Project: KICS (Provisioning / Security & Compliance)
File: 9f88c88d-824d-4d9a-b985-e22977046042.md

title: Additional Properties Too Permissive hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9f88c88d-824d-4d9a-b985-e22977046042 Query name: Additional Properties Too Permissive Platform: OpenAPI Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Objects should not accept 'additionalProperties' if it is possible<br> ```json title="Positive test num. 1 - json file" hl_lines="24" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "true" } } } } } }, "components": { "schemas": { "MyObject": { "oneOf": [ { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "true" }, { "type": "string", "additionalProperties": "false" } ] } } } } ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="19" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': schema: type: object properties: id: type: string name: type: string additionalProperties: 'true' components: schemas: MyObject: oneOf: type: object properties: id: type: string name: type: string additionalProperties: 'true' type: string additionalProperties: 'false' ``` ```json title="Positive test num. 3 - json file" hl_lines="34" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "false" } } } } } }, "components": { "schemas": { "MyObject": { "oneOf": [ { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "true" }, { "type": "string", "additionalProperties": "true" } ] } } } } ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="23" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': schema: type: object properties: id: type: string name: type: string additionalProperties: 'false' components: schemas: MyObject: oneOf: type: object properties: id: type: string name: type: string additionalProperties: 'true' type: string additionalProperties: 'true' ``` </details> <details><summary>Positive test

5 - json file</summary> ```json hl_lines="14" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } } } } } } } }, "components": { "schemas": { "MyObject": { "oneOf": [ { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "true" }, { "type": "string", "additionalProperties": "false" } ] } } } } ``` </details> <details><summary>Positive test num. 6 - yaml file</summary> ```yaml hl_lines="12" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': schema: type: object properties: id: type: string name: type: string components: schemas: MyObject: oneOf: type: object properties: id: type: string name: type: string additionalProperties: 'true' type: string additionalProperties: 'false' ``` </details> ```json title="Negative test num. 1 - json file" { "openapi": "3.0.0", "info": { "title": "Simple API Overview", "version": "1.0.0" }, "paths": { "/": { "get": { "operationId": "listVersionsv2", "summary": "List API versions", "responses": { "200": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "false" } } } } } }, "components": { "schemas": { "MyObject": { "oneOf": [ { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "additionalProperties": "true" }, { "type": "string", "additionalProperties": "false" } ] } } } } ``` ```yaml title="Negative test num. 2 - yaml file" openapi: 3.0.0 info: title: Simple API Overview version: 1.0.0 paths: "/": get: operationId: listVersionsv2 summary: List API versions responses: '200': schema: type: object properties: id: type: string name: type: string additionalProperties: 'false' components: schemas: MyObject: oneOf: type: object properties: id: type: string name: type: string additionalProperties: 'true' type: string additionalProperties: 'false' ``` ```json title="Negative test num. 3 - json file" { "components": {}, "info": { "description": "Swagger auto-generated from learnt schema for ves-io-s-gorman-s-gorman-sent4-http-load-balancer", "title": "ves-io-s-gorman-s-gorman-sent4-http-load-balancer", "version": "2023-06-21 17:30:59" }, "openapi": "3.0.3", "paths": { "/": { "get": { "description": "Swagger auto-generated from learnt schema", "parameters": [ { "description": "Integer", "in": "header", "name": "upgrade-insecure-requests", "schema": { "pattern": "-?\\d+", "type": "string" } } ] } }, "servers": [ { "url": "http://sent4.volterra.plutometal.com" }, { "url": "https://sent4.volterra.plutometal.com" } ] } } ```