owasp-constrained-additionalProperties

By default, JSON Schema allows additional properties, which can potentially lead to mass assignment issues with OpenAPI.

Avoid using additionalProperties in schemas. Use maxProperties instead.

Bad example

openapi: "3.1.0"
info:
  version: "1.0"
components:
  schemas:
    Foo:
      type: object
      additionalProperties: true

Good Example

openapi: "3.1.0"
info:
  version: "1.0"
components:
  schemas:
    Foo:
      type: object
      additionalProperties:
        type: string
      maxProperties: 1

How do I fix this violation?

Avoid additionalProperties in schemas, explicitly set to something other than true or false, and use maxProperties instead.