owaspNoAdditionalProperties

owaspNoAdditionalProperties checks simple request objects for omitted property restrictions or additionalProperties: true. Closed objects and schema-valued maps are accepted. Response-only and unused schemas are excluded.

OpenAPI 3.1 and 3.2 support closure with unevaluatedProperties: false. Composition handling is conservative; the function does not prove that a composed schema is closed.

Example ruleset configuration

my-security-rule:
  description: Checks request objects for unrestricted additional properties.
  type: validation
  given: $
  then:
    function: owaspNoAdditionalProperties

Used by the following rules:

• owasp-no-additionalProperties