Code Review Checklist Java Spring

SOP-ENG-042: Code Review Checklist - Java Spring Framework

1. Document Control & Revision History

2. Executive Summary & Scope

This Standard Operating Procedure (SOP) defines the mandatory technical audit criteria for Java Spring application codebases. The objective is to ensure architectural integrity, performance optimization, and security posture alignment with OWASP Top 10 and internal compliance frameworks. This SOP applies to all developers, architects, and DevOps engineers contributing to production-bound Java Spring services.

3. Prerequisites & Tool Requirements

• Integrated Development Environment (IDE): IntelliJ IDEA Ultimate / Eclipse (latest stable).
• Access Control: Privileged access to internal Git repository (Bitbucket/GitHub Enterprise).
• Static Analysis Tools: SonarQube Enterprise, Snyk, and Checkstyle plugins configured.
• Environment: Access to local JDK 17/21 (LTS) development runtime.
• Credentials: Verified SSO credentials for CI/CD pipelines and internal documentation portals.

4. Roles & Responsibilities (RACI Matrix)

5. Step-by-Step Operational Procedure

Phase 1: Security & Compliance Audit

• Ensure all input parameters are validated using @Valid or @Validated annotations.
• Verify that no secrets, API keys, or database credentials exist in source code (check .env and application.yml usage).
• Confirm that SQL injection risks are mitigated by using Spring Data JPA/Hibernate Query DSLs; reject raw JDBC statements without parameterized inputs.
• Validate that sensitive logs do not expose PII (Personally Identifiable Information).

Phase 2: Spring Context & Architectural Integrity

• Verify dependency injection patterns (Constructor Injection preferred over @Autowired field injection).
• Check for proper usage of Spring Scopes (avoid @Scope("prototype") unless explicitly required for performance).
• Ensure @Transactional is applied at the service layer and handles propagation/isolation levels correctly.
• Validate that @RestController methods use correct HTTP verbs and DTOs (Data Transfer Objects) instead of exposing Entity classes directly.

Phase 3: Performance & Resource Management

• Inspect loops for N+1 query issues (ensure EntityGraph or JOIN FETCH is utilized).
• Confirm that external service calls are wrapped in timeouts and circuit breakers (Resilience4j).
• Verify proper connection pool settings in application.yml for production profiles.
• Check for memory leak risks (unclosed streams, static collection holding references to large objects).

Phase 4: Testing & Observability

• Confirm unit test coverage meets the >85% threshold per internal policy.
• Verify that Integration Tests use @SpringBootTest with @MockBean for downstream dependencies.
• Ensure proper instrumentation via Micrometer/Actuator endpoints.

6. Quality Assurance & Verification Criteria

• Tolerance Threshold: Zero critical or blocker vulnerabilities allowed in static analysis reports.
• Benchmark: Builds must complete execution within 300 seconds; API latency must remain <200ms at the 95th percentile.
• Verification: The Pull Request (PR) must be approved by at least one Senior Lead and pass all automated CI pipeline gates.

7. Practical Troubleshooting Scenarios

Scenario A: Cyclic Dependency Exception

• Failure: BeanCurrentlyInCreationException during application context initialization.
• Corrective Action: Refactor the design to decouple services. If immediate, use @Lazy injection as a temporary patch, but open a technical debt ticket for refactoring.

Scenario B: Database Connection Exhaustion

• Failure: HikariPool-1 - Connection is not available, request timed out.
• Corrective Action: Audit the transaction boundaries. Ensure long-running operations are removed from the @Transactional method scope. Increase pool size only if baseline telemetry proves exhaustion is due to throughput volume, not resource leaks.

Scenario C: N+1 Query Degradation

• Failure: Excessive database round-trips detected during performance monitoring (JMX/APM).
• Corrective Action: Identify the collection fetch in JPA repositories and implement JOIN FETCH or use EntityGraph to consolidate fetching into a single query. Verify with hibernate.show_sql logs.