OWASP API4 2023 String Restricted (Edit)

To avoid unexpected values being sent or leaked, strings should have a format, RegEx pattern, enum, or const to restrict the possible values.

OWASPSecuritySchemaStringsOpenAPI

Rule Definition

owasp-api4-2023-string-restricted-warn.yaml
{"owasp-api4-2023-string-restricted-warn":{"description":"To avoid unexpected values being sent or leaked, strings should have a format, RegEx pattern, enum, or const to restrict the possible values.","message":"Schema of type string should specify a format, pattern, enum, or const.","given":"$..[?(@.type==\"string\")]","severity":"warn","then":{"function":"schema","functionOptions":{"schema":{"anyOf":[{"required":["format"]},{"required":["pattern"]},{"required":["enum"]},{"required":["const"]}]}}}}}

Back to All of the Rules