search

trolie / spec

Transmission Ratings and Operating Limits Information Exchange
https://trolie.energy/
Other
2 stars 2 forks source link

workaround owasp:api4:2019-array-limit limitations #27

Closed caindy closed 5 months ago

caindy commented 5 months ago

So this https://github.com/trolie/spec/actions/runs/7576129390/job/20634238288#step:4:82 is a false positive. It gets flagged because this existential qualifier https://github.com/stoplightio/spectral-owasp-ruleset/blob/main/src/ruleset.ts#L511 is also a selector https://github.com/stoplightio/spectral-owasp-ruleset/blob/main/src/ruleset.ts#L23 and does not consider the allOf construct, e.g., https://github.com/trolie/spec/blob/1.0.0-wip/docs/_data/components/schemas/forecast-limit-item.yaml#L7

I have already addressed similar limitations in that ruleset https://github.com/trolie/spec/blob/1.0.0-wip/.spectral.yaml#L6

caindy commented 5 months ago

Unfortunately it looks like 42crunch has a similar limitation https://github.com/trolie/spec/security/code-scanning/216

caindy commented 5 months ago

I was able to workaround this by duplicating maxLength values for three free-text description properties in disparate schemas. We could write a linter rule that checks that { "type": "string", "format": "description" } fields all have the same maxLength value.