OWASP API4 2023 Integer Limit (Edit)

Integers should be limited to mitigate resource exhaustion attacks. This can be done using minimum and maximum, which helps avoid negative numbers when positive are expected, or reducing unreasonable iterations.

OWASPSecuritySchemaIntegersOpenAPI

Rule Definition

owasp-api4-2023-integer-limit-error.yaml 
{"owasp-api4-2023-integer-limit-error":{"description":"Integers should be limited to mitigate resource exhaustion attacks. This can be done using minimum and maximum, which helps avoid negative numbers when positive are expected, or reducing unreasonable iterations.","message":"Schema of type integer must specify minimum and maximum.","given":"$..[?(@.type==\"integer\")]","severity":"error","then":[{"field":"minimum","function":"defined"},{"field":"maximum","function":"defined"}]}}

Back to All of the Rules