Validation — Jakarta Bean Validation, custom validator, cross-field

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-validation</artifactId>
</dependency>

public record OrderRequest(
    @NotBlank(message = "Customer name is required")
    @Size(min = 2, max = 100)
    String customer,

    @NotBlank
    @Email
    String email,

    @NotNull
    @Positive
    @DecimalMax("999999.99")
    BigDecimal total,

    @NotNull
    @Future(message = "Delivery date must be in future")
    LocalDate deliveryDate,

    @NotEmpty
    @Size(max = 100, message = "Maximum 100 items per order")
    @Valid       // cascade — validate each OrderItem
    List<OrderItem> items,

    @Pattern(regexp = "^[A-Z]{2}\\d{4}$", message = "Voucher must be 2 letters + 4 digits")
    String voucherCode
) {}

public record OrderItem(
    @NotBlank String sku,
    @Min(1) @Max(99) int quantity,
    @NotNull @Positive BigDecimal unitPrice
) {}

@PostMapping("/orders")
public OrderDto create(@Valid @RequestBody OrderRequest req) { ... }

public record OrderRequest(
    ...
    @Valid List<OrderItem> items     // CASCADE
) {}

@GetMapping("/orders")
public List<OrderDto> list(
    @RequestParam @Min(0) int page,
    @RequestParam @Min(1) @Max(100) int size,
    @RequestParam @Email String filterEmail
) { ... }

@RestController
@Validated                       // BAT VALIDATION CHO PARAM
@RequestMapping("/api/orders")
public class OrderController { ... }

@Service
@Validated                       // bat method-level validation
public class OrderService {

    public OrderDto create(@Valid OrderRequest req) {
        // Spring intercept method call qua AOP, validate truoc khi enter
    }

    public OrderDto findById(@NotNull @Positive Long id) {
        // ID phai positive, khong null
    }
}

public interface Create {}
public interface Update {}

public record OrderRequest(
    @Null(groups = Create.class)            // Create: phai null (auto-gen)
    @NotNull(groups = Update.class)          // Update: phai có
    Long id,

    @NotBlank(groups = {Create.class, Update.class})
    String customer,

    @NotNull(groups = Create.class)          // Create require
    BigDecimal total                         // Update optional
) {}

@PostMapping("/orders")
public OrderDto create(@Validated(Create.class) @RequestBody OrderRequest req) { ... }

@PutMapping("/orders/{id}")
public OrderDto update(@PathVariable Long id, @Validated(Update.class) @RequestBody OrderRequest req) { ... }

public record CreateOrderRequest(@NotBlank String customer, @NotNull BigDecimal total) {}
public record UpdateOrderRequest(@NotNull Long id, String customer, BigDecimal total) {}

// 1. Annotation
@Target({ElementType.FIELD, ElementType.METHOD, ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
@Constraint(validatedBy = SkuValidator.class)
public @interface ValidSku {
    String message() default "Invalid SKU format";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

// 2. Validator
public class SkuValidator implements ConstraintValidator<ValidSku, String> {

    private static final Pattern SKU_PATTERN = Pattern.compile("^[A-Z]{3}-\\d{4}$");

    public boolean isValid(String value, ConstraintValidatorContext context) {
        if (value == null) return true;          // null check by @NotNull, not here
        return SKU_PATTERN.matcher(value).matches();
    }
}

// 3. Use
public record OrderItem(
    @NotBlank @ValidSku String sku,
    @Min(1) int quantity
) {}

@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Constraint(validatedBy = DateRangeValidator.class)
public @interface ValidDateRange {
    String message() default "Start date must be before end date";
    Class<?>[] groups() default {};
    Class<? extends Payload>[] payload() default {};
}

public class DateRangeValidator implements ConstraintValidator<ValidDateRange, OrderFilter> {

    public boolean isValid(OrderFilter filter, ConstraintValidatorContext context) {
        if (filter.from() == null || filter.to() == null) return true;
        return !filter.from().isAfter(filter.to());
    }
}

@ValidDateRange
public record OrderFilter(
    LocalDate from,
    LocalDate to
) {}

public record OrderFilter(LocalDate from, LocalDate to) {

    @AssertTrue(message = "from must be before to")
    public boolean isDateRangeValid() {
        if (from == null || to == null) return true;
        return !from.isAfter(to);
    }
}

@Size(min = 2, max = 100, message = "{order.customer.size}")
String customer;

# src/main/resources/messages.properties
order.customer.size=Customer name must be between {min} and {max} characters
order.customer.size.vi=Tên khách hàng phải dài từ {min} đến {max} ký tự

@Service
@Validated
public class OrderService {

    public OrderDto findById(@NotNull @Positive Long id) {
        // Goi tu controller, library, scheduler — luon validate
        return repo.findById(id).orElseThrow(...);
    }

    public List<OrderDto> findByCustomer(@NotBlank @Email String email,
                                          @NotNull Pageable page) {
        // ...
    }
}

@RestControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler(ConstraintViolationException.class)
    public ProblemDetail handleConstraintViolation(ConstraintViolationException ex) {
        ProblemDetail pd = ProblemDetail.forStatus(HttpStatus.BAD_REQUEST);
        pd.setTitle("Validation failed");

        List<Map<String, String>> violations = ex.getConstraintViolations().stream()
            .map(v -> Map.of(
                "path", v.getPropertyPath().toString(),
                "message", v.getMessage(),
                "rejectedValue", String.valueOf(v.getInvalidValue())
            ))
            .toList();
        pd.setProperty("violations", violations);

        return pd;
    }
}

public interface Step1 {}
public interface Step2 {}

@GroupSequence({Step1.class, Step2.class})
public interface OrderedChecks {}

public record User(
    @NotBlank(groups = Step1.class)
    @Email(groups = Step2.class)               // chi check Email neu Step1 pass
    String email
) {}

// Use
@PostMapping("/users")
public ... create(@Validated(OrderedChecks.class) @RequestBody User u) { ... }

public record DiscountRequest(
    @NotNull DiscountType type,
    BigDecimal percentage,
    BigDecimal fixedAmount
) {

    @AssertTrue(message = "Percentage required for PERCENT discount")
    public boolean isPercentageValid() {
        return type != DiscountType.PERCENT || percentage != null;
    }

    @AssertTrue(message = "Fixed amount required for FIXED discount")
    public boolean isFixedValid() {
        return type != DiscountType.FIXED || fixedAmount != null;
    }
}

@Service
public class OrderService {

    private final Validator validator;       // jakarta.validation.Validator

    public void importBulk(List<OrderRequest> requests) {
        for (var req : requests) {
            Set<ConstraintViolation<OrderRequest>> violations = validator.validate(req);
            if (!violations.isEmpty()) {
                log.warn("Skipping invalid order: {}", violations);
                continue;
            }
            create(req);
        }
    }
}

@RestControllerAdvice
@Slf4j
public class ValidationMetricsAdvice {

    private final MeterRegistry meterRegistry;

    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ProblemDetail handle(MethodArgumentNotValidException ex) {
        ex.getBindingResult().getFieldErrors().forEach(err -> {
            meterRegistry.counter("validation.failure",
                "field", err.getField(),
                "code", err.getCode(),
                "objectName", err.getObjectName()
            ).increment();
        });

        ProblemDetail pd = ProblemDetail.forStatus(400);
        pd.setTitle("Validation failed");
        // ... build violations
        return pd;
    }
}

- alert: ValidationFailureSpike
  expr: rate(validation_failure_total[10m]) > 100
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: "Validation failure spike on field {{ $labels.field }}"

// VULNERABLE — catastrophic backtrack
@Pattern(regexp = "^([a-zA-Z]+)+$", message = "Letters only")
String input;

@Test
void regex_completes_within_100ms_for_evil_input() {
    String evilInput = "a".repeat(50) + "!";
    Pattern pattern = Pattern.compile("^([a-zA-Z]+)+$");

    long start = System.currentTimeMillis();
    pattern.matcher(evilInput).matches();
    long duration = System.currentTimeMillis() - start;

    assertThat(duration).isLessThan(100);    // bao ve regex DoS
}

// SAFE — atomic group (?>...) khong backtrack
@Pattern(regexp = "^(?>[a-zA-Z]+)+$")

// SAFE hon — flat regex khong nested quantifier
@Pattern(regexp = "^[a-zA-Z]+$")

@Configuration
public class LocaleConfig {

    @Bean
    public LocaleResolver localeResolver() {
        AcceptHeaderLocaleResolver resolver = new AcceptHeaderLocaleResolver();
        resolver.setDefaultLocale(Locale.forLanguageTag("vi"));
        resolver.setSupportedLocales(List.of(
            Locale.forLanguageTag("vi"),
            Locale.forLanguageTag("en")
        ));
        return resolver;
    }
}

order.customer.required=Tên khách hàng không được trống
order.total.positive=Tổng tiền phải lớn hơn 0
order.delivery.future=Ngày giao phải trong tương lai

order.customer.required=Customer name is required
order.total.positive=Total must be positive
order.delivery.future=Delivery date must be in the future

public record OrderRequest(
    @NotBlank(message = "{order.customer.required}")
    String customer,

    @Positive(message = "{order.total.positive}")
    BigDecimal total,

    @Future(message = "{order.delivery.future}")
    LocalDate deliveryDate
) {}

# Pseudo script — chay trong GH Actions
diff <(grep -oP '^[\w.]+' messages_vi.properties | sort) \
     <(grep -oP '^[\w.]+' messages_en.properties | sort)
# Khac → build fail

ALTER TABLE orders
    ADD CONSTRAINT total_positive CHECK (total > 0),
    ADD CONSTRAINT customer_not_blank CHECK (length(trim(customer)) > 0);

public OrderDto create(@RequestBody OrderRequest req) { ... }      // KHONG validate

@RestController            // KHONG @Validated
public class C {
    @GetMapping("/orders")
    public ... list(@RequestParam @Min(0) int page) { ... }    // @Min skip
}

public record OrderRequest(
    List<OrderItem> items     // KHONG cascade
) {}

public boolean isValid(String value, ...) {
    return SKU_PATTERN.matcher(value).matches();    // NPE neu value = null
}

public boolean isValid(String value, ...) {
    if (value == null) return true;       // null la job cua @NotNull
    return SKU_PATTERN.matcher(value).matches();
}

@NotBlank(message = "Customer is required")           // hardcode

@PostMapping
public ... create(@Valid @RequestBody OrderRequest req) {
    return service.create(req);     // service @Validated lai validate lan nua → wasted
}