{"ref":"capability:input-validation","page":"/capabilities/input-validation","json":"/capabilities/input-validation.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"input-validation","name":"Input validation","domain":"security-and-compliance","ecosystems":["cap","abap","ui5"],"universal":true,"description":"Rejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks  from the model definitions.","short":"Rejecting bad input before it reaches a handler","core_coverage":{"state":"core-and-community","assessed_at":"2026-09-27","what_core_does":"The CAP runtimes, [@sap/cds](artifact:sap-cds) and CAP Java, enforce constraints declared in the model whenever data is written: @mandatory, @assert.range, @assert.format, @assert.target, and @assert with a CXL case expression that can compare other elements and associated entities. Static checks such as @mandatory run on the input, the @assert expressions are collected into one query and run in the database after the write, and a failure rejects the request and rolls the transaction back.","where_it_stops":"It stops at what a range, a regular expression or a CXL expression run in the database can say about an entity's elements: @assert.format takes a pattern and has no named format such as email or uri, and @assert.target does not check across services or against a target created in the same deep insert. Past that the check is a before handler of the developer's own, or a second vocabulary: JSON Schema keywords per element, evaluated by [Ajv](external:ajv), in [sap-cap-validator-plugin](artifact:mauriciolauffer-sap-cap-validator-plugin), and [Zod](https://zod.dev) schemas registered in a before handler in [cds-validate](artifact:nagarjundas1994-aiagents-cds-validate). capire's own advice at that edge is to try the declarative constraints first and to write the before handler only past them; in CAP Java the Before phase is the one meant for validating the incoming parameters.","sources":[{"url":"https://cap.cloud.sap/docs/guides/services/constraints","title":"Declarative Constraints — capire","checked":"2026-09-27","quote":"Support for open intervals and infinity is available for CAP Node.js since @sap/cds version 8.5 and in CAP Java since version 3.5.0."},{"url":"https://cap.cloud.sap/docs/guides/services/constraints","title":"Declarative Constraints","checked":"2026-09-20","quote":"Cross-service checks are not supported. It is expected that the associated entities are defined in the same service."},{"url":"https://github.com/mauriciolauffer/sap-cap-validator-plugin","title":"mauriciolauffer/sap-cap-validator-plugin — README","checked":"2026-09-20","quote":"All validation keywords available in `Ajv` (draft-07) can be used."},{"url":"https://github.com/Nagarjundas1994-AiAgents/cds-validate","title":"Nagarjundas1994-AiAgents/cds-validate — README","checked":"2026-09-20","quote":"`validate()` works in `srv.before()` handlers."},{"url":"https://cap.cloud.sap/docs/guides/services/custom-code","title":"Custom Event Handlers — capire","checked":"2026-09-27","quote":"Consider first whether your custom logic can be addressed using declarative techniques, like status flows or declarative constraints, before resorting over to programmatic and hence imperative options."},{"url":"https://cap.cloud.sap/docs/java/event-handlers/","title":"Event Handlers (CAP Java) — capire","checked":"2026-09-27","quote":"This phase is intended for filtering, validation, and other types of preprocessing of the incoming parameters of an event."}],"relationship":"unassessed"},"history":[{"date":"2026-08-31","field":"core_coverage.state","from":"core","to":"core-only","reason":"States renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately."},{"date":"2026-09-14","field":"ecosystems","from":"cap","to":"cap, abap","reason":"abap-data-validator checks dates, times, e-mail addresses, GUIDs and other types from ABAP code, alone or against a table of rules, and abapDomCheck checks a structure against its domains' fixed values. Both are for data that never passes a screen."},{"date":"2026-09-20","field":"core_coverage.state","from":"core-only","to":"core-and-community","reason":"Three independent CAP artifacts carry a provides edge to this capability: sap-cap-validator-plugin (entered 2026-09-18), cds-validate and cap-toolkit (both 2026-09-07). The state said only the core was present. relationship is unassessed: no retrieved document gives the history between them and the core."},{"date":"2026-09-27","field":"changed_in","from":"none","to":"@sap/cds 8.5.0, open intervals in @assert.range","reason":"The Declarative Constraints page carries the version marker and nothing recorded it. Dated from the npm publish of 8.5.0, sourced to the November 2024 release notes; the @sap/cds edge for this capability was rewritten from the page at the same time, since it predated CXL constraints and placed every check before the handler."},{"date":"2026-09-27","field":"core_coverage.where_it_stops","from":"the before handler named without its page","to":"cites the two handler pages","reason":"capire audit 2026-09-27, proposed pages read a third time: the boundary said the check past the constraints is a before handler of the developer's own, and the two pages that document that handler were cited nowhere; the Node.js page states the order the boundary implies, declarative first."},{"date":"2026-10-19","field":"ecosystems","from":"cap, abap","to":"cap, abap, ui5","reason":"openui5-validator was staged in intake-20261019-bestofui5 under ui5-data-binding because this capability was not open on the UI5 door. The UI5 reading comes from the OpenUI5 pages on data types and validation messages."},{"date":"2026-10-26","field":"coverage_by_ecosystem.ui5.state, coverage_by_ecosystem.ui5.relationship, coverage_by_ecosystem.ui5.community_adds","from":"core-and-community, unassessed, community_adds naming openui5-validator","to":"core-only, relationship removed, community_adds removed","reason":"Reassessed against the graph (check:capabilities): no artifact carries a provides edge to this capability for the UI5 door, because openui5-validator provides ui5-data-binding. The state follows the edges, and the core stays present through the block's sourced what_core_does."}],"coverage_by_ecosystem":{"abap":{"state":"core-and-community","assessed_at":"2026-09-14","what_core_does":"On a classic dynpro, fields that refer to ABAP Dictionary are checked before PAI runs: a value must exist in its check table and be one of its domain's fixed values. In RAP, a validation declared in the behavior definition runs in the save sequence and can reject an instance, with its check written in the behavior pool.","where_it_stops":"At the screen. Data that reaches the system through an upload, an RFC call or a program passes no dictionary check, and a RAP validation checks only what its author implemented.","sources":[{"url":"https://help.sap.com/doc/abapdocu_752_index_htm/7.52/en-US/abendynpro_auto_check_abexa.htm","title":"ABAP Keyword Documentation 7.52 — Dynpros, Automatic Input Checks","checked":"2026-09-14","quote":"The marker MARK must be one of the fixed values of the domain S_FLAG."},{"url":"https://help.sap.com/doc/abapdocu_758_index_htm/7.58/en-US/abenbdl_validations.htm","title":"ABAP Keyword Documentation 7.58 — RAP - validation","checked":"2026-09-14","quote":"Validations are always invoked during the save sequence at the end of a transaction"},{"url":"https://github.com/abapTools/abapDomCheck","title":"abapTools/abapDomCheck — README","checked":"2026-09-14","quote":"SAP only check data against the domain fixed values and check tables in the GUI."}],"relationship":"unassessed"},"ui5":{"state":"core-only","assessed_at":"2026-10-19","what_core_does":"Data types check user input on its way into the model: a type's constraints, the maximum of an Integer say, are validated when the input is parsed, the OData types carry the property facets as constraints, and a custom type implements `validateValue`. With `handleValidation` set in the manifest or on the component, a failed check becomes a validation message on the control's property.","where_it_stops":"At the input of one bound property: the documentation places the check in parsing what was entered and creates the message when the data changes, and it describes no check of a whole form at once.","sources":[{"url":"https://github.com/SAP/openui5-docs/blob/main/docs/04_Essentials/formatting-parsing-and-validating-data-07e4b92.md","title":"OpenUI5 documentation — Formatting, Parsing, and Validating Data","checked":"2026-10-19","quote":"During parsing the value is validated against these constraints."},{"url":"https://github.com/SAP/openui5-docs/blob/main/docs/04_Essentials/validation-messages-a90d93d.md","title":"OpenUI5 documentation — Validation Messages","checked":"2026-10-19","quote":"Validation messages are generated by the framework type validation when data changes."}]}},"framing_by_ecosystem":{"abap":{"description":"In ABAP the rules sit in ABAP Dictionary, on domains, data elements and check tables, and the screen applies them. Code that takes data in without a screen calls a check of its own, by type in [abap-data-validator](https://github.com/hhelibeb/abap-data-validator) or against fixed values in [abapDomCheck](https://github.com/abapTools/abapDomCheck)."},"ui5":{"description":"In a UI5 app input is checked in the browser, against the type of the property it is bound to, before it reaches the model; the service behind it still checks what it receives."}},"drafted_with_ai":true,"changed_in":[{"version":"@sap/cds 8.5.0","date":"2024-11-26","applies_to":{"ecosystems":["cap"],"flavors":["node"]},"what_changed":"@assert.range accepts open intervals, a min or max wrapped in parentheses, and an underscore for infinity. Before this release a range was a closed [min, max] and a one-sided bound needed a case expression or a handler. CAP Java gained the same in 3.5.0.","invalidates":"Advice that @assert.range cannot express 'strictly positive' or an unbounded side, and the before handlers written for that.","source":{"url":"https://cap.cloud.sap/docs/releases/2024/nov24","title":"November 2024 — capire release notes","checked":"2026-09-27","quote":"We now support open intervals with @assert.range by wrapping min or max values in parentheses"}}]},"sap_delivery":{"door":"cap","all":{"built_in":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json"},{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json"}],"documented_pattern":[],"announced":[],"packages":[]},"by_flavor":{"node":{"built_in":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json"}],"documented_pattern":[],"announced":[],"packages":[]},"java":{"built_in":[{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json"}],"documented_pattern":[],"announced":[],"packages":[]}}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:hhelibeb-abap-data-validator","name":"abap-data-validator","json":"/artifacts/hhelibeb-abap-data-validator.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:abaptools-abapdomcheck","name":"abapDomCheck","json":"/artifacts/abaptools-abapdomcheck.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:eyupbaycol-cap-toolkit","name":"cap-toolkit","json":"/artifacts/eyupbaycol-cap-toolkit.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:mertsap-capval","name":"capval","json":"/artifacts/mertsap-capval.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:nagarjundas1994-aiagents-cds-validate","name":"cds-validate","json":"/artifacts/nagarjundas1994-aiagents-cds-validate.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:cap-java-cds-services-bom","name":"com.sap.cds:cds-services-bom","json":"/artifacts/cap-java-cds-services-bom.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:mauriciolauffer-sap-cap-validator-plugin","name":"sap-cap-validator-plugin","json":"/artifacts/mauriciolauffer-sap-cap-validator-plugin.json","ecosystem":"cap","origin_ring":"independent"}],"samples":[{"ref":"artifact:miyasuta-assert-target","name":"assert-target","json":"/artifacts/miyasuta-assert-target.json"}],"explained_by":[{"ref":"content:declarative-programming-in-cap-less-code-more-value","name":"Declarative Programming in CAP: Less Code, More Value","json":"/content/declarative-programming-in-cap-less-code-more-value.json"},{"ref":"content:building-secure-sapui5-applications-best-practices-for-developers","name":"Building Secure SAPUI5 Applications: Best Practices for Developers","json":"/content/building-secure-sapui5-applications-best-practices-for-developers.json"},{"ref":"content:open-source-ui5-form-validator","name":"Open Source UI5 Form Validator","json":"/content/open-source-ui5-form-validator.json"},{"ref":"content:capval-a-project-is-born","name":"CAPVAL: A project is born","json":"/content/capval-a-project-is-born.json"},{"ref":"content:extend-cap-validations-with-the-capval-plugin","name":"Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL Plugin","json":"/content/extend-cap-validations-with-the-capval-plugin.json"},{"ref":"content:cap-techbytes-input-validation","name":"#CAP-TechBytes Input Validation","json":"/content/cap-techbytes-input-validation.json"},{"ref":"content:btp-sapcap-quirky-nuggets-n01-n02","name":"#BTP #SAPCAP: Quirky Nuggets (N01-N02)","json":"/content/btp-sapcap-quirky-nuggets-n01-n02.json"},{"ref":"content:part-1-enrich-cap-based-services-with-behaviors-using-annotations","name":"[Part - 1] Enrich CAP based Services with Behaviors using Annotations","json":"/content/part-1-enrich-cap-based-services-with-behaviors-using-annotations.json"},{"ref":"content:sap-tutorial-cap-define-constraints-declaratively","name":"Learn how to define constraints declaratively in your CDS model","json":"/content/sap-tutorial-cap-define-constraints-declaratively.json"},{"ref":"content:teched-2026-ad162","name":"Everything new: Try out the latest features in CAP","json":"/content/teched-2026-ad162.json"}],"normative_context":[]}}