security-review-owasp-bean-validation

To find missing Jakarta Bean Validation constraints on Java DTOs, review externally controlled fields for evidence of size, format, range, and structure constraints. This identifies where unsafe input could bypass intended input controls and reach sensitive business logic.

A fail-open custom validator in Jakarta Bean Validation occurs when validation code mixes business logic with enforcement, allowing malformed input to pass through instead of blocking it. Validator safety review flags these risky patterns and ensures fail-closed behavior before trust-boundary execution.

To check if Bean Validation triggers at the right trust boundaries, verify that validation actually runs at controllers, service boundaries, and nested object graphs. Trigger-point analysis confirms validation enforcement occurs before trust-boundary execution processes the input.

Yes, this Bean Validation review checks regex safety in custom constraints by flagging risky regex patterns that could cause ReDoS or bypass enforcement. It ensures regex-backed constraints handle invalid input safely before trust-boundary execution.

The best way to review nested object graphs for validation gaps is to apply constraint coverage and trigger-point analysis across the entire object graph, verifying that validation cascades through nested beans and custom constraints at each trust boundary.

You should not rely solely on Bean Validation for Java security when validation code mixes business logic with enforcement or lacks fail-closed behavior. Constraint coverage review identifies these gaps but cannot replace comprehensive security assessment workflows.