Security Test: Swagger rules¶

Description¶

Default Severity: info

Swagger rules are used to validate the schema for a REST API, but because they aren't strictly structured, they can introduce security weaknesses. The main issue is that their flexibility sometimes allows unexpected or malicious data to slip through validation, which can then be exploited by attackers to bypass security controls or trigger unintended behaviors. Developers using these rules might assume they're automatically enforcing strict validations, but attackers can take advantage of less rigorous checks—leading to risks like data breaches or unauthorized access. Essentially, the danger lies in relying too heavily on these rules without adding robust, manual security checks.

Configuration¶

Identifier: schema/swagger_rules

Examples¶

All configuration available:

checks:
  schema/swagger_rules:
    skip: false # default

Compliance and Standards¶