owaspNoAdditionalPropertiesConstrained

owaspNoAdditionalPropertiesConstrained checks for maxProperties on request maps that allow additional values through additionalProperties, or through unevaluatedProperties in OpenAPI 3.1 and 3.2. Closed objects, finite object values, response-only schemas, and unused schemas are excluded.

The count limit controls size. It does not control which fields can be assigned.

Example ruleset configuration

my-security-rule:
  description: Checks request maps for a property-count limit.
  type: validation
  given: $
  then:
    function: owaspNoAdditionalPropertiesConstrained

Used by the following rules:

• owasp-constrained-additionalProperties