owasp-no-additionalProperties
By default, JSON Schema allows additional properties, which can potentially lead to mass assignment issues with OpenAPI.
Avoid using additionalProperties in schemas, or explicitly set to false.
Bad example
openapi: "3.0.0"
info:
version: "1.0"
components:
schemas:
Foo:
type: object
additionalProperties:
type: object
properties:
code:
type: integer
text:
type: string
Good Example
openapi: "3.0.0"
info:
version: "1.0"
components:
schemas:
Foo:
type: object
additionalProperties: false
How do I fix this violation?
Avoid additionalProperties in schemas, or explicitly set to false.