java/com/retailsvc/http/internal/RequestPreparationFilter.java

@@ -20,7 +20,6 @@
 import com.sun.net.httpserver.Headers;
 import com.sun.net.httpserver.HttpExchange;
 import java.io.IOException;
-import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Locale;
@@ -189,7 +188,7 @@ private void validateParameters(
     for (Parameter p : op.parameters()) {
       String pointer = p.pointer();
       if (p.in() == Parameter.Location.QUERY && query == null) {
-        query = parseQuery(exchange.getRequestURI().getQuery());
+        query = QueryParams.parse(exchange.getRequestURI().getRawQuery());
       }
       String value =
           switch (p.in()) {
@@ -253,19 +252,4 @@ private ParsedBody validateAndParseBody(HttpExchange exchange, Operation op, byt
     validator.validate(parsed, mt.schema(), "");
     return new ParsedBody(parsed, mapper);
   }
-
-  private static Map<String, String> parseQuery(String query) {
-    if (query == null || query.isBlank()) {
-      return Map.of();
-    }
-    Map<String, String> out = new HashMap<>();
-    for (String pair : query.split("&")) {
-      int eq = pair.indexOf('=');
-      if (eq <= 0) {
-        continue;
-      }
-      out.putIfAbsent(pair.substring(0, eq), pair.substring(eq + 1));
-    }
-    return out;
-  }
 }

src/main/java/com/retailsvc/http/validate/DefaultValidator.java

@@ -21,6 +21,7 @@
 import com.retailsvc.http.spec.schema.StringSchema;
 import com.retailsvc.http.spec.schema.TypeName;
 import java.math.BigDecimal;
+import java.math.BigInteger;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.time.LocalDate;
@@ -365,13 +366,40 @@ private static boolean isHextet(String hextet) {
     return true;
   }
 
+  /** Largest magnitude an IEEE-754 double represents as an exact integer (2^53). */
+  private static final double MAX_EXACT_INTEGRAL_DOUBLE = 9007199254740992.0;
+
   private static Optional<ValidationError> checkInteger(
       Object value, IntegerSchema s, String pointer) {
     if (!(value instanceof Number num)) {
       return err(pointer, "type", "expected integer", value);
     }
-    long n = num.longValue();
+    // Fast path: integral wrappers bound-check as a long with no allocation. This is the common
+    // case (e.g. Jackson int/long, Gson integral tokens parsed as Long).
+    if (num instanceof Long
+        || num instanceof Integer
+        || num instanceof Short
+        || num instanceof Byte) {
+      return checkIntegerBounds(num.longValue(), s, pointer);
+    }
+    // Integral doubles small enough to be represented exactly also take the long path.
+    double d = num.doubleValue();
+    if (Double.isFinite(d) && d == Math.rint(d) && Math.abs(d) <= MAX_EXACT_INTEGRAL_DOUBLE) {
+      return checkIntegerBounds((long) d, s, pointer);
+    }
+    // Non-integral (e.g. 4.9), non-finite, or beyond a double's exact-integer range: verify the
+    // value is a whole number and compare the full magnitude so nothing wraps past a bound.
+    BigInteger n;
+    try {
+      n = new BigDecimal(num.toString()).toBigIntegerExact();
+    } catch (ArithmeticException | NumberFormatException e) {
+      return err(pointer, "type", "expected integer", value);
+    }
+    return checkIntegerBounds(n, s, pointer);
+  }
 
+  private static Optional<ValidationError> checkIntegerBounds(
+      long n, IntegerSchema s, String pointer) {
     if (s.minimum() != null && n < s.minimum()) {
       return err(pointer, "minimum", "integer below minimum " + s.minimum(), n);
     }
@@ -394,6 +422,45 @@ private static Optional<ValidationError> checkInteger(
     return OK;
   }
 
+  private static Optional<ValidationError> checkIntegerBounds(
+      BigInteger n, IntegerSchema s, String pointer) {
+    long l;
+    try {
+      l = n.longValueExact();
+    } catch (ArithmeticException outsideLong) {
+      // Magnitude exceeds long range: it is below any Long minimum (if negative) or above any Long
+      // maximum (if positive), and cannot satisfy an int32/int64 format.
+      if (n.signum() > 0) {
+        if (s.maximum() != null) {
+          return err(pointer, "maximum", "integer above maximum " + s.maximum(), n);
+        }
+        if (s.exclusiveMaximum() != null) {
+          return err(
+              pointer, "exclusiveMaximum", "integer not less than " + s.exclusiveMaximum(), n);
+        }
+      } else {
+        if (s.minimum() != null) {
+          return err(pointer, "minimum", "integer below minimum " + s.minimum(), n);
+        }
+        if (s.exclusiveMinimum() != null) {
+          return err(
+              pointer, "exclusiveMinimum", "integer not greater than " + s.exclusiveMinimum(), n);
+        }
+      }
+      if (s.multipleOf() != null && n.remainder(BigInteger.valueOf(s.multipleOf())).signum() != 0) {
+        return err(pointer, "multipleOf", "not a multiple of " + s.multipleOf(), n);
+      }
+      if (s.format() != null) {
+        IntegerFormatCheck check = INTEGER_FORMAT_CHECKS.get(s.format());
+        if (check != null) {
+          return err(pointer, FORMAT_KEYWORD, check.message(), n);
+        }
+      }
+      return OK;
+    }
+    return checkIntegerBounds(l, s, pointer);
+  }
+
   private static Optional<ValidationError> checkNumber(
       Object value, NumberSchema s, String pointer) {
     if (!(value instanceof Number num)) {

src/test/java/com/retailsvc/http/QueryParamSmugglingTest.java

@@ -0,0 +1,52 @@
+package com.retailsvc.http;
+
+import static java.net.http.HttpRequest.BodyPublishers.noBody;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.fail;
+
+import com.retailsvc.http.spec.Spec;
+import java.io.InputStream;
+import java.net.http.HttpResponse;
+import java.net.http.HttpResponse.BodyHandlers;
+import java.nio.charset.StandardCharsets;
+import java.util.List;
+import java.util.Map;
+import org.junit.jupiter.api.Test;
+
+class QueryParamSmugglingTest extends ServerBaseTest {
+
+  @Test
+  void encodedAmpersandCannotSmuggleAValuePastQueryValidation() throws Exception {
+    // Constrain q1 so any value containing '&' or '=' fails validation.
+    constrainQ1ToLowercaseLetters();
+    server = newServer(Map.of());
+
+    // %26 must stay inside q1: the handler would decode q1 to "abc&x=y", so validation must see the
+    // same value and reject it against ^[a-z]+$ (400). The exploit was that validation parsed the
+    // already-decoded query and saw q1="abc" (passing) while the handler received "abc&x=y".
+    var request = newRequest(server, "/params/query?q1=abc%26x=y&q2=ok", "GET", noBody());
+    HttpResponse<String> response = httpClient().send(request, BodyHandlers.ofString());
+
+    assertThat(response.statusCode()).isEqualTo(400);
+  }
+
+  @SuppressWarnings("unchecked")
+  private void constrainQ1ToLowercaseLetters() {
+    try (InputStream in = QueryParamSmugglingTest.class.getResourceAsStream("/openapi.json")) {
+      Map<String, Object> raw =
+          (Map<String, Object>)
+              gson.fromJson(new String(in.readAllBytes(), StandardCharsets.UTF_8), Map.class);
+      var paths = (Map<String, Object>) raw.get("paths");
+      var op = (Map<String, Object>) ((Map<String, Object>) paths.get("/params/query")).get("get");
+      for (Object p : (List<Object>) op.get("parameters")) {
+        var param = (Map<String, Object>) p;
+        if ("q1".equals(param.get("name"))) {
+          ((Map<String, Object>) param.get("schema")).put("pattern", "^[a-z]+$");
+        }
+      }
+      spec = Spec.from(raw);
+    } catch (Exception e) {
+      fail(e);
+    }
+  }
+}

src/test/java/com/retailsvc/http/validate/StringIntegerNumberTest.java

@@ -8,6 +8,7 @@
 import com.retailsvc.http.spec.schema.NumberSchema;
 import com.retailsvc.http.spec.schema.StringSchema;
 import com.retailsvc.http.spec.schema.TypeName;
+import java.math.BigInteger;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -225,6 +226,39 @@ void integerMultipleOf() {
         .isEqualTo("multipleOf");
   }
 
+  @Test
+  void integerRejectsFractionalDouble() {
+    // Exploit: a Double with a fractional part must not satisfy `type: integer`. Master narrowed
+    // via
+    // longValue() before the bound check, so 4.9 slipped through minimum/maximum as 4.
+    IntegerSchema s =
+        new IntegerSchema(Set.of(TypeName.INTEGER), 1L, 5L, null, null, null, null, Map.of());
+    assertThatThrownBy(() -> v.validate(4.9, s, "/v"))
+        .isInstanceOf(ValidationException.class)
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("type");
+  }
+
+  @Test
+  void integerAcceptsIntegralDouble() {
+    IntegerSchema s =
+        new IntegerSchema(Set.of(TypeName.INTEGER), 1L, 5L, null, null, null, null, Map.of());
+    assertThatCode(() -> v.validate(4.0, s, "/v")).doesNotThrowAnyException();
+  }
+
+  @Test
+  void integerRejectsValueOverflowingLongPastMaximum() {
+    // Exploit: 2^64 + 50 narrows to 50 via longValue(), sneaking past maximum:1000. The full
+    // magnitude must be compared so the bound cannot be wrapped.
+    IntegerSchema s =
+        new IntegerSchema(Set.of(TypeName.INTEGER), 0L, 1000L, null, null, null, null, Map.of());
+    BigInteger huge = BigInteger.TWO.pow(64).add(BigInteger.valueOf(50));
+    assertThatThrownBy(() -> v.validate(huge, s, "/v"))
+        .isInstanceOf(ValidationException.class)
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("maximum");
+  }
+
   @Test
   void numberAcceptsDoublesAndIntegers() {
     NumberSchema s =