Security Test: Permissive JSON Input¶

Description¶

Default Severity: info

The issue arises when a system allows JSON inputs without strictly defining the type, letting users include any type of data—even entire JSON objects—in places where a simple value was expected. This weak type control can lead to unintentional data exposure, as the system might process and return more information than intended. Developers often fall into the trap of assuming certain inputs based on schema design, but if that validation is too lax, it opens the door for attackers to inject complex data that can leak sensitive information or disrupt normal application behavior. It's a reminder to enforce strong typing and strict validation in your input handling to avoid such risks.

Configuration¶

Identifier: schema/permissive_json_input

Examples¶

All configuration available:

checks:
  schema/permissive_json_input:
    skip: false # default

Compliance and Standards¶