format con un valor reconocido, oformat, declarando un campo pattern que sea una expresión regular no vacía y sintácticamente válida.La regla dispara cuando format está presente pero no es reconocido, o cuando format está ausente y pattern está ausente, vacío, o no es una expresión regular sintácticamente válida.
Cuando no se declara format, un enum no vacío también satisface la regla: el enum ya restringe los valores permitidos, por lo que no se exige un pattern. Un format presente pero no reconocido sigue disparando aunque haya un enum.
La regla dispara cuando format está presente pero no es reconocido, o cuando format está ausente y no hay un pattern válido ni un enum no vacío.
Formatos válidos: date, date-time, password, byte, binary, email, uuid, uri, hostname, ipv4, ipv6, HEX, HEX(16), json, xml, base64.
Configurable: formats-allowed — lista de formatos permitidos separados por coma (por defecto: la lista anterior).
Toda operación GET de colección debe definir $expand como parámetro de consulta.
Se aplica a: operaciones GET en rutas de colección (rutas que no terminan en un parámetro de ruta como /{id}).
Excluidos automáticamente: endpoints de detalle (ruta termina en /{param}), rutas que contienen /me, y rutas de health-check que contienen status, health o ping.
Se aplica a: por defecto, todas las operaciones GET en rutas de colección, excepto las rutas excluidas más abajo.
+Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}) y, por defecto, las rutas que contienen /me, /health, /ping o /status.
Parámetros configurables:
paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).pathValidationStrategy — /include o /exclude (por defecto: /include).paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /me,/health,/ping,/status).pathValidationStrategy — /include o /exclude (por defecto: /exclude).diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html index d6fac197..e9740a8f 100644 --- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html +++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html @@ -1,10 +1,10 @@Toda operación GET de colección debe definir
-$excludecomo parámetro de consulta.Se aplica a: operaciones GET en rutas de colección (rutas que no terminan en un parámetro de ruta como
-/{id}).Excluidos automáticamente: endpoints de detalle (ruta termina en
+/{param}), rutas que contienen/me, y rutas de health-check que contienenstatus,healthoping.Se aplica a: por defecto, todas las operaciones GET en rutas de colección, excepto las rutas excluidas más abajo.
+Excluidos automáticamente: endpoints de detalle (la ruta termina en
/{param}) y, por defecto, las rutas que contienen/me,/health,/pingo/status.Parámetros configurables:
paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).pathValidationStrategy — /include o /exclude (por defecto: /include).paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /me,/health,/ping,/status).pathValidationStrategy — /include o /exclude (por defecto: /exclude).diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html index f0b86367..e18bde44 100644 --- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html +++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html @@ -1,102 +1,105 @@ -El parámetro elegido debe definirse en esta operación. Por defecto, $orderby
-Esta regla se aplica únicamente a endpoints GET de colección. Los paths que terminan con un parámetro de ruta (p. ej.
+/examples/{id}) se consideran endpoints de recurso único y quedan excluidos automáticamente.Toda operación GET de colección dentro del alcance debe definir
+$orderbycomo parámetro de consulta.Se aplica a: por defecto, solo a las operaciones GET en rutas que contienen el segmento
+/examplesque declaran una respuesta206. Las operaciones sin respuesta206no se comprueban, y el resto de rutas queda fuera de alcance.Excluidos automáticamente: endpoints de detalle (la ruta termina en
+/{param}, p. ej./examples/{id}).Parámetros configurables:
+
paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).pathValidationStrategy — /include o /exclude (por defecto: /include).
- swagger: "2.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: other
- type: array
- items:
- type: string
- - in: query
- name: hola
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+swagger: "2.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
+ parameters:
+ - in: query
+ name: other
+ type: array
+ items:
+ type: string
+ responses:
+ 206:
+ description: Ok
-
- swagger: "2.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: $orderby
- type: array
- items:
- type: string
- - in: query
- name: $orderby
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+swagger: "2.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get:
+ parameters:
+ - in: query
+ name: $orderby
+ type: array
+ items:
+ type: string
+ responses:
+ 206:
+ description: Ok
+ /examples/{id}:
+ get:
+ parameters:
+ - in: path
+ name: id
+ type: integer
+ required: true
+ responses:
+ 206:
+ description: Ok
-
- openapi: "3.0.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: other
- schema:
- type: array
- items:
- type: string
- - in: query
- name: select
- schema:
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+openapi: "3.0.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
+ parameters:
+ - in: query
+ name: other
+ schema:
+ type: string
+ responses:
+ "206":
+ description: Ok
-- openapi: "3.0.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: $orderby - schema: - type: array - items: - type: string - - in: query - name: $orderby - schema: - type: array - items: - type: string - responses: - 206: - description: Ok -\ No newline at end of file +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: + parameters: + - in: query + name: $orderby + schema: + type: array + items: + type: string + responses: + "206": + description: Ok + /examples/{id}: + get: + parameters: + - name: id + in: path + required: true + schema: + type: integer + responses: + "206": + description: Ok + diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html index 84e5d1bc..02879292 100644 --- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html +++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html @@ -1,102 +1,102 @@ -
El parámetro elegido debe definirse en esta operación. Por defecto, $limit
-Esta regla se aplica únicamente a endpoints GET de colección. Los paths que terminan con un parámetro de ruta (p. ej. /examples/{id}) se consideran endpoints de recurso único y quedan excluidos automáticamente.
Toda operación GET de colección dentro del alcance debe definir $limit como parámetro de consulta de tipo integer.
Se aplica a: por defecto, solo a las operaciones GET en rutas que contienen el segmento /examples que declaran una respuesta 206. Las operaciones sin respuesta 206 no se comprueban, y el resto de rutas queda fuera de alcance.
Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}, p. ej. /examples/{id}).
También se reporta: cuando $limit está presente pero su tipo no es integer.
Parámetros configurables:
+paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).pathValidationStrategy — /include o /exclude (por defecto: /include).
- swagger: "2.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: other
- type: array
- items:
- type: string
- - in: query
- name: hola
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+swagger: "2.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
+ parameters:
+ - in: query
+ name: other
+ type: array
+ items:
+ type: string
+ responses:
+ 206:
+ description: Ok
-
- swagger: "2.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: $limit
- type: array
- items:
- type: string
- - in: query
- name: $limit
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+swagger: "2.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get:
+ parameters:
+ - in: query
+ name: $limit
+ type: integer
+ responses:
+ 206:
+ description: Ok
+ /examples/{id}:
+ get:
+ parameters:
+ - in: path
+ name: id
+ type: integer
+ required: true
+ responses:
+ 206:
+ description: Ok
-
- openapi: "3.0.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: other
- schema:
- type: array
- items:
- type: string
- - in: query
- name: select
- schema:
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+openapi: "3.0.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
+ parameters:
+ - in: query
+ name: other
+ schema:
+ type: string
+ responses:
+ "206":
+ description: Ok
-- openapi: "3.0.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: $limit - schema: - type: array - items: - type: string - - in: query - name: $limit - schema: - type: array - items: - type: string - responses: - 206: - description: Ok -\ No newline at end of file +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + type: integer + responses: + "206": + description: Ok + /examples/{id}: + get: + parameters: + - name: id + in: path + required: true + schema: + type: integer + responses: + "206": + description: Ok + diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html index 64fe2c3c..92136b4f 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html @@ -4,7 +4,8 @@
format field with a recognized value, orformat is declared, declare a pattern field that is a non-empty, syntactically valid regular expression.The rule fires when format is present but not recognized, or when format is absent and pattern is missing, empty, or not a syntactically valid regular expression.
When no format is declared, a non-empty enum also satisfies the rule: the enum already constrains the allowed values, so a pattern is not required. A format that is present but not recognized still fires even when an enum is declared.
The rule fires when format is present but not recognized, or when format is absent and there is no valid pattern and no non-empty enum.
Valid formats: date, date-time, password, byte, binary, email, uuid, uri, hostname, ipv4, ipv6, HEX, HEX(16), json, xml, base64.
Configurable: formats-allowed — comma-separated list of allowed formats (default: the list above).
Every GET collection operation must define $expand as a query parameter.
Applies to: GET operations on collection paths (paths that do not end with a path parameter such as /{id}).
Excluded automatically: detail endpoints (path ends with /{param}), paths containing /me, and health-check paths containing status, health, or ping.
Applies to: by default, all GET operations on collection paths, except the paths excluded below.
+Excluded automatically: detail endpoints (path ends with /{param}), plus (by default) paths containing /me, /health, /ping, or /status.
Configurable parameters:
paths — list of explicit paths to include/exclude (default: /examples).pathValidationStrategy — /include or /exclude (default: /include).paths — comma-separated list of paths to include/exclude (default: /me,/health,/ping,/status).pathValidationStrategy — /include or /exclude (default: /exclude).diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html index c39836cc..71e1f904 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html @@ -1,10 +1,10 @@Every GET collection operation must define
-$excludeas a query parameter.Applies to: GET operations on collection paths (paths that do not end with a path parameter such as
-/{id}).Excluded automatically: detail endpoints (path ends with
+/{param}), paths containing/me, and health-check paths containingstatus,health, orping.Applies to: by default, all GET operations on collection paths, except the paths excluded below.
+Excluded automatically: detail endpoints (path ends with
/{param}), plus (by default) paths containing/me,/health,/ping, or/status.Configurable parameters:
paths — list of explicit paths to include/exclude (default: /examples).pathValidationStrategy — /include or /exclude (default: /include).paths — comma-separated list of paths to include/exclude (default: /me,/health,/ping,/status).pathValidationStrategy — /include or /exclude (default: /exclude).diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html index 2d816f82..83dd2e79 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html @@ -1,102 +1,105 @@ -The chosen parameter must be defined in this operation. By default, $orderby
-This rule applies only to collection GET endpoints. Paths ending with a path parameter (e.g.
+/examples/{id}) are treated as single-resource endpoints and are automatically excluded.Every GET collection operation in scope must define
+$orderbyas a query parameter.Applies to: by default, only GET operations on paths containing the
+/examplessegment that declare a206response. Operations without a206response are not checked, and every other path is out of scope.Excluded automatically: detail endpoints (path ends with
+/{param}, e.g./examples/{id}).Configurable parameters:
+
paths — comma-separated list of paths to include/exclude (default: /examples).pathValidationStrategy — /include or /exclude (default: /include).- swagger: "2.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: other # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}} - type: array - items: - type: string - - in: query - name: hola # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}} - type: array - items: - type: string - responses: - 206: - description: Ok +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}} + parameters: + - in: query + name: other + type: array + items: + type: string + responses: + 206: + description: Ok
- swagger: "2.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: $orderby
- type: array
- items:
- type: string
- - in: query
- name: $orderby
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+swagger: "2.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get:
+ parameters:
+ - in: query
+ name: $orderby
+ type: array
+ items:
+ type: string
+ responses:
+ 206:
+ description: Ok
+ /examples/{id}:
+ get:
+ parameters:
+ - in: path
+ name: id
+ type: integer
+ required: true
+ responses:
+ 206:
+ description: Ok
- openapi: "3.0.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: other # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}} - schema: - type: array - items: - type: string - - in: query - name: select # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}} - schema: - type: array - items: - type: string - responses: - 206: - description: Ok +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}} + parameters: + - in: query + name: other + schema: + type: string + responses: + "206": + description: Ok
- openapi: "3.0.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: $orderby - schema: - type: array - items: - type: string - - in: query - name: $orderby - schema: - type: array - items: - type: string - responses: - 206: - description: Ok -\ No newline at end of file +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: + parameters: + - in: query + name: $orderby + schema: + type: array + items: + type: string + responses: + "206": + description: Ok + /examples/{id}: + get: + parameters: + - name: id + in: path + required: true + schema: + type: integer + responses: + "206": + description: Ok + diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html index 40d0873f..d15c78ac 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html @@ -1,102 +1,102 @@ -
The chosen parameter must be defined in this operation. By default, $limit
-This rule applies only to collection GET endpoints. Paths ending with a path parameter (e.g. /examples/{id}) are treated as single-resource endpoints and are automatically excluded.
Every GET collection operation in scope must define $limit as a query parameter of type integer.
Applies to: by default, only GET operations on paths containing the /examples segment that declare a 206 response. Operations without a 206 response are not checked, and every other path is out of scope.
Excluded automatically: detail endpoints (path ends with /{param}, e.g. /examples/{id}).
Also reported: when $limit is present but its type is not integer.
Configurable parameters:
+paths — comma-separated list of paths to include/exclude (default: /examples).pathValidationStrategy — /include or /exclude (default: /include).- swagger: "2.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: other # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}} - type: array - items: - type: string - - in: query - name: hola # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}} - type: array - items: - type: string - responses: - 206: - description: Ok +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}} + parameters: + - in: query + name: other + type: array + items: + type: string + responses: + 206: + description: Ok
- swagger: "2.0"
- info:
- version: 1.0.0
- title: Swagger Petstore
- paths:
- /pets:
- get:
- parameters:
- - in: query
- name: $limit
- type: array
- items:
- type: string
- - in: query
- name: $limit
- type: array
- items:
- type: string
- responses:
- 206:
- description: Ok
+swagger: "2.0"
+info:
+ version: 1.0.0
+ title: Swagger Petstore
+paths:
+ /examples:
+ get:
+ parameters:
+ - in: query
+ name: $limit
+ type: integer
+ responses:
+ 206:
+ description: Ok
+ /examples/{id}:
+ get:
+ parameters:
+ - in: path
+ name: id
+ type: integer
+ required: true
+ responses:
+ 206:
+ description: Ok
- openapi: "3.0.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: other # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}} - schema: - type: array - items: - type: string - - in: query - name: select # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}} - schema: - type: array - items: - type: string - responses: - 206: - description: Ok +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}} + parameters: + - in: query + name: other + schema: + type: string + responses: + "206": + description: Ok
- openapi: "3.0.0" - info: - version: 1.0.0 - title: Swagger Petstore - paths: - /pets: - get: - parameters: - - in: query - name: $limit - schema: - type: array - items: - type: string - - in: query - name: $limit - schema: - type: array - items: - type: string - responses: - 206: - description: Ok -\ No newline at end of file +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + type: integer + responses: + "206": + description: Ok + /examples/{id}: + get: + parameters: + - name: id + in: path + required: true + schema: + type: integer + responses: + "206": + description: Ok + diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java index 89c741be..6f9e281e 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java @@ -72,6 +72,15 @@ public void verifyInV32Without() { verifyV32("plain-without"); } + @Test + public void verifyInV2NoPagination() { + verifyV2("no-pagination"); + } + @Test + public void verifyInV3NoPagination() { + verifyV3("no-pagination"); + } + @Test public void verifyInV2SingleResource() { verifyV2("single-resource"); diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java index 463dfe8c..a044b481 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java @@ -72,6 +72,15 @@ public void verifyInV32Without() { verifyV32("plain-without"); } + @Test + public void verifyInV2NoPagination() { + verifyV2("no-pagination"); + } + @Test + public void verifyInV3NoPagination() { + verifyV3("no-pagination"); + } + @Test public void verifyInV2SingleResource() { verifyV2("single-resource"); @@ -89,6 +98,84 @@ public void verifyInV32SingleResource() { verifyV32("single-resource"); } + @Test + public void verifyInV2WrongType() { + verifyV2("wrong-type"); + } + @Test + public void verifyInV3WrongType() { + verifyV3("wrong-type"); + } + @Test + public void verifyInV31WrongType() { + verifyV31("wrong-type"); + } + @Test + public void verifyInV32WrongType() { + verifyV32("wrong-type"); + } + + @Test + public void verifyInV2WrongTypeRef() { + verifyV2("wrong-type-ref"); + } + @Test + public void verifyInV3WrongTypeRef() { + verifyV3("wrong-type-ref"); + } + @Test + public void verifyInV31WrongTypeRef() { + verifyV31("wrong-type-ref"); + } + @Test + public void verifyInV32WrongTypeRef() { + verifyV32("wrong-type-ref"); + } + + @Test + public void verifyInV3SchemaRef() { + verifyV3("schema-ref"); + } + @Test + public void verifyInV31SchemaRef() { + verifyV31("schema-ref"); + } + @Test + public void verifyInV32SchemaRef() { + verifyV32("schema-ref"); + } + + @Test + public void verifyInV2OkRef() { + verifyV2("ok-ref"); + } + @Test + public void verifyInV3OkRef() { + verifyV3("ok-ref"); + } + @Test + public void verifyInV31OkRef() { + verifyV31("ok-ref"); + } + @Test + public void verifyInV32OkRef() { + verifyV32("ok-ref"); + } + + @Test + public void verifyInV31ArrayType() { + verifyV31("array-type"); + } + @Test + public void verifyInV32ArrayType() { + verifyV32("array-type"); + } + + @Test + public void verifyInV3NoType() { + verifyV3("no-type"); + } + @Override public void verifyRule() { assertRuleProperties("OAR025 - LimitParameter - the chosen parameter must be defined in this operation", RuleType.BUG, Severity.MAJOR, tags("parameters")); diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java index cdd82acd..84a65668 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java @@ -46,6 +46,11 @@ public void verifyInV32() { public void verifyInV3WithoutAuthorizationResponses() { verifyV3("without-authorization-responses"); } + + @Test + public void verifyInV3SecurityOptOut() { + verifyV3("security-opt-out"); + } @Test public void verifyInV31WithoutAuthorizationResponses() { verifyV31("without-authorization-responses"); diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java index 7785ea2d..923362fb 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java @@ -46,6 +46,11 @@ public void verifyInV32() { public void verifyInV3WithoutAuthorizationResponses() { verifyV3("without-authorization-responses"); } + + @Test + public void verifyInV3SecurityOptOut() { + verifyV3("security-opt-out"); + } @Test public void verifyInV31WithoutAuthorizationResponses() { verifyV31("without-authorization-responses"); diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json index c33df6db..1a341339 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml index cbfa1337..0cddad70 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json index 5a767b89..42c40f92 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml index 5ff4ea53..c4b2e498 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json index 9cd3db7a..64d230cb 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json +++ b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml index 795fbab0..225d0387 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml +++ b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v2/format/OAR037/nested.json b/src/test/resources/checks/v2/format/OAR037/nested.json index 819ad8b7..c53ad332 100644 --- a/src/test/resources/checks/v2/format/OAR037/nested.json +++ b/src/test/resources/checks/v2/format/OAR037/nested.json @@ -17,7 +17,7 @@ "type" : "object", "properties" : { "value" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format" : "YYYY-MM-DD" }, "code" : { diff --git a/src/test/resources/checks/v2/format/OAR037/nested.yaml b/src/test/resources/checks/v2/format/OAR037/nested.yaml index 6a3c55c2..b187416e 100644 --- a/src/test/resources/checks/v2/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v2/format/OAR037/nested.yaml @@ -15,7 +15,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v2/format/OAR037/plain.json b/src/test/resources/checks/v2/format/OAR037/plain.json index 31df3943..64aabe13 100644 --- a/src/test/resources/checks/v2/format/OAR037/plain.json +++ b/src/test/resources/checks/v2/format/OAR037/plain.json @@ -14,14 +14,18 @@ "type" : "object", "properties" : { "without" : { - "type" : "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern" : { "type" : "string", "pattern" : "^[A-Z]{3}-[0-9]+$" }, + "withEnum" : { + "type" : "string", + "enum" : ["email", "sms"] + }, "withInvalidPattern" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern" : "[" }, "date" : { @@ -69,7 +73,7 @@ "format" : "ipv6" }, "other" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format" : "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v2/format/OAR037/plain.yaml b/src/test/resources/checks/v2/format/OAR037/plain.yaml index a09e36e2..072033f3 100644 --- a/src/test/resources/checks/v2/format/OAR037/plain.yaml +++ b/src/test/resources/checks/v2/format/OAR037/plain.yaml @@ -12,12 +12,17 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -59,5 +64,5 @@ paths: type: string format: HEX(16) other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v2/format/OAR037/with-$ref.json b/src/test/resources/checks/v2/format/OAR037/with-$ref.json index e9c50847..bc482563 100644 --- a/src/test/resources/checks/v2/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v2/format/OAR037/with-$ref.json @@ -32,7 +32,7 @@ "type" : "object", "properties" : { "value" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format" : "YYYY-MM-DD" }, "code" : { diff --git a/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml index a589efeb..0000a0d8 100644 --- a/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml @@ -22,7 +22,7 @@ definitions: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v2/format/OAR044/media-type.json b/src/test/resources/checks/v2/format/OAR044/media-type.json index 216fca4c..c785305c 100644 --- a/src/test/resources/checks/v2/format/OAR044/media-type.json +++ b/src/test/resources/checks/v2/format/OAR044/media-type.json @@ -18,8 +18,8 @@ } }, "post" : { - "produces" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json", "text/csv", "image/png" ], - "consumes" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json" ], + "produces" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json", "text/csv", "image/png", "text/plain;charset=utf-8", "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" ], + "consumes" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json", "application/json; charset=utf-8; boundary=xyz" ], "responses" : { "200" : { "description" : "some operation" diff --git a/src/test/resources/checks/v2/format/OAR044/media-type.yaml b/src/test/resources/checks/v2/format/OAR044/media-type.yaml index fd2d08e0..aaabbad4 100644 --- a/src/test/resources/checks/v2/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v2/format/OAR044/media-type.yaml @@ -27,10 +27,13 @@ paths: - application/ld+json - text/csv - image/png + - text/plain;charset=utf-8 + - multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk consumes: - application/vnd.ms-excel - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet - application/ld+json + - application/json; charset=utf-8; boundary=xyz responses: '200': description: some operation \ No newline at end of file diff --git a/src/test/resources/checks/v2/operations/OAR014/plain.json b/src/test/resources/checks/v2/operations/OAR014/plain.json index 1dc0ee29..97d2e1d1 100644 --- a/src/test/resources/checks/v2/operations/OAR014/plain.json +++ b/src/test/resources/checks/v2/operations/OAR014/plain.json @@ -59,7 +59,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -68,7 +68,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -77,7 +77,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -86,7 +86,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v2/operations/OAR014/plain.yaml b/src/test/resources/checks/v2/operations/OAR014/plain.yaml index 5647b610..1b37831c 100644 --- a/src/test/resources/checks/v2/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v2/operations/OAR014/plain.yaml @@ -33,22 +33,22 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/operations/OAR015/plain.json b/src/test/resources/checks/v2/operations/OAR015/plain.json index d8f8fc1d..4d0248dc 100644 --- a/src/test/resources/checks/v2/operations/OAR015/plain.json +++ b/src/test/resources/checks/v2/operations/OAR015/plain.json @@ -95,7 +95,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -104,7 +104,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -113,7 +113,7 @@ } } }, - "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get" : { "responses" : { "default" : { diff --git a/src/test/resources/checks/v2/operations/OAR015/plain.yaml b/src/test/resources/checks/v2/operations/OAR015/plain.yaml index 19bce139..8fcff6ba 100644 --- a/src/test/resources/checks/v2/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v2/operations/OAR015/plain.yaml @@ -53,17 +53,17 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/parameters/OAR022/no-pagination.json b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.json new file mode 100644 index 00000000..0fa286cd --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.json @@ -0,0 +1,18 @@ +{ + "swagger": "2.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml new file mode 100644 index 00000000..0c668a99 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml @@ -0,0 +1,10 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/no-pagination.json b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.json new file mode 100644 index 00000000..0fa286cd --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.json @@ -0,0 +1,18 @@ +{ + "swagger": "2.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml new file mode 100644 index 00000000..0c668a99 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml @@ -0,0 +1,10 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..401fe997 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.json @@ -0,0 +1,29 @@ +{ + "swagger" : "2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "type" : "integer", + "format" : "int64" + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..39171d70 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,18 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +parameters: + limit: + in: query + name: $limit + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/plain.json b/src/test/resources/checks/v2/parameters/OAR025/plain.json index 609a66fb..008f8f58 100644 --- a/src/test/resources/checks/v2/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v2/parameters/OAR025/plain.json @@ -9,18 +9,12 @@ "get" : { "parameters" : [ { "in" : "query", - "name" : "$limit", - "type" : "array", - "items" : { - "type" : "string" - } + "name" : "$limit", + "type" : "integer" }, { "in" : "query", - "name" : "$limit", - "type" : "array", - "items" : { - "type" : "string" - } + "name" : "$limit", + "type" : "integer" } ], "responses" : { "206" : { @@ -30,4 +24,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/plain.yaml b/src/test/resources/checks/v2/parameters/OAR025/plain.yaml index 4d2fd9a5..3c641624 100644 --- a/src/test/resources/checks/v2/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v2/parameters/OAR025/plain.yaml @@ -8,14 +8,10 @@ paths: parameters: - in: query name: $limit - type: array - items: - type: string + type: integer - in: query name: $limit - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..861b5308 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,28 @@ +{ + "swagger" : "2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "type" : "string" + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..f80d9f35 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,17 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +parameters: + limit: + in: query + name: $limit + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..36aeb1c1 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.json @@ -0,0 +1,23 @@ +{ + "swagger" : "2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "type" : "string" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..f61b299b --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,14 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v2/resources/OAR014/plain.json b/src/test/resources/checks/v2/resources/OAR014/plain.json index 1dc0ee29..97d2e1d1 100644 --- a/src/test/resources/checks/v2/resources/OAR014/plain.json +++ b/src/test/resources/checks/v2/resources/OAR014/plain.json @@ -59,7 +59,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -68,7 +68,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -77,7 +77,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -86,7 +86,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v2/resources/OAR014/plain.yaml b/src/test/resources/checks/v2/resources/OAR014/plain.yaml index 385ef638..9af5b6dd 100644 --- a/src/test/resources/checks/v2/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v2/resources/OAR014/plain.yaml @@ -33,22 +33,22 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/resources/OAR015/plain.json b/src/test/resources/checks/v2/resources/OAR015/plain.json index 53082e2b..d5653f56 100644 --- a/src/test/resources/checks/v2/resources/OAR015/plain.json +++ b/src/test/resources/checks/v2/resources/OAR015/plain.json @@ -95,7 +95,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -104,7 +104,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -113,7 +113,7 @@ } } }, - "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get" : { "responses" : { "default" : { diff --git a/src/test/resources/checks/v2/resources/OAR015/plain.yaml b/src/test/resources/checks/v2/resources/OAR015/plain.yaml index 8e617f60..a6f60283 100644 --- a/src/test/resources/checks/v2/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v2/resources/OAR015/plain.yaml @@ -53,17 +53,17 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/security/OAR082/valid-format.json b/src/test/resources/checks/v2/security/OAR082/valid-format.json index d01e4a29..423340a7 100644 --- a/src/test/resources/checks/v2/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v2/security/OAR082/valid-format.json @@ -14,11 +14,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v2/security/OAR082/valid-format.yaml b/src/test/resources/checks/v2/security/OAR082/valid-format.yaml index 67972ef5..4f860b86 100644 --- a/src/test/resources/checks/v2/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v2/security/OAR082/valid-format.yaml @@ -12,10 +12,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} lapiz: type: string price: diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json index 48350b93..e410485e 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml index 2958720b..eef0a8fc 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json index f975009e..7a1dc3a3 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml index 2c9729aa..bb95b57c 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json index 0945724a..3b26e700 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json +++ b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml index dbe5b3ba..f46ef47e 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml +++ b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v3/format/OAR037/complete.json b/src/test/resources/checks/v3/format/OAR037/complete.json index 7c6f894f..08a7458f 100644 --- a/src/test/resources/checks/v3/format/OAR037/complete.json +++ b/src/test/resources/checks/v3/format/OAR037/complete.json @@ -10,7 +10,7 @@ "in": "header", "name": "paramOne", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } }, @@ -18,7 +18,7 @@ "in": "header", "name": "paramTwo", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -34,7 +34,7 @@ "in": "header", "name": "paramThree", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -54,14 +54,18 @@ "type": "object", "properties": { "without": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern": { "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, + "withEnum": { + "type": "string", + "enum": ["email", "sms"] + }, "withInvalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[" }, "date": { @@ -109,7 +113,7 @@ "format": "ipv6" }, "other": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v3/format/OAR037/complete.yaml b/src/test/resources/checks/v3/format/OAR037/complete.yaml index 0008a528..ba0e26ef 100644 --- a/src/test/resources/checks/v3/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v3/format/OAR037/complete.yaml @@ -8,13 +8,13 @@ components: in: header name: paramOne schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paramTwo: in: header name: paramTwo schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paths: /invoices: @@ -23,7 +23,7 @@ paths: - in: header name: paramThree schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD get: parameters: @@ -37,12 +37,17 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -78,5 +83,5 @@ paths: type: string format: ipv6 other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v3/format/OAR037/nested.json b/src/test/resources/checks/v3/format/OAR037/nested.json index 5f6a71dc..312df758 100644 --- a/src/test/resources/checks/v3/format/OAR037/nested.json +++ b/src/test/resources/checks/v3/format/OAR037/nested.json @@ -19,7 +19,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v3/format/OAR037/nested.yaml b/src/test/resources/checks/v3/format/OAR037/nested.yaml index 9a0465f1..a693669d 100644 --- a/src/test/resources/checks/v3/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v3/format/OAR037/nested.yaml @@ -17,7 +17,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v3/format/OAR037/no-format.json b/src/test/resources/checks/v3/format/OAR037/no-format.json index 57a1dd0f..2b7e0076 100644 --- a/src/test/resources/checks/v3/format/OAR037/no-format.json +++ b/src/test/resources/checks/v3/format/OAR037/no-format.json @@ -20,15 +20,15 @@ "pattern": "^[A-Za-z ]+$" }, "emptyPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "" }, "invalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[a-z" }, "code": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} } } } diff --git a/src/test/resources/checks/v3/format/OAR037/no-format.yaml b/src/test/resources/checks/v3/format/OAR037/no-format.yaml index ec4f21f1..7e832e70 100644 --- a/src/test/resources/checks/v3/format/OAR037/no-format.yaml +++ b/src/test/resources/checks/v3/format/OAR037/no-format.yaml @@ -17,10 +17,10 @@ paths: type: string pattern: '^[A-Za-z ]+$' emptyPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: "" invalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: "[a-z" code: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} diff --git a/src/test/resources/checks/v3/format/OAR037/with-$ref.json b/src/test/resources/checks/v3/format/OAR037/with-$ref.json index 51e70ff3..db2aac42 100644 --- a/src/test/resources/checks/v3/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v3/format/OAR037/with-$ref.json @@ -37,7 +37,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml index fbe316a5..110b40dc 100644 --- a/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml @@ -25,7 +25,7 @@ components: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v3/format/OAR044/media-type.json b/src/test/resources/checks/v3/format/OAR044/media-type.json index 3d3b5d7a..560ca700 100644 --- a/src/test/resources/checks/v3/format/OAR044/media-type.json +++ b/src/test/resources/checks/v3/format/OAR044/media-type.json @@ -19,10 +19,11 @@ "name" : "someParam", "in" : "query", "content" : { - "application" : { }, # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + "text/*" : { }, "text/plain" : { } } - }, + }, { "name" : "otherParam", "in" : "path" @@ -32,12 +33,17 @@ "requestBody" : { "content" : { "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + ".text/plain" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} "text/*" : { }, "application/vnd.ms-excel" : { }, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : { }, "application/ld+json" : { }, "image/*" : { }, - "*/*" : { } + "*/*" : { }, + "text/plain;charset=utf-8" : { }, + "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" : { }, + "multipart/form-data; boundary=\"----abc 123\"" : { }, + "application/json; charset=utf-8; boundary=xyz" : { } } }, "responses" : { diff --git a/src/test/resources/checks/v3/format/OAR044/media-type.yaml b/src/test/resources/checks/v3/format/OAR044/media-type.yaml index 60d8c85a..91373ff4 100644 --- a/src/test/resources/checks/v3/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v3/format/OAR044/media-type.yaml @@ -14,7 +14,8 @@ paths: - name: someParam in: query content: - 'application': {} # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + 'application': {} # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + 'text/*': {} 'text/plain': {} # invalid (only 1 content allowed by spec), but should not be caught by this rule - name: otherParam in: path @@ -22,12 +23,17 @@ paths: requestBody: content: 'application': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + '.text/plain': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} 'text/*': { } 'application/vnd.ms-excel': {} 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': {} 'application/ld+json': {} 'image/*': {} '*/*': {} + 'text/plain;charset=utf-8': {} + 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk': {} + 'multipart/form-data; boundary="----abc 123"': {} + 'application/json; charset=utf-8; boundary=xyz': {} responses: '200': description: some operation diff --git a/src/test/resources/checks/v3/operations/OAR014/plain.json b/src/test/resources/checks/v3/operations/OAR014/plain.json index ec717959..69435707 100644 --- a/src/test/resources/checks/v3/operations/OAR014/plain.json +++ b/src/test/resources/checks/v3/operations/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/operations/OAR014/plain.yaml b/src/test/resources/checks/v3/operations/OAR014/plain.yaml index 08c7baa0..5c7cb46d 100644 --- a/src/test/resources/checks/v3/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v3/operations/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/operations/OAR015/plain.json b/src/test/resources/checks/v3/operations/OAR015/plain.json index 258325fe..c94c552a 100644 --- a/src/test/resources/checks/v3/operations/OAR015/plain.json +++ b/src/test/resources/checks/v3/operations/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/operations/OAR015/plain.yaml b/src/test/resources/checks/v3/operations/OAR015/plain.yaml index 94edfe5d..1f18f36a 100644 --- a/src/test/resources/checks/v3/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v3/operations/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/parameters/OAR022/no-pagination.json b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.json new file mode 100644 index 00000000..68b6c31b --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.json @@ -0,0 +1,18 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml new file mode 100644 index 00000000..e3e4265e --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml @@ -0,0 +1,10 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-pagination.json b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.json new file mode 100644 index 00000000..68b6c31b --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.json @@ -0,0 +1,18 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml new file mode 100644 index 00000000..e3e4265e --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml @@ -0,0 +1,10 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-type.json b/src/test/resources/checks/v3/parameters/OAR025/no-type.json new file mode 100644 index 00000000..85760114 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "format" : "int64" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-type.yaml b/src/test/resources/checks/v3/parameters/OAR025/no-type.yaml new file mode 100644 index 00000000..f58f3717 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + format: int64 + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..07a916d8 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : "integer", + "format" : "int64" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..f5e2ddd5 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/components/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/plain.json b/src/test/resources/checks/v3/parameters/OAR025/plain.json index b853da7f..b530779a 100644 --- a/src/test/resources/checks/v3/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v3/parameters/OAR025/plain.json @@ -11,19 +11,13 @@ "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } }, { "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } } ], "responses" : { @@ -34,4 +28,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/plain.yaml b/src/test/resources/checks/v3/parameters/OAR025/plain.yaml index 7eebb8fa..6083aa20 100644 --- a/src/test/resources/checks/v3/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v3/parameters/OAR025/plain.yaml @@ -9,15 +9,11 @@ paths: - in: query name: $limit schema: - type: array - items: - type: string + type: integer - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/schema-ref.json b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.json new file mode 100644 index 00000000..17c0f3cc --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "schemas" : { + "LimitType" : { + "type" : "integer", + "format" : "int64" + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "$ref" : "#/components/schemas/LimitType" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml new file mode 100644 index 00000000..e21c405c --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + schemas: + LimitType: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + $ref: '#/components/schemas/LimitType' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..f607f779 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,32 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..c4ccd59a --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,19 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/components/parameters/limit' + responses: + "206": + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..dcae46f1 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..48d38b43 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/resources/OAR014/plain.json b/src/test/resources/checks/v3/resources/OAR014/plain.json index ec717959..69435707 100644 --- a/src/test/resources/checks/v3/resources/OAR014/plain.json +++ b/src/test/resources/checks/v3/resources/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/resources/OAR014/plain.yaml b/src/test/resources/checks/v3/resources/OAR014/plain.yaml index 08c7baa0..5c7cb46d 100644 --- a/src/test/resources/checks/v3/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v3/resources/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/resources/OAR015/plain.json b/src/test/resources/checks/v3/resources/OAR015/plain.json index 258325fe..c94c552a 100644 --- a/src/test/resources/checks/v3/resources/OAR015/plain.json +++ b/src/test/resources/checks/v3/resources/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/resources/OAR015/plain.yaml b/src/test/resources/checks/v3/resources/OAR015/plain.yaml index 94edfe5d..1f18f36a 100644 --- a/src/test/resources/checks/v3/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v3/resources/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/security/OAR035/security-opt-out.json b/src/test/resources/checks/v3/security/OAR035/security-opt-out.json new file mode 100644 index 00000000..6c37de49 --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR035/security-opt-out.json @@ -0,0 +1,40 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "OAR035 - security opt-out" + }, + "components": { + "securitySchemes": { + "ApiKeyAuth": { + "type": "apiKey", + "in": "header", + "name": "X-API-Key" + } + } + }, + "security": [ + { "ApiKeyAuth": [] } + ], + "paths": { + "/public": { + "get": { + "security": [], + "responses": { + "200": { + "description": "Ok" + } + } + } + }, + "/secured": { + "get": { + "responses": { # Noncompliant {{OAR035: Response code 401 must be defined for operations with security schemes defined}} + "200": { + "description": "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml b/src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml new file mode 100644 index 00000000..92e6e6d6 --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml @@ -0,0 +1,26 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: OAR035 - security opt-out +components: + securitySchemes: + ApiKeyAuth: + type: apiKey + in: header + name: X-API-Key +security: + - ApiKeyAuth: [] +paths: + /public: + get: + # Explicit opt-out: `security: []` disables the global security for this + # operation, so it is unsecured and no 401 is required (compliant). + security: [] + responses: + 200: + description: Ok + /secured: + get: + responses: # Noncompliant {{OAR035: Response code 401 must be defined for operations with security schemes defined}} + 200: + description: Ok diff --git a/src/test/resources/checks/v3/security/OAR082/valid-format.json b/src/test/resources/checks/v3/security/OAR082/valid-format.json index 7423cb98..de5421e5 100644 --- a/src/test/resources/checks/v3/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v3/security/OAR082/valid-format.json @@ -16,11 +16,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v3/security/OAR082/valid-format.yaml b/src/test/resources/checks/v3/security/OAR082/valid-format.yaml index 626624e9..965696f6 100644 --- a/src/test/resources/checks/v3/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v3/security/OAR082/valid-format.yaml @@ -14,10 +14,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} price: type: string format: byte \ No newline at end of file diff --git a/src/test/resources/checks/v3/security/OAR096/security-opt-out.json b/src/test/resources/checks/v3/security/OAR096/security-opt-out.json new file mode 100644 index 00000000..d11ba4b4 --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR096/security-opt-out.json @@ -0,0 +1,40 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "OAR096 - security opt-out" + }, + "components": { + "securitySchemes": { + "ApiKeyAuth": { + "type": "apiKey", + "in": "header", + "name": "X-API-Key" + } + } + }, + "security": [ + { "ApiKeyAuth": [] } + ], + "paths": { + "/public": { + "get": { + "security": [], + "responses": { + "200": { + "description": "Ok" + } + } + } + }, + "/secured": { + "get": { + "responses": { # Noncompliant {{OAR096: Response code 403 must be defined for operations with security schemes defined}} + "200": { + "description": "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml b/src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml new file mode 100644 index 00000000..4a06da4b --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml @@ -0,0 +1,26 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: OAR096 - security opt-out +components: + securitySchemes: + ApiKeyAuth: + type: apiKey + in: header + name: X-API-Key +security: + - ApiKeyAuth: [] +paths: + /public: + get: + # Explicit opt-out: `security: []` disables the global security for this + # operation, so it is unsecured and no 403 is required (compliant). + security: [] + responses: + 200: + description: Ok + /secured: + get: + responses: # Noncompliant {{OAR096: Response code 403 must be defined for operations with security schemes defined}} + 200: + description: Ok diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json index 8d4da38a..5521fb71 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml index ba79bbe6..2bdf51c1 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json index 6d2e1cb8..eb68f917 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml index 0f470c00..e9b07e7d 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v31/apim/OAR040/invalid.json b/src/test/resources/checks/v31/apim/OAR040/invalid.json index 802839a0..ccc66d8b 100644 --- a/src/test/resources/checks/v31/apim/OAR040/invalid.json +++ b/src/test/resources/checks/v31/apim/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v31/apim/OAR040/invalid.yaml b/src/test/resources/checks/v31/apim/OAR040/invalid.yaml index 0f445609..e97d36d7 100644 --- a/src/test/resources/checks/v31/apim/OAR040/invalid.yaml +++ b/src/test/resources/checks/v31/apim/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v31/format/OAR037/complete.json b/src/test/resources/checks/v31/format/OAR037/complete.json index 6584f397..d338aaf9 100644 --- a/src/test/resources/checks/v31/format/OAR037/complete.json +++ b/src/test/resources/checks/v31/format/OAR037/complete.json @@ -10,7 +10,7 @@ "in": "header", "name": "paramOne", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } }, @@ -18,7 +18,7 @@ "in": "header", "name": "paramTwo", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -34,7 +34,7 @@ "in": "header", "name": "paramThree", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -54,14 +54,18 @@ "type": "object", "properties": { "without": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern": { "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, + "withEnum": { + "type": "string", + "enum": ["email", "sms"] + }, "withInvalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[" }, "date": { @@ -109,7 +113,7 @@ "format": "ipv6" }, "other": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v31/format/OAR037/complete.yaml b/src/test/resources/checks/v31/format/OAR037/complete.yaml index e75afc02..e4b5b59a 100644 --- a/src/test/resources/checks/v31/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v31/format/OAR037/complete.yaml @@ -8,13 +8,13 @@ components: in: header name: paramOne schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paramTwo: in: header name: paramTwo schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paths: /invoices: @@ -23,7 +23,7 @@ paths: - in: header name: paramThree schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD get: parameters: @@ -37,12 +37,17 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -78,5 +83,5 @@ paths: type: string format: ipv6 other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v31/format/OAR037/nested.json b/src/test/resources/checks/v31/format/OAR037/nested.json index 5fc02cb9..b82a4a64 100644 --- a/src/test/resources/checks/v31/format/OAR037/nested.json +++ b/src/test/resources/checks/v31/format/OAR037/nested.json @@ -19,7 +19,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v31/format/OAR037/nested.yaml b/src/test/resources/checks/v31/format/OAR037/nested.yaml index 302751f2..09a6b93e 100644 --- a/src/test/resources/checks/v31/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v31/format/OAR037/nested.yaml @@ -17,7 +17,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v31/format/OAR037/with-$ref.json b/src/test/resources/checks/v31/format/OAR037/with-$ref.json index 0e0d12bc..24be9044 100644 --- a/src/test/resources/checks/v31/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v31/format/OAR037/with-$ref.json @@ -37,7 +37,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml index 36a92461..960da9ec 100644 --- a/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml @@ -25,7 +25,7 @@ components: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v31/format/OAR044/media-type.json b/src/test/resources/checks/v31/format/OAR044/media-type.json index 05232934..97dd17e6 100644 --- a/src/test/resources/checks/v31/format/OAR044/media-type.json +++ b/src/test/resources/checks/v31/format/OAR044/media-type.json @@ -19,10 +19,11 @@ "name" : "someParam", "in" : "query", "content" : { - "application" : { }, # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + "text/*" : { }, "text/plain" : { } } - }, + }, { "name" : "otherParam", "in" : "path" @@ -32,12 +33,17 @@ "requestBody" : { "content" : { "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + ".text/plain" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} "text/*" : { }, "application/vnd.ms-excel" : { }, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : { }, "application/ld+json" : { }, "image/*" : { }, - "*/*" : { } + "*/*" : { }, + "text/plain;charset=utf-8" : { }, + "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" : { }, + "multipart/form-data; boundary=\"----abc 123\"" : { }, + "application/json; charset=utf-8; boundary=xyz" : { } } }, "responses" : { diff --git a/src/test/resources/checks/v31/format/OAR044/media-type.yaml b/src/test/resources/checks/v31/format/OAR044/media-type.yaml index 71f903d8..1de0edc8 100644 --- a/src/test/resources/checks/v31/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v31/format/OAR044/media-type.yaml @@ -14,7 +14,8 @@ paths: - name: someParam in: query content: - 'application': {} # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + 'application': {} # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + 'text/*': {} 'text/plain': {} # invalid (only 1 content allowed by spec), but should not be caught by this rule - name: otherParam in: path @@ -22,12 +23,17 @@ paths: requestBody: content: 'application': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + '.text/plain': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} 'text/*': { } 'application/vnd.ms-excel': {} 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': {} 'application/ld+json': {} 'image/*': {} '*/*': {} + 'text/plain;charset=utf-8': {} + 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk': {} + 'multipart/form-data; boundary="----abc 123"': {} + 'application/json; charset=utf-8; boundary=xyz': {} responses: '200': description: some operation diff --git a/src/test/resources/checks/v31/operations/OAR014/plain.json b/src/test/resources/checks/v31/operations/OAR014/plain.json index ae30763d..94def842 100644 --- a/src/test/resources/checks/v31/operations/OAR014/plain.json +++ b/src/test/resources/checks/v31/operations/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/operations/OAR014/plain.yaml b/src/test/resources/checks/v31/operations/OAR014/plain.yaml index 0e563616..f14772af 100644 --- a/src/test/resources/checks/v31/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v31/operations/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/operations/OAR015/plain.json b/src/test/resources/checks/v31/operations/OAR015/plain.json index cbdd1838..d185ad4d 100644 --- a/src/test/resources/checks/v31/operations/OAR015/plain.json +++ b/src/test/resources/checks/v31/operations/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/operations/OAR015/plain.yaml b/src/test/resources/checks/v31/operations/OAR015/plain.yaml index e298945b..5e2889c3 100644 --- a/src/test/resources/checks/v31/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v31/operations/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/parameters/OAR025/array-type.json b/src/test/resources/checks/v31/parameters/OAR025/array-type.json new file mode 100644 index 00000000..9cc98ddb --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/array-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : [ "integer", "null" ] + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/array-type.yaml b/src/test/resources/checks/v31/parameters/OAR025/array-type.yaml new file mode 100644 index 00000000..91d0cad7 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/array-type.yaml @@ -0,0 +1,17 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: + - integer + - "null" + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..d0716f34 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : "integer", + "format" : "int64" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..4a465d0b --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/components/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/plain.json b/src/test/resources/checks/v31/parameters/OAR025/plain.json index 96bc8d9a..6acf169c 100644 --- a/src/test/resources/checks/v31/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v31/parameters/OAR025/plain.json @@ -11,19 +11,13 @@ "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } }, { "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } } ], "responses" : { @@ -34,4 +28,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/plain.yaml b/src/test/resources/checks/v31/parameters/OAR025/plain.yaml index 3bf57ba7..211962c6 100644 --- a/src/test/resources/checks/v31/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v31/parameters/OAR025/plain.yaml @@ -9,15 +9,11 @@ paths: - in: query name: $limit schema: - type: array - items: - type: string + type: integer - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/schema-ref.json b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.json new file mode 100644 index 00000000..94d74d36 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "schemas" : { + "LimitType" : { + "type" : "integer", + "format" : "int64" + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "$ref" : "#/components/schemas/LimitType" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml new file mode 100644 index 00000000..9205f523 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + schemas: + LimitType: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + $ref: '#/components/schemas/LimitType' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..813e37f5 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,32 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..4352ade3 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,19 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/components/parameters/limit' + responses: + "206": + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..aa97f48d --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..8c41be46 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/resources/OAR014/plain.json b/src/test/resources/checks/v31/resources/OAR014/plain.json index 973e4d92..63ada396 100644 --- a/src/test/resources/checks/v31/resources/OAR014/plain.json +++ b/src/test/resources/checks/v31/resources/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/resources/OAR014/plain.yaml b/src/test/resources/checks/v31/resources/OAR014/plain.yaml index 0e563616..f14772af 100644 --- a/src/test/resources/checks/v31/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v31/resources/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/resources/OAR015/plain.json b/src/test/resources/checks/v31/resources/OAR015/plain.json index 28fbb79d..f968f5c7 100644 --- a/src/test/resources/checks/v31/resources/OAR015/plain.json +++ b/src/test/resources/checks/v31/resources/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/resources/OAR015/plain.yaml b/src/test/resources/checks/v31/resources/OAR015/plain.yaml index e298945b..5e2889c3 100644 --- a/src/test/resources/checks/v31/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v31/resources/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/security/OAR082/valid-format.json b/src/test/resources/checks/v31/security/OAR082/valid-format.json index 23251d95..14f67df5 100644 --- a/src/test/resources/checks/v31/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v31/security/OAR082/valid-format.json @@ -16,11 +16,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v31/security/OAR082/valid-format.yaml b/src/test/resources/checks/v31/security/OAR082/valid-format.yaml index ec26b569..3eea1a41 100644 --- a/src/test/resources/checks/v31/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v31/security/OAR082/valid-format.yaml @@ -14,10 +14,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} price: type: string format: byte \ No newline at end of file diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json index 8174b636..6b6e1192 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml index d87427fd..7492553e 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json index 629afce2..a57822db 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml index e768acea..433013de 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v32/apim/OAR040/invalid.json b/src/test/resources/checks/v32/apim/OAR040/invalid.json index 2f56af18..4863c280 100644 --- a/src/test/resources/checks/v32/apim/OAR040/invalid.json +++ b/src/test/resources/checks/v32/apim/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v32/apim/OAR040/invalid.yaml b/src/test/resources/checks/v32/apim/OAR040/invalid.yaml index 177ea034..e060ba58 100644 --- a/src/test/resources/checks/v32/apim/OAR040/invalid.yaml +++ b/src/test/resources/checks/v32/apim/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v32/format/OAR037/complete.json b/src/test/resources/checks/v32/format/OAR037/complete.json index 74f1adcd..4d38fbb0 100644 --- a/src/test/resources/checks/v32/format/OAR037/complete.json +++ b/src/test/resources/checks/v32/format/OAR037/complete.json @@ -10,7 +10,7 @@ "in": "header", "name": "paramOne", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } }, @@ -18,7 +18,7 @@ "in": "header", "name": "paramTwo", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -34,7 +34,7 @@ "in": "header", "name": "paramThree", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -54,14 +54,18 @@ "type": "object", "properties": { "without": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern": { "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, + "withEnum": { + "type": "string", + "enum": ["email", "sms"] + }, "withInvalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[" }, "date": { @@ -109,7 +113,7 @@ "format": "ipv6" }, "other": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v32/format/OAR037/complete.yaml b/src/test/resources/checks/v32/format/OAR037/complete.yaml index 0e7f4cc7..1105de1f 100644 --- a/src/test/resources/checks/v32/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v32/format/OAR037/complete.yaml @@ -8,13 +8,13 @@ components: in: header name: paramOne schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paramTwo: in: header name: paramTwo schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paths: /invoices: @@ -23,7 +23,7 @@ paths: - in: header name: paramThree schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD get: parameters: @@ -37,12 +37,17 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -78,5 +83,5 @@ paths: type: string format: ipv6 other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v32/format/OAR037/nested.json b/src/test/resources/checks/v32/format/OAR037/nested.json index 74e72c00..77f69c32 100644 --- a/src/test/resources/checks/v32/format/OAR037/nested.json +++ b/src/test/resources/checks/v32/format/OAR037/nested.json @@ -19,7 +19,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v32/format/OAR037/nested.yaml b/src/test/resources/checks/v32/format/OAR037/nested.yaml index a6fd15be..fcfd1a94 100644 --- a/src/test/resources/checks/v32/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v32/format/OAR037/nested.yaml @@ -17,7 +17,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v32/format/OAR037/with-$ref.json b/src/test/resources/checks/v32/format/OAR037/with-$ref.json index 0589c17f..baca97c4 100644 --- a/src/test/resources/checks/v32/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v32/format/OAR037/with-$ref.json @@ -37,7 +37,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml index b631e251..bda454ab 100644 --- a/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml @@ -25,7 +25,7 @@ components: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v32/format/OAR044/media-type.json b/src/test/resources/checks/v32/format/OAR044/media-type.json index 0251e212..0b41954d 100644 --- a/src/test/resources/checks/v32/format/OAR044/media-type.json +++ b/src/test/resources/checks/v32/format/OAR044/media-type.json @@ -19,10 +19,11 @@ "name" : "someParam", "in" : "query", "content" : { - "application" : { }, # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + "text/*" : { }, "text/plain" : { } } - }, + }, { "name" : "otherParam", "in" : "path" @@ -32,12 +33,17 @@ "requestBody" : { "content" : { "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + ".text/plain" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} "text/*" : { }, "application/vnd.ms-excel" : { }, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : { }, "application/ld+json" : { }, "image/*" : { }, - "*/*" : { } + "*/*" : { }, + "text/plain;charset=utf-8" : { }, + "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" : { }, + "multipart/form-data; boundary=\"----abc 123\"" : { }, + "application/json; charset=utf-8; boundary=xyz" : { } } }, "responses" : { diff --git a/src/test/resources/checks/v32/format/OAR044/media-type.yaml b/src/test/resources/checks/v32/format/OAR044/media-type.yaml index 6e1cbd7d..7b19fa8f 100644 --- a/src/test/resources/checks/v32/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v32/format/OAR044/media-type.yaml @@ -14,7 +14,8 @@ paths: - name: someParam in: query content: - 'application': {} # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + 'application': {} # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + 'text/*': {} 'text/plain': {} # invalid (only 1 content allowed by spec), but should not be caught by this rule - name: otherParam in: path @@ -22,12 +23,17 @@ paths: requestBody: content: 'application': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + '.text/plain': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} 'text/*': { } 'application/vnd.ms-excel': {} 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': {} 'application/ld+json': {} 'image/*': {} '*/*': {} + 'text/plain;charset=utf-8': {} + 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk': {} + 'multipart/form-data; boundary="----abc 123"': {} + 'application/json; charset=utf-8; boundary=xyz': {} responses: '200': description: some operation diff --git a/src/test/resources/checks/v32/operations/OAR014/plain.json b/src/test/resources/checks/v32/operations/OAR014/plain.json index e5976e87..00c3d3dd 100644 --- a/src/test/resources/checks/v32/operations/OAR014/plain.json +++ b/src/test/resources/checks/v32/operations/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/operations/OAR014/plain.yaml b/src/test/resources/checks/v32/operations/OAR014/plain.yaml index a5037c89..3b82e7f5 100644 --- a/src/test/resources/checks/v32/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v32/operations/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/operations/OAR015/plain.json b/src/test/resources/checks/v32/operations/OAR015/plain.json index 97cb52fe..bb0e67b6 100644 --- a/src/test/resources/checks/v32/operations/OAR015/plain.json +++ b/src/test/resources/checks/v32/operations/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/operations/OAR015/plain.yaml b/src/test/resources/checks/v32/operations/OAR015/plain.yaml index f29ada81..a56a7dd6 100644 --- a/src/test/resources/checks/v32/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v32/operations/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/parameters/OAR025/array-type.json b/src/test/resources/checks/v32/parameters/OAR025/array-type.json new file mode 100644 index 00000000..bc82d1d7 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/array-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : [ "integer", "null" ] + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/array-type.yaml b/src/test/resources/checks/v32/parameters/OAR025/array-type.yaml new file mode 100644 index 00000000..d22ea694 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/array-type.yaml @@ -0,0 +1,17 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: + - integer + - "null" + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..dea24726 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : "integer", + "format" : "int64" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..d5e87eab --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/components/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/plain.json b/src/test/resources/checks/v32/parameters/OAR025/plain.json index 33ee1029..636a365c 100644 --- a/src/test/resources/checks/v32/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v32/parameters/OAR025/plain.json @@ -11,19 +11,13 @@ "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } }, { "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } } ], "responses" : { @@ -34,4 +28,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/plain.yaml b/src/test/resources/checks/v32/parameters/OAR025/plain.yaml index ffee1572..4757b7d5 100644 --- a/src/test/resources/checks/v32/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v32/parameters/OAR025/plain.yaml @@ -9,15 +9,11 @@ paths: - in: query name: $limit schema: - type: array - items: - type: string + type: integer - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/schema-ref.json b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.json new file mode 100644 index 00000000..f1c3a243 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "schemas" : { + "LimitType" : { + "type" : "integer", + "format" : "int64" + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "$ref" : "#/components/schemas/LimitType" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml new file mode 100644 index 00000000..67fb80d2 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + schemas: + LimitType: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + $ref: '#/components/schemas/LimitType' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..1e384bbf --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,32 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..6dad83c0 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,19 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/components/parameters/limit' + responses: + "206": + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..09d692a1 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..2b925542 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/resources/OAR014/plain.json b/src/test/resources/checks/v32/resources/OAR014/plain.json index 2777ce2c..1cda79c9 100644 --- a/src/test/resources/checks/v32/resources/OAR014/plain.json +++ b/src/test/resources/checks/v32/resources/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/resources/OAR014/plain.yaml b/src/test/resources/checks/v32/resources/OAR014/plain.yaml index a5037c89..3b82e7f5 100644 --- a/src/test/resources/checks/v32/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v32/resources/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/resources/OAR015/plain.json b/src/test/resources/checks/v32/resources/OAR015/plain.json index d2152946..57e193b5 100644 --- a/src/test/resources/checks/v32/resources/OAR015/plain.json +++ b/src/test/resources/checks/v32/resources/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/resources/OAR015/plain.yaml b/src/test/resources/checks/v32/resources/OAR015/plain.yaml index f29ada81..a56a7dd6 100644 --- a/src/test/resources/checks/v32/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v32/resources/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/security/OAR082/valid-format.json b/src/test/resources/checks/v32/security/OAR082/valid-format.json index 9c00671e..39024bba 100644 --- a/src/test/resources/checks/v32/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v32/security/OAR082/valid-format.json @@ -16,11 +16,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v32/security/OAR082/valid-format.yaml b/src/test/resources/checks/v32/security/OAR082/valid-format.yaml index 6af346ba..aff701fa 100644 --- a/src/test/resources/checks/v32/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v32/security/OAR082/valid-format.yaml @@ -14,10 +14,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} price: type: string format: byte \ No newline at end of file