owasp-no-additionalProperties

By default, JSON Schema allows additional properties. Leaving out additionalProperties does not close an object. For request data, that can expose fields you did not intend callers to set.

This rule warns about simple request objects with omitted restrictions or additionalProperties: true. Response-only and unused schemas are excluded.

Bad example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
paths:
  /chickenNuggets:
    post:
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
      responses:
        '201':
          description: Chicken nugget created

Good Example

openapi: "3.1.0"
info:
  title: Chicken Nuggets API
  version: "1.0"
paths:
  /chickenNuggets:
    post:
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
              additionalProperties: false
      responses:
        '201':
          description: Chicken nugget created

How do I fix this violation?

Set additionalProperties: false for an object with a fixed set of fields.

For a deliberate map, define the value schema with additionalProperties and add a sensible maxProperties limit. The map-size rule checks that limit separately:

type: object
additionalProperties:
  type: string
maxProperties: 10

maxProperties limits the number of fields. It does not control which fields a caller can assign.

OpenAPI 3.1 and 3.2 can also use unevaluatedProperties: false to close an object, including at the enclosing level of a composition. Composition handling is conservative: the rule does not require closure on each branch and does not prove that a composed schema is closed. Finite enum values, and const in OpenAPI 3.1+, already restrict the accepted object values.