Validation Constraint On Static Field
ID |
java.validation_constraint_on_static_field |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
best-practice, reliability |
Description
Reports a Bean Validation constraint annotation (@NotNull, @Size, @Min, …) placed on a static field. Each qualifying constraint on the field is reported individually, so a field carrying two constraints yields two findings.
Rationale
Bean Validation (Hibernate Validator and other implementations) validates the state of object instances; a static field belongs to the class itself, not to any instance, so it falls outside the validation lifecycle and the constraint is never evaluated. Code that relies on the annotation to keep the field non-null or in range gets no such guarantee, which surfaces later as an unexpected NullPointerException or an out-of-range value flowing through the application.
public class ApiGatewayConfig {
@NotNull
private static String apiEndpoint; // never validated: static fields are outside Bean Validation's scope
}