search

blst-security / cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
https://www.blstsecurity.com/cherrybomb
Apache License 2.0
1.08k stars 78 forks source link

{type: number, format: int32} should be a validation error #96

Closed jayvdb closed 1 year ago

jayvdb commented 1 year ago

Is your feature request related to a problem? Please describe. {type: number, format: int32} is not ideal OAS 3.0.3, as it defines a format which should be an integer, but uses type: number when the type: integer should be used.

As it is ambiguous, the validator should emit an error of some sort, as openapi tools are very likely to either ignore either type or format, or fail when trying to combined the two.

An example of a tool which silently ignores the format is https://github.com/oxidecomputer/progenitor/issues/266

Describe the solution you'd like Detect type: number and a integer format, and type: integer and a float format.

https://github.com/zalando/zally (Kotlin) does detect this as rule MUST define a format for number and integer types

Describe alternatives you've considered

Additional context

OmerWow commented 1 year ago

Hey @jayvdb

Thanks for the feature suggestion!

We're thinking about adding a new passive check that will check for integrity of types, is that what you had in mind?

jayvdb commented 1 year ago

Yes

OmerWow commented 1 year ago

Great then!

We're adding this to our future development plans, thanks for the suggestion :)

OmerWow commented 1 year ago

Hey @jayvdb

Just wanted to let you know we're adding the new passive check to Cherrybomb, this is the link to the PR: https://github.com/blst-security/cherrybomb/pull/97

Thanks again for the suggestion :)

DeliciousBounty commented 1 year ago

Hii @jayvdb Just wanted to let you know that there is a new passive check that responds to your feature suggestion: https://github.com/blst-security/cherrybomb/blob/b2eb8b421cd4a78a107fe41f3921275a516986be/cherrybomb-engine/src/scan/passive/additions_checks.rs#L39 I close this issue