Fix for #60. Added maxPageSize to the RepositoryRestConfiguration so the user can specify a maximum which can be specified as the limit parameter. If the user specifies a value that exceeds the maximum, the configured maximum will be used rather than the value specified as a query parameter.

spring-data-rest-repository/src/main/java/org/springframework/data/rest/config/RepositoryRestConfiguration.java

@@ -17,6 +17,7 @@ public class RepositoryRestConfiguration {
 
   private URI                           baseUri             = null;
   private int                           defaultPageSize     = 20;
+  private int                           maxPageSize         = 1000;
   private String                        pageParamName       = "page";
   private String                        limitParamName      = "limit";
   private String                        sortParamName       = "sort";
@@ -74,6 +75,29 @@ public class RepositoryRestConfiguration {
     return this;
   }
 
+  /**
+   * Get the maximum size of pages.
+   *
+   * @return Maximum page size.
+   */
+  public int getMaxPageSize() {
+    return maxPageSize;
+  }
+
+  /**
+   * Set the maximum size of pages.
+   *
+   * @param maxPageSize
+   *     Maximum page size.
+   *
+   * @return {@literal this}
+   */
+  public RepositoryRestConfiguration setMaxPageSize(int maxPageSize) {
+    Assert.isTrue((defaultPageSize > 0), "Maximum page size must be greater than 0.");
+    this.maxPageSize = maxPageSize;
+    return this;
+  }
+
   /**
    * Get the name of the URL query string parameter that indicates what page to return. Default is 'page'.
    *

spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/PagingAndSortingMethodArgumentResolver.java

@@ -28,7 +28,6 @@ import org.springframework.web.method.support.ModelAndViewContainer;
 public class PagingAndSortingMethodArgumentResolver implements HandlerMethodArgumentResolver {
 
   private static final int DEFAULT_PAGE = 1; // We're 1-based, not 0-based
-
   @Autowired
   private RepositoryRestConfiguration config;
 
@@ -64,7 +63,7 @@ public class PagingAndSortingMethodArgumentResolver implements HandlerMethodArgu
       String sLimit = request.getParameter(config.getLimitParamName());
       if(StringUtils.hasText(sLimit)) {
         try {
-          limit = Integer.parseInt(sLimit);
+          limit = Math.min(Integer.parseInt(sLimit), config.getMaxPageSize());
         } catch(NumberFormatException ignored) {
         }
       }