Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

min/maxItems unnecessary alert #137

Open
GuyL99 opened this issue Aug 31, 2023 · 0 comments
Open

min/maxItems unnecessary alert #137

GuyL99 opened this issue Aug 31, 2023 · 0 comments

Comments

@GuyL99
Copy link
Contributor

GuyL99 commented Aug 31, 2023

Describe the bug
Haven't had a chance to fully play with the tool but the passive scan does not correctly detect min/max items in arrays correctly:

paths:
/:
get:
summary: List items
description: List all items.
operationId: listItems
responses:
'200':
description: success.
content:
application/json:
schema:
$ref: '#/components/schemas/ListReply'
default:
description: Unexpected error

components:
schemas:
ListReply:
title: items
type: array
description: items list
items:
type: string
description: item
minItems: 0
maxItems: 10
uniqueItems: true

│ ARRAY ATTRIBUTES ┆ "Info" ┆ Array schema without an item minimum ┆ swagger root path:/ method:GET response status:200 media type:application/json │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ARRAY ATTRIBUTES ┆ "Low" ┆ Array schema without an item maximum ┆ swagger root path:/ method:GET response status:200 media type:application/json │
Expected behavior
To not have those alerts

Additional context
https://github.com/blst-security/cherrybomb/blob/main/cherrybomb-oas/src/legacy/schema.rs#L44
https://github.com/blst-security/cherrybomb/blob/main/cherrybomb-oas/src/legacy/schema.rs#L46

Item to Items

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant