-
Notifications
You must be signed in to change notification settings - Fork 78
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
min/maxItems unnecessary alert #137
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Haven't had a chance to fully play with the tool but the passive scan does not correctly detect min/max items in arrays correctly:
paths:
/:
get:
summary: List items
description: List all items.
operationId: listItems
responses:
'200':
description: success.
content:
application/json:
schema:
$ref: '#/components/schemas/ListReply'
default:
description: Unexpected error
components:
schemas:
ListReply:
title: items
type: array
description: items list
items:
type: string
description: item
minItems: 0
maxItems: 10
uniqueItems: true
│ ARRAY ATTRIBUTES ┆ "Info" ┆ Array schema without an item minimum ┆ swagger root path:/ method:GET response status:200 media type:application/json │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ARRAY ATTRIBUTES ┆ "Low" ┆ Array schema without an item maximum ┆ swagger root path:/ method:GET response status:200 media type:application/json │
Expected behavior
To not have those alerts
Additional context
https://github.com/blst-security/cherrybomb/blob/main/cherrybomb-oas/src/legacy/schema.rs#L44
https://github.com/blst-security/cherrybomb/blob/main/cherrybomb-oas/src/legacy/schema.rs#L46
Item to Items
The text was updated successfully, but these errors were encountered: