owasp-array-limit
This rule checks schemas used in requests, including parameters and request bodies. Response-only and unused schemas are excluded.
Bad example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/chickenNuggets:
post:
requestBody:
content:
application/json:
schema:
type: array
items:
type: string
responses:
'201':
description: Created
Good example
openapi: "3.1.0"
info:
title: Chicken Nuggets API
version: "1.0"
paths:
/chickenNuggets:
post:
requestBody:
content:
application/json:
schema:
type: array
items:
type: string
maxItems: 99
responses:
'201':
description: Created
How do I fix this violation?
Set maxItems to limit the number of array items.