owasp-integer-limit

Set a lower and an upper bound on integer schemas. Use minimum and maximum, numeric exclusiveMinimum and exclusiveMaximum, or a combination.

OpenAPI 3.0 uses minimum and maximum with boolean exclusivity flags. OpenAPI 3.1 and 3.2 also support numeric exclusive bounds.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
components:
  schemas:
    Foo:
      type: integer
paths: {}

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
components:
  schemas:
    Foo:
      type: integer
      exclusiveMinimum: 1
      maximum: 99
paths: {}

How do I fix this violation?

Ensure that minimum and maximum or exclusiveMinimum and exclusiveMaximum (or used in a combination between them) have been specified on integer values.