Cannot deserialize value of type `java.math.BigInteger` from String

I have a API like below, it receive and process a number that is given by user

@RestController
@RequestMapping(produces = MediaType.APPLICATION_JSON_VALUE)
public class MainController {

    @RequestMapping(value = "/test", method = RequestMethod.POST, produces = "application/json;charset=UTF-8")
    public String test(@Validated @RequestBody InputRequest input) throws Exception {
		return "{\"num\":" + String.valueOf(input.getNum()) +"}";
	}
}


@Getter
@Setter
public class InputRequest{
	private BigInteger num;
}

And then my tester sent a string of junk like "!@#$^!&*" to num field, my API show Http 400 and a line of exception pop up

Resolved [org.springframework.http.converter.HttpMessageNotReadableException: JSON parse error: Cannot deserialize value of type `java.math.BigInteger` from String "!@#$%^&*()_+<>?~!": not a valid representation; ...

Is there any way to block such junk input or handle this exception by my own? Without change the data type of num?

You can create custom deserializer to handle invalid value:

public class BigIntegerDeserializer extends StdDeserializer<BigInteger> {

    protected BigIntegerDeserializer() {
        super(BigInteger.class);
    }
    @Override
    public BigInteger deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext) throws IOException, JacksonException {
        final String input = jsonParser.getText();
        try {
            return BigInteger.valueOf(Long.parseLong(input));
        } catch (final NumberFormatException e) {
            throw new IllegalArgumentException("Value must be a number.");
        }
    }
}

Then annotate that deserializer to your field:

@Getter
@Setter
public class InputRequest {


    @JsonDeserialize(using = BigIntegerDeserializer.class) // Here
    private BigInteger num;
}

In case you want to return the message "Value must a number" back to tester. You can handle the exception using ExceptionHandler:

    @ExceptionHandler(HttpMessageNotReadableException.class)
    public static ResponseEntity<String> handleHttpMessageNotReadableException(
        @NonNull final HttpMessageNotReadableException exception
    ) {
        // Since Jackson wrap your IllegalArgumentException exception before throwing. You have to find the cause exception inside it.
        Throwable rootCause = org.apache.commons.lang3.exception.ExceptionUtils.getRootCause(exception);
        final String message = rootCause.getMessage(); // Value must be a number.
        return ...;
    }

The functionality you see is the expected functionality.

If you want to handle non-number values,
consider changing the handler method to receive a String value and then parse
it yourself.

Here is some sample code:

import org.apache.commons.lang3.math.NumberUtils;

@RequestMapping(value = "/test", method = RequestMethod.POST, produces = "application/json;charset=UTF-8")
public String test(@RequestBody String requestBody) throws Exception
{
	String returnValue;
	
	if (StringUtils.isNotEmpty(requestBody)))
	{
		final InputRequest inputRequest;
		
		try
		{
			inputRequest = objectMapper.readValue(requestBody, InputRequest.class);
			
			returnValue = "blam";  // handle success
		}
		catch (some exception type)
		{
			returnValue = "kapow"; // handle parse error.
			// handle parse exceptions here.
		}
	}
	else
	{
		returnValue = "blam"; // handle no request body here.
	}
	
	return returnValue;
}


// The dependency for commons lang3
//      <dependency>
//        <groupId>org.apache.commons</groupId>
//        <artifactId>commons-lang3</artifactId>
//        <version>3.5</version>
//      </dependency>

Validation of request body can be done using Validation
For example - https://blog.tericcabrel.com/validate-request-body-and-parameter-in-spring-boot/

You can simply define an @ExceptionHandler annotated method in your controller:

@ExceptionHandler
ResponseEntity<String> handleMessageNotReadable(HttpMessageNotReadableException e) {
  // change the status below according to requirements
  return new ResponseEntity<>(e.getMessage(), HttpStatus.NOT_ACCEPTABLE);
}

For handling exceptions globally use @ControllerAdvice, for more details about exception handling check the blog post.