owasp-constrained-additionalProperties

A map can accept caller-defined keys without accepting an unlimited number of them. Use maxProperties to put a limit on the number of fields in a request map.

This rule checks request objects that allow additional values through additionalProperties: true or an additionalProperties schema. It also checks unevaluatedProperties maps in OpenAPI 3.1 and 3.2. Response-only and unused schemas are excluded.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
paths:
  /chickenNuggets:
    post:
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: string
      responses:
        '201':
          description: Chicken nugget created

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
paths:
  /chickenNuggets:
    post:
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: string
              maxProperties: 10
      responses:
        '201':
          description: Chicken nugget created

How do I fix this violation?

Keep the map’s value schema and add a maxProperties limit that fits the API. Do not replace additionalProperties with maxProperties; they do different jobs.

A closed object with additionalProperties: false does not need a map-size limit for this rule. Finite enum values, and const in OpenAPI 3.1+, are also excluded.

A property-count limit controls size, not mass assignment. Use the request-object rule to check unrestricted extra fields.