OWASP API4 2023 Array Limit (Edit)

Array size should be limited to mitigate resource exhaustion attacks. This can be done using maxItems. You should ensure that the subschema in items is constrained too.

OWASPSecuritySchemaArraysOpenAPI

Rule Definition

owasp-api4-2023-array-limit-error.yaml 
{"owasp-api4-2023-array-limit-error":{"description":"Array size should be limited to mitigate resource exhaustion attacks. This can be done using maxItems. You should ensure that the subschema in items is constrained too.","message":"Schema of type array must specify maxItems.","given":"$..[?(@.type==\"array\")]","severity":"error","then":{"field":"maxItems","function":"truthy"}}}

Back to All of the Rules