From e871a3538159885f215903fcb5cb385e63d1a3be Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Mon, 27 Jul 2026 13:26:21 -0500 Subject: [PATCH 01/11] feat: align param names and make rule messages reflect configured parameters --- CHANGELOG.md | 11 +++++++++++ pom.xml | 2 +- .../apim/wso2/AbstractPatternWso2ScopesCheck.java | 5 +++-- .../checks/format/OAR037StringFormatCheck.java | 4 ++-- .../operations/AbstractResourceLevelCheck.java | 8 +++++--- ...4ResourceLevelWithinNonSuggestedRangeCheck.java | 10 ++++++++++ .../OAR015ResourceLevelMaxAllowedCheck.java | 10 ++++++++++ .../OAR038StandardCreateResponseCheck.java | 4 ++-- .../security/OAR082BinaryOrByteFormatCheck.java | 2 +- .../checks/security/OAR085OpenAPIVersionCheck.java | 2 +- src/main/resources/messages/errors.properties | 14 ++++++++------ src/main/resources/messages/errors_es.properties | 14 ++++++++------ .../apim/wso2/OAR004/with-invalid-array-roles.json | 2 +- .../apim/wso2/OAR004/with-invalid-array-roles.yaml | 2 +- .../v2/apim/wso2/OAR004/with-invalid-roles.json | 2 +- .../v2/apim/wso2/OAR004/with-invalid-roles.yaml | 2 +- .../checks/v2/apim/wso2/OAR040/invalid.json | 8 ++++---- .../checks/v2/apim/wso2/OAR040/invalid.yaml | 8 ++++---- .../resources/checks/v2/format/OAR037/nested.json | 2 +- .../resources/checks/v2/format/OAR037/nested.yaml | 2 +- .../resources/checks/v2/format/OAR037/plain.json | 6 +++--- .../resources/checks/v2/format/OAR037/plain.yaml | 6 +++--- .../checks/v2/format/OAR037/with-$ref.json | 2 +- .../checks/v2/format/OAR037/with-$ref.yaml | 2 +- .../checks/v2/operations/OAR014/plain.json | 8 ++++---- .../checks/v2/operations/OAR014/plain.yaml | 8 ++++---- .../checks/v2/operations/OAR015/plain.json | 6 +++--- .../checks/v2/operations/OAR015/plain.yaml | 6 +++--- .../checks/v2/resources/OAR014/plain.json | 8 ++++---- .../checks/v2/resources/OAR014/plain.yaml | 8 ++++---- .../checks/v2/resources/OAR015/plain.json | 6 +++--- .../checks/v2/resources/OAR015/plain.yaml | 6 +++--- .../checks/v2/security/OAR082/valid-format.json | 4 ++-- .../checks/v2/security/OAR082/valid-format.yaml | 4 ++-- .../apim/wso2/OAR004/with-invalid-array-roles.json | 2 +- .../apim/wso2/OAR004/with-invalid-array-roles.yaml | 2 +- .../v3/apim/wso2/OAR004/with-invalid-roles.json | 2 +- .../v3/apim/wso2/OAR004/with-invalid-roles.yaml | 2 +- .../checks/v3/apim/wso2/OAR040/invalid.json | 8 ++++---- .../checks/v3/apim/wso2/OAR040/invalid.yaml | 8 ++++---- .../checks/v3/format/OAR037/complete.json | 12 ++++++------ .../checks/v3/format/OAR037/complete.yaml | 12 ++++++------ .../resources/checks/v3/format/OAR037/nested.json | 2 +- .../resources/checks/v3/format/OAR037/nested.yaml | 2 +- .../checks/v3/format/OAR037/no-format.json | 6 +++--- .../checks/v3/format/OAR037/no-format.yaml | 6 +++--- .../checks/v3/format/OAR037/with-$ref.json | 2 +- .../checks/v3/format/OAR037/with-$ref.yaml | 2 +- .../checks/v3/operations/OAR014/plain.json | 4 ++-- .../checks/v3/operations/OAR014/plain.yaml | 4 ++-- .../checks/v3/operations/OAR015/plain.json | 4 ++-- .../checks/v3/operations/OAR015/plain.yaml | 4 ++-- .../checks/v3/resources/OAR014/plain.json | 4 ++-- .../checks/v3/resources/OAR014/plain.yaml | 4 ++-- .../checks/v3/resources/OAR015/plain.json | 4 ++-- .../checks/v3/resources/OAR015/plain.yaml | 4 ++-- .../checks/v3/security/OAR082/valid-format.json | 4 ++-- .../checks/v3/security/OAR082/valid-format.yaml | 4 ++-- .../v31/apim/OAR004/with-invalid-array-roles.json | 2 +- .../v31/apim/OAR004/with-invalid-array-roles.yaml | 2 +- .../checks/v31/apim/OAR004/with-invalid-roles.json | 2 +- .../checks/v31/apim/OAR004/with-invalid-roles.yaml | 2 +- .../resources/checks/v31/apim/OAR040/invalid.json | 8 ++++---- .../resources/checks/v31/apim/OAR040/invalid.yaml | 8 ++++---- .../checks/v31/format/OAR037/complete.json | 12 ++++++------ .../checks/v31/format/OAR037/complete.yaml | 12 ++++++------ .../resources/checks/v31/format/OAR037/nested.json | 2 +- .../resources/checks/v31/format/OAR037/nested.yaml | 2 +- .../checks/v31/format/OAR037/with-$ref.json | 2 +- .../checks/v31/format/OAR037/with-$ref.yaml | 2 +- .../checks/v31/operations/OAR014/plain.json | 4 ++-- .../checks/v31/operations/OAR014/plain.yaml | 4 ++-- .../checks/v31/operations/OAR015/plain.json | 4 ++-- .../checks/v31/operations/OAR015/plain.yaml | 4 ++-- .../checks/v31/resources/OAR014/plain.json | 4 ++-- .../checks/v31/resources/OAR014/plain.yaml | 4 ++-- .../checks/v31/resources/OAR015/plain.json | 4 ++-- .../checks/v31/resources/OAR015/plain.yaml | 4 ++-- .../checks/v31/security/OAR082/valid-format.json | 4 ++-- .../checks/v31/security/OAR082/valid-format.yaml | 4 ++-- .../v32/apim/OAR004/with-invalid-array-roles.json | 2 +- .../v32/apim/OAR004/with-invalid-array-roles.yaml | 2 +- .../checks/v32/apim/OAR004/with-invalid-roles.json | 2 +- .../checks/v32/apim/OAR004/with-invalid-roles.yaml | 2 +- .../resources/checks/v32/apim/OAR040/invalid.json | 8 ++++---- .../resources/checks/v32/apim/OAR040/invalid.yaml | 8 ++++---- .../checks/v32/format/OAR037/complete.json | 12 ++++++------ .../checks/v32/format/OAR037/complete.yaml | 12 ++++++------ .../resources/checks/v32/format/OAR037/nested.json | 2 +- .../resources/checks/v32/format/OAR037/nested.yaml | 2 +- .../checks/v32/format/OAR037/with-$ref.json | 2 +- .../checks/v32/format/OAR037/with-$ref.yaml | 2 +- .../checks/v32/operations/OAR014/plain.json | 4 ++-- .../checks/v32/operations/OAR014/plain.yaml | 4 ++-- .../checks/v32/operations/OAR015/plain.json | 4 ++-- .../checks/v32/operations/OAR015/plain.yaml | 4 ++-- .../checks/v32/resources/OAR014/plain.json | 4 ++-- .../checks/v32/resources/OAR014/plain.yaml | 4 ++-- .../checks/v32/resources/OAR015/plain.json | 4 ++-- .../checks/v32/resources/OAR015/plain.yaml | 4 ++-- .../checks/v32/security/OAR082/valid-format.json | 4 ++-- .../checks/v32/security/OAR082/valid-format.yaml | 4 ++-- 102 files changed, 266 insertions(+), 228 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21481194..e81c69c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.5.0-beta-5] - 2026-07-27 + +### Fixed + +- OAR014 / OAR015 - ResourceLevel - Issue message now interpolates the configured level values (min-level/max-level for OAR014, max-level-allowed for OAR015). +- OAR004 / OAR040 - Wso2Scopes - Issue message now includes the configured `pattern` (passed through `AbstractPatternWso2ScopesCheck`). +- OAR038 - StandardCreateResponse - Issue message now interpolates the configured `data-property` instead of the hardcoded `data`. +- OAR082 - BinaryOrByteFormat - Issue message now shows the configured `fields-to-apply`. +- OAR085 - OpenAPIVersion - Issue message now shows the configured `valid-versions`. +- OAR037 - StringFormat - Issue message now interpolates the configured `formats-allowed`. + ## [1.5.0-beta-4] - 2026-07-14 ### Fixed diff --git a/pom.xml b/pom.xml index 161983e8..2942fd55 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.0-beta-4 + 1.5.0-beta-5 sonar-plugin SonarQube OpenAPI Community Rules diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/apim/wso2/AbstractPatternWso2ScopesCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/apim/wso2/AbstractPatternWso2ScopesCheck.java index 8e5fb60e..9a487453 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/apim/wso2/AbstractPatternWso2ScopesCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/apim/wso2/AbstractPatternWso2ScopesCheck.java @@ -35,18 +35,19 @@ protected void visitScope(JsonNode scope) { if (fieldNode == null || fieldNode.isNull() || fieldNode.isMissing()) return; + String patternStr = getPatternStr() != null ? getPatternStr() : defaultPatternValue; List elements = fieldNode.elements(); if (!elements.isEmpty()) { for (JsonNode element : elements) { String roleText = element.getTokenValue(); if (roleText != null && !pattern.matcher(roleText).matches()) { - addIssue(ruleKey, translate(messageKey), element); + addIssue(ruleKey, translate(messageKey, patternStr), element); } } } else { String fieldText = fieldNode.getTokenValue(); if (fieldText != null && !pattern.matcher(fieldText).matches()) { - addIssue(ruleKey, translate(messageKey), fieldNode); + addIssue(ruleKey, translate(messageKey, patternStr), fieldNode); } } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java index 96e58d22..5b64fb36 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java @@ -34,13 +34,13 @@ public void validate(String type, String format, JsonNode typeNode, JsonNode nod .map(f -> f.trim().toLowerCase()) .collect(Collectors.toSet()); if (!validFormats.contains(format.toLowerCase())) { - addIssue(KEY, translate(MESSAGE), typeNode.key()); + addIssue(KEY, translate(MESSAGE, formatsAllowed), typeNode.key()); } return; } if (!hasValidPattern(node)) { - addIssue(KEY, translate(MESSAGE), typeNode.key()); + addIssue(KEY, translate(MESSAGE, formatsAllowed), typeNode.key()); } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/operations/AbstractResourceLevelCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/operations/AbstractResourceLevelCheck.java index ac94b477..d8deba40 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/operations/AbstractResourceLevelCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/operations/AbstractResourceLevelCheck.java @@ -15,8 +15,6 @@ public abstract class AbstractResourceLevelCheck extends BaseCheck { - private static final String MESSAGE = "generic.path-level"; - private String key; protected AbstractResourceLevelCheck(String key) { @@ -31,9 +29,13 @@ public Set subscribedKinds() { @Override public void visitNode(JsonNode node) { String path = node.key().getTokenValue(); - if (matchLevel(path)) addIssue(key, translate(MESSAGE), node.key()); + if (matchLevel(path)) addIssue(key, translate(messageKey(), messageArgs()), node.key()); } + protected abstract String messageKey(); + + protected abstract Object[] messageArgs(); + private boolean matchLevel(String path) { long literalCount = Stream.of(path.split("/")) .filter(s -> !s.trim().isEmpty()) diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR014ResourceLevelWithinNonSuggestedRangeCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR014ResourceLevelWithinNonSuggestedRangeCheck.java index 504aabe0..a429360f 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR014ResourceLevelWithinNonSuggestedRangeCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR014ResourceLevelWithinNonSuggestedRangeCheck.java @@ -34,4 +34,14 @@ public OAR014ResourceLevelWithinNonSuggestedRangeCheck() { boolean matchLevel(long level) { return minLevel <= level && level <= maxLevel; } + + @Override + protected String messageKey() { + return "OAR014.error"; + } + + @Override + protected Object[] messageArgs() { + return new Object[] { minLevel, maxLevel }; + } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR015ResourceLevelMaxAllowedCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR015ResourceLevelMaxAllowedCheck.java index 2320e732..c570ba67 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR015ResourceLevelMaxAllowedCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR015ResourceLevelMaxAllowedCheck.java @@ -25,4 +25,14 @@ public OAR015ResourceLevelMaxAllowedCheck() { boolean matchLevel(long level) { return maxLevelAllowed < level; } + + @Override + protected String messageKey() { + return "OAR015.error"; + } + + @Override + protected Object[] messageArgs() { + return new Object[] { maxLevelAllowed }; + } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR038StandardCreateResponseCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR038StandardCreateResponseCheck.java index 57e27ce6..c613cac0 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR038StandardCreateResponseCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/operations/OAR038StandardCreateResponseCheck.java @@ -49,12 +49,12 @@ protected void visitV2ExplicitNode(JsonNode node) { addIssue(KEY, translate("OAR038.error-required-one-property"), entry.getValue().key()); } } else { - addIssue(KEY, translate("OAR038.error"), entry.getValue().key()); + addIssue(KEY, translate("OAR038.error", dataNode), entry.getValue().key()); } } if (properties.isEmpty()) { - addIssue(KEY, translate("OAR038.error"), schemaNode.key()); + addIssue(KEY, translate("OAR038.error", dataNode), schemaNode.key()); } } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR082BinaryOrByteFormatCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR082BinaryOrByteFormatCheck.java index cbaf2ad1..2f619e19 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR082BinaryOrByteFormatCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR082BinaryOrByteFormatCheck.java @@ -62,7 +62,7 @@ private void visitV2Node(JsonNode node) { if ("string".equals(type)) { String format = fieldNode.get("format").getTokenValue(); if (!"binary".equals(format) && !"byte".equals(format)) { - addIssue(KEY, translate(MESSAGE), typeNode.key()); + addIssue(KEY, translate(MESSAGE, fieldsApply), typeNode.key()); } } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR085OpenAPIVersionCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR085OpenAPIVersionCheck.java index 7422bc70..4ba0c578 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR085OpenAPIVersionCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/security/OAR085OpenAPIVersionCheck.java @@ -38,7 +38,7 @@ protected void visitFile(JsonNode root) { List validVersions = Arrays.asList(validVersionsStr.split(",")); if (version == null || !validVersions.contains(version)) { - addIssue(KEY, translate(MESSAGE, version), root.key()); + addIssue(KEY, translate(MESSAGE, validVersionsStr), root.key()); } } diff --git a/src/main/resources/messages/errors.properties b/src/main/resources/messages/errors.properties index 78ab417f..ab992b90 100644 --- a/src/main/resources/messages/errors.properties +++ b/src/main/resources/messages/errors.properties @@ -5,13 +5,15 @@ OAR001.error-v3-https=Protocol https in server url is mandatory OAR002.error=WSO2 scopes definition is wrong OAR002.error-property=WSO2 scope ''{0}'' is required OAR003.error=WSO2 scope ''description'' is recommended -OAR004.error=WSO2 scope roles value is not valid +OAR004.error=WSO2 scope role does not match the required pattern: {0} OAR005.error=WSO2 scope definition does not exists OAR008.error=Http verb ({0}) not encouraged OAR010.error-request-body-not-allowed=requestBody not allowed with operation ''{0}'' OAR011.error=The base path and resource names with more than two words must be compliant with the standard naming convention: {0} OAR012.error=Path params names, query params names, object names and property names with more than two words must be compliant with the standard naming convention: {0} OAR013.error=Default response is required +OAR014.error=Resources depth level must not fall within the non-suggested range {0} to {1} +OAR015.error=Resources depth level must be smaller than or equal to {0} OAR016.error=Numeric types requires a valid format OAR017.error=Resource path should alternate static and parametrized parts OAR017.error-patterns=Pattern ''{0}'' not allowed @@ -37,12 +39,12 @@ OAR032.error=Ambiguous path parts not encouraged: {0} OAR033.error-header-required=''{0}'' header must be required OAR035.error=Response code {0} must be defined for operations with security schemes defined OAR036.error=Cookie use is forbidden as a session mechanism -OAR037.error=String types require a valid format, or a valid pattern when no format is defined -OAR038.error=''data'' or ''error'' property is required +OAR037.error=String types require one of the allowed formats ({0}), or a valid pattern when no format is defined +OAR038.error=''{0}'' or ''error'' property is required OAR038.error-required-schema=Response schema is required OAR038.error-required-one-property=At least you have to define the identifier property OAR039.error=Response code {0} must be defined -OAR040.error=WSO2 scope name value is non compliant with the standard +OAR040.error=WSO2 scope name does not match the required pattern: {0} OAR041.error=WSO2 x-scope requires x-auth-type definition OAR042.error-version=Last path part must be the API version, indicated with the prefix ''v'' and the version number as integer OAR042.error-path-short=Path has to few parts @@ -92,10 +94,10 @@ OAR078.error=All API methods must have security OAR079.error=Paths parameters, should have not found (404) response OAR080.error=The security scheme must be among those allowed by the organization and must be complete. OAR081.error=Fields of type password should be string with format password -OAR082.error=The string properties of the specified parameters must define a byte or binary format. +OAR082.error=The string properties among {0} must define a byte or binary format OAR083.error=The parameter {0} should not pass through this querystring OAR084.error=The format {0} should not pass through this querystring -OAR085.error=The OpenAPI version should be one of the allowed by the organization +OAR085.error=The OpenAPI version must be one of: {0} OAR086.error=Descriptions must begin with a capital letter, end with a period and not be empty OAR087.error=Summaries must begin with a capital letter, end with a period and not be empty OAR088.error=The $ref of a parameter must end with the suffix {0} diff --git a/src/main/resources/messages/errors_es.properties b/src/main/resources/messages/errors_es.properties index 7b509b68..e1006a49 100644 --- a/src/main/resources/messages/errors_es.properties +++ b/src/main/resources/messages/errors_es.properties @@ -5,13 +5,15 @@ OAR001.error-v3-https=El protocolo https en la URL del servidor es obligatorio OAR002.error=La definición de los scopes es errónea OAR002.error-property=EL apartado ''{0}'' del scope es obligatorio OAR003.error=Se recomienda definir el apartado ''description'' de este scope -OAR004.error=El valor del campo roles de este scope no es válido +OAR004.error=El rol del scope de WSO2 no cumple con el patrón requerido: {0} OAR005.error=La definición de este scope no existe OAR008.error=Verbo http ({0}) no recomendado OAR010.error-request-body-not-allowed=requestBody no permitido con la operación ''{0}'' OAR011.error=La ruta base y los nombres de recursos con más de dos palabras deben cumplir con la convención de nombres estándar: {0} OAR012.error=Los nombres de parámetros de ruta, parámetros de consulta, objetos y propiedades con más de dos palabras deben ajustarse a la convención de nomenclatura estándar: {0} OAR013.error=La respuesta por defecto es obligatoria +OAR014.error=El nivel de profundidad de los recursos no debe estar dentro del rango no sugerido de {0} a {1} +OAR015.error=El nivel de profundidad de los recursos debe ser menor o igual a {0} OAR016.error=Tipos numéricos requieren un formato válido OAR017.error=El path del recurso debe de alternar entre partes estáticas y parametrizadas OAR017.error-patterns=Patrón ''{0}'' no permitido @@ -37,12 +39,12 @@ OAR032.error=Nombres de partes de path ambiguos no permitidos: {0} OAR033.error-header-required=La cabecera ''{0}'' debe ser obligatoria OAR035.error=El código de respuesta {0} debe estar definido cuando la operación tiene esquemas de seguridad definidos OAR036.error=El uso de cookies está prohibido como mecanismo de sesión -OAR037.error=Las propiedades de tipo string deben definir un formato válido o, si no hay formato, un pattern válido -OAR038.error=La propiedad ''data'' o ''error'' es obligatoria +OAR037.error=Las propiedades de tipo string deben definir uno de los formatos permitidos ({0}) o, si no hay formato, un pattern válido +OAR038.error=La propiedad ''{0}'' o ''error'' es obligatoria OAR038.error-required-schema=El esquema de respuesta es obligatorio OAR038.error-required-one-property=Se debe de definir al menos una propiedad OAR039.error=Código de respuesta {0} debe ser definido -OAR040.error=El nombre del scope de WSO2 no cumple con el estándar +OAR040.error=El nombre del scope de WSO2 no cumple con el patrón requerido: {0} OAR041.error=La sección x-scope de WSO2 obliga a definir la sección x-auth-type OAR042.error-version=La última parte de la ruta debe ser la versión de la API, indicada con el prefijo ''v'' y el número de versión como entero OAR042.error-path-short=El path tiene muy pocas partes @@ -92,10 +94,10 @@ OAR078.error=Todos los métodos de una API deben tener seguridad OAR079.error=Los parámetros in PATH debem tener una respuesta Not Found (404) OAR080.error=El esquema de seguridad debe ser entre los permitidos de la organización, además debe estar completo OAR081.error=Los campos de tipo password deben ser string con formato password -OAR082.error=Las propiedades de tipo string de los parámetros especificados,deben definir un formato bite o binary +OAR082.error=Las propiedades de tipo string entre {0} deben definir un formato byte o binary OAR083.error=El parámetro {0} no debe pasar por este querystring OAR084.error=El formato {0} no debe pasar por este querystring -OAR085.error=La versión del OpenAPI debe estar entre los permitidos de la organización +OAR085.error=La versión del OpenAPI debe ser una de: {0} OAR086.error=Las descripciones no pueden estar vacías, deben empezar con mayúsculas y terminar con un punto OAR087.error=Los summary no pueden estar vacíos, deben empezar con mayúsculas y terminar con un punto OAR088.error=El $ref de un parámetro debe terminar con el sufijo {0} diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json index c33df6db..1a341339 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml index cbfa1337..0cddad70 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json index 5a767b89..42c40f92 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml index 5ff4ea53..c4b2e498 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v2/apim/wso2/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json index 9cd3db7a..64d230cb 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json +++ b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml index 795fbab0..225d0387 100644 --- a/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml +++ b/src/test/resources/checks/v2/apim/wso2/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v2/format/OAR037/nested.json b/src/test/resources/checks/v2/format/OAR037/nested.json index 819ad8b7..c53ad332 100644 --- a/src/test/resources/checks/v2/format/OAR037/nested.json +++ b/src/test/resources/checks/v2/format/OAR037/nested.json @@ -17,7 +17,7 @@ "type" : "object", "properties" : { "value" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format" : "YYYY-MM-DD" }, "code" : { diff --git a/src/test/resources/checks/v2/format/OAR037/nested.yaml b/src/test/resources/checks/v2/format/OAR037/nested.yaml index 6a3c55c2..b187416e 100644 --- a/src/test/resources/checks/v2/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v2/format/OAR037/nested.yaml @@ -15,7 +15,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v2/format/OAR037/plain.json b/src/test/resources/checks/v2/format/OAR037/plain.json index 31df3943..d89e6276 100644 --- a/src/test/resources/checks/v2/format/OAR037/plain.json +++ b/src/test/resources/checks/v2/format/OAR037/plain.json @@ -14,14 +14,14 @@ "type" : "object", "properties" : { "without" : { - "type" : "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern" : { "type" : "string", "pattern" : "^[A-Z]{3}-[0-9]+$" }, "withInvalidPattern" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern" : "[" }, "date" : { @@ -69,7 +69,7 @@ "format" : "ipv6" }, "other" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format" : "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v2/format/OAR037/plain.yaml b/src/test/resources/checks/v2/format/OAR037/plain.yaml index a09e36e2..a6dae9de 100644 --- a/src/test/resources/checks/v2/format/OAR037/plain.yaml +++ b/src/test/resources/checks/v2/format/OAR037/plain.yaml @@ -12,12 +12,12 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -59,5 +59,5 @@ paths: type: string format: HEX(16) other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v2/format/OAR037/with-$ref.json b/src/test/resources/checks/v2/format/OAR037/with-$ref.json index e9c50847..bc482563 100644 --- a/src/test/resources/checks/v2/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v2/format/OAR037/with-$ref.json @@ -32,7 +32,7 @@ "type" : "object", "properties" : { "value" : { - "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type" : "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format" : "YYYY-MM-DD" }, "code" : { diff --git a/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml index a589efeb..0000a0d8 100644 --- a/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v2/format/OAR037/with-$ref.yaml @@ -22,7 +22,7 @@ definitions: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v2/operations/OAR014/plain.json b/src/test/resources/checks/v2/operations/OAR014/plain.json index 1dc0ee29..97d2e1d1 100644 --- a/src/test/resources/checks/v2/operations/OAR014/plain.json +++ b/src/test/resources/checks/v2/operations/OAR014/plain.json @@ -59,7 +59,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -68,7 +68,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -77,7 +77,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -86,7 +86,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v2/operations/OAR014/plain.yaml b/src/test/resources/checks/v2/operations/OAR014/plain.yaml index 5647b610..1b37831c 100644 --- a/src/test/resources/checks/v2/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v2/operations/OAR014/plain.yaml @@ -33,22 +33,22 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/operations/OAR015/plain.json b/src/test/resources/checks/v2/operations/OAR015/plain.json index d8f8fc1d..4d0248dc 100644 --- a/src/test/resources/checks/v2/operations/OAR015/plain.json +++ b/src/test/resources/checks/v2/operations/OAR015/plain.json @@ -95,7 +95,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -104,7 +104,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -113,7 +113,7 @@ } } }, - "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get" : { "responses" : { "default" : { diff --git a/src/test/resources/checks/v2/operations/OAR015/plain.yaml b/src/test/resources/checks/v2/operations/OAR015/plain.yaml index 19bce139..8fcff6ba 100644 --- a/src/test/resources/checks/v2/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v2/operations/OAR015/plain.yaml @@ -53,17 +53,17 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/resources/OAR014/plain.json b/src/test/resources/checks/v2/resources/OAR014/plain.json index 1dc0ee29..97d2e1d1 100644 --- a/src/test/resources/checks/v2/resources/OAR014/plain.json +++ b/src/test/resources/checks/v2/resources/OAR014/plain.json @@ -59,7 +59,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -68,7 +68,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -77,7 +77,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -86,7 +86,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v2/resources/OAR014/plain.yaml b/src/test/resources/checks/v2/resources/OAR014/plain.yaml index 385ef638..9af5b6dd 100644 --- a/src/test/resources/checks/v2/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v2/resources/OAR014/plain.yaml @@ -33,22 +33,22 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/resources/OAR015/plain.json b/src/test/resources/checks/v2/resources/OAR015/plain.json index 53082e2b..d5653f56 100644 --- a/src/test/resources/checks/v2/resources/OAR015/plain.json +++ b/src/test/resources/checks/v2/resources/OAR015/plain.json @@ -95,7 +95,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -104,7 +104,7 @@ } } }, - "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -113,7 +113,7 @@ } } }, - "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven" : { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get" : { "responses" : { "default" : { diff --git a/src/test/resources/checks/v2/resources/OAR015/plain.yaml b/src/test/resources/checks/v2/resources/OAR015/plain.yaml index 8e617f60..a6f60283 100644 --- a/src/test/resources/checks/v2/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v2/resources/OAR015/plain.yaml @@ -53,17 +53,17 @@ paths: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/{one}/two/{two}/three/{three}/four/{four}/five/{five}/six/{six}: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v2/security/OAR082/valid-format.json b/src/test/resources/checks/v2/security/OAR082/valid-format.json index d01e4a29..423340a7 100644 --- a/src/test/resources/checks/v2/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v2/security/OAR082/valid-format.json @@ -14,11 +14,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v2/security/OAR082/valid-format.yaml b/src/test/resources/checks/v2/security/OAR082/valid-format.yaml index 67972ef5..4f860b86 100644 --- a/src/test/resources/checks/v2/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v2/security/OAR082/valid-format.yaml @@ -12,10 +12,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} lapiz: type: string price: diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json index 48350b93..e410485e 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml index 2958720b..eef0a8fc 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json index f975009e..7a1dc3a3 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml index 2c9729aa..bb95b57c 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v3/apim/wso2/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json index 0945724a..3b26e700 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json +++ b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml index dbe5b3ba..f46ef47e 100644 --- a/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml +++ b/src/test/resources/checks/v3/apim/wso2/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v3/format/OAR037/complete.json b/src/test/resources/checks/v3/format/OAR037/complete.json index 7c6f894f..180881ce 100644 --- a/src/test/resources/checks/v3/format/OAR037/complete.json +++ b/src/test/resources/checks/v3/format/OAR037/complete.json @@ -10,7 +10,7 @@ "in": "header", "name": "paramOne", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } }, @@ -18,7 +18,7 @@ "in": "header", "name": "paramTwo", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -34,7 +34,7 @@ "in": "header", "name": "paramThree", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -54,14 +54,14 @@ "type": "object", "properties": { "without": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern": { "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, "withInvalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[" }, "date": { @@ -109,7 +109,7 @@ "format": "ipv6" }, "other": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v3/format/OAR037/complete.yaml b/src/test/resources/checks/v3/format/OAR037/complete.yaml index 0008a528..fa516500 100644 --- a/src/test/resources/checks/v3/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v3/format/OAR037/complete.yaml @@ -8,13 +8,13 @@ components: in: header name: paramOne schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paramTwo: in: header name: paramTwo schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paths: /invoices: @@ -23,7 +23,7 @@ paths: - in: header name: paramThree schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD get: parameters: @@ -37,12 +37,12 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -78,5 +78,5 @@ paths: type: string format: ipv6 other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v3/format/OAR037/nested.json b/src/test/resources/checks/v3/format/OAR037/nested.json index 5f6a71dc..312df758 100644 --- a/src/test/resources/checks/v3/format/OAR037/nested.json +++ b/src/test/resources/checks/v3/format/OAR037/nested.json @@ -19,7 +19,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v3/format/OAR037/nested.yaml b/src/test/resources/checks/v3/format/OAR037/nested.yaml index 9a0465f1..a693669d 100644 --- a/src/test/resources/checks/v3/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v3/format/OAR037/nested.yaml @@ -17,7 +17,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v3/format/OAR037/no-format.json b/src/test/resources/checks/v3/format/OAR037/no-format.json index 57a1dd0f..2b7e0076 100644 --- a/src/test/resources/checks/v3/format/OAR037/no-format.json +++ b/src/test/resources/checks/v3/format/OAR037/no-format.json @@ -20,15 +20,15 @@ "pattern": "^[A-Za-z ]+$" }, "emptyPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "" }, "invalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[a-z" }, "code": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} } } } diff --git a/src/test/resources/checks/v3/format/OAR037/no-format.yaml b/src/test/resources/checks/v3/format/OAR037/no-format.yaml index ec4f21f1..7e832e70 100644 --- a/src/test/resources/checks/v3/format/OAR037/no-format.yaml +++ b/src/test/resources/checks/v3/format/OAR037/no-format.yaml @@ -17,10 +17,10 @@ paths: type: string pattern: '^[A-Za-z ]+$' emptyPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: "" invalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: "[a-z" code: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} diff --git a/src/test/resources/checks/v3/format/OAR037/with-$ref.json b/src/test/resources/checks/v3/format/OAR037/with-$ref.json index 51e70ff3..db2aac42 100644 --- a/src/test/resources/checks/v3/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v3/format/OAR037/with-$ref.json @@ -37,7 +37,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml index fbe316a5..110b40dc 100644 --- a/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v3/format/OAR037/with-$ref.yaml @@ -25,7 +25,7 @@ components: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v3/operations/OAR014/plain.json b/src/test/resources/checks/v3/operations/OAR014/plain.json index ec717959..69435707 100644 --- a/src/test/resources/checks/v3/operations/OAR014/plain.json +++ b/src/test/resources/checks/v3/operations/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/operations/OAR014/plain.yaml b/src/test/resources/checks/v3/operations/OAR014/plain.yaml index 08c7baa0..5c7cb46d 100644 --- a/src/test/resources/checks/v3/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v3/operations/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/operations/OAR015/plain.json b/src/test/resources/checks/v3/operations/OAR015/plain.json index 258325fe..c94c552a 100644 --- a/src/test/resources/checks/v3/operations/OAR015/plain.json +++ b/src/test/resources/checks/v3/operations/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/operations/OAR015/plain.yaml b/src/test/resources/checks/v3/operations/OAR015/plain.yaml index 94edfe5d..1f18f36a 100644 --- a/src/test/resources/checks/v3/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v3/operations/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/resources/OAR014/plain.json b/src/test/resources/checks/v3/resources/OAR014/plain.json index ec717959..69435707 100644 --- a/src/test/resources/checks/v3/resources/OAR014/plain.json +++ b/src/test/resources/checks/v3/resources/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/resources/OAR014/plain.yaml b/src/test/resources/checks/v3/resources/OAR014/plain.yaml index 08c7baa0..5c7cb46d 100644 --- a/src/test/resources/checks/v3/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v3/resources/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/resources/OAR015/plain.json b/src/test/resources/checks/v3/resources/OAR015/plain.json index 258325fe..c94c552a 100644 --- a/src/test/resources/checks/v3/resources/OAR015/plain.json +++ b/src/test/resources/checks/v3/resources/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v3/resources/OAR015/plain.yaml b/src/test/resources/checks/v3/resources/OAR015/plain.yaml index 94edfe5d..1f18f36a 100644 --- a/src/test/resources/checks/v3/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v3/resources/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v3/security/OAR082/valid-format.json b/src/test/resources/checks/v3/security/OAR082/valid-format.json index 7423cb98..de5421e5 100644 --- a/src/test/resources/checks/v3/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v3/security/OAR082/valid-format.json @@ -16,11 +16,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v3/security/OAR082/valid-format.yaml b/src/test/resources/checks/v3/security/OAR082/valid-format.yaml index 626624e9..965696f6 100644 --- a/src/test/resources/checks/v3/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v3/security/OAR082/valid-format.yaml @@ -14,10 +14,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} price: type: string format: byte \ No newline at end of file diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json index 8d4da38a..5521fb71 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml index ba79bbe6..2bdf51c1 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json index 6d2e1cb8..eb68f917 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml index 0f470c00..e9b07e7d 100644 --- a/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v31/apim/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v31/apim/OAR040/invalid.json b/src/test/resources/checks/v31/apim/OAR040/invalid.json index 802839a0..ccc66d8b 100644 --- a/src/test/resources/checks/v31/apim/OAR040/invalid.json +++ b/src/test/resources/checks/v31/apim/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v31/apim/OAR040/invalid.yaml b/src/test/resources/checks/v31/apim/OAR040/invalid.yaml index 0f445609..e97d36d7 100644 --- a/src/test/resources/checks/v31/apim/OAR040/invalid.yaml +++ b/src/test/resources/checks/v31/apim/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v31/format/OAR037/complete.json b/src/test/resources/checks/v31/format/OAR037/complete.json index 6584f397..d30d2110 100644 --- a/src/test/resources/checks/v31/format/OAR037/complete.json +++ b/src/test/resources/checks/v31/format/OAR037/complete.json @@ -10,7 +10,7 @@ "in": "header", "name": "paramOne", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } }, @@ -18,7 +18,7 @@ "in": "header", "name": "paramTwo", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -34,7 +34,7 @@ "in": "header", "name": "paramThree", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -54,14 +54,14 @@ "type": "object", "properties": { "without": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern": { "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, "withInvalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[" }, "date": { @@ -109,7 +109,7 @@ "format": "ipv6" }, "other": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v31/format/OAR037/complete.yaml b/src/test/resources/checks/v31/format/OAR037/complete.yaml index e75afc02..bc48872e 100644 --- a/src/test/resources/checks/v31/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v31/format/OAR037/complete.yaml @@ -8,13 +8,13 @@ components: in: header name: paramOne schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paramTwo: in: header name: paramTwo schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paths: /invoices: @@ -23,7 +23,7 @@ paths: - in: header name: paramThree schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD get: parameters: @@ -37,12 +37,12 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -78,5 +78,5 @@ paths: type: string format: ipv6 other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v31/format/OAR037/nested.json b/src/test/resources/checks/v31/format/OAR037/nested.json index 5fc02cb9..b82a4a64 100644 --- a/src/test/resources/checks/v31/format/OAR037/nested.json +++ b/src/test/resources/checks/v31/format/OAR037/nested.json @@ -19,7 +19,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v31/format/OAR037/nested.yaml b/src/test/resources/checks/v31/format/OAR037/nested.yaml index 302751f2..09a6b93e 100644 --- a/src/test/resources/checks/v31/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v31/format/OAR037/nested.yaml @@ -17,7 +17,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v31/format/OAR037/with-$ref.json b/src/test/resources/checks/v31/format/OAR037/with-$ref.json index 0e0d12bc..24be9044 100644 --- a/src/test/resources/checks/v31/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v31/format/OAR037/with-$ref.json @@ -37,7 +37,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml index 36a92461..960da9ec 100644 --- a/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v31/format/OAR037/with-$ref.yaml @@ -25,7 +25,7 @@ components: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v31/operations/OAR014/plain.json b/src/test/resources/checks/v31/operations/OAR014/plain.json index ae30763d..94def842 100644 --- a/src/test/resources/checks/v31/operations/OAR014/plain.json +++ b/src/test/resources/checks/v31/operations/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/operations/OAR014/plain.yaml b/src/test/resources/checks/v31/operations/OAR014/plain.yaml index 0e563616..f14772af 100644 --- a/src/test/resources/checks/v31/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v31/operations/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/operations/OAR015/plain.json b/src/test/resources/checks/v31/operations/OAR015/plain.json index cbdd1838..d185ad4d 100644 --- a/src/test/resources/checks/v31/operations/OAR015/plain.json +++ b/src/test/resources/checks/v31/operations/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/operations/OAR015/plain.yaml b/src/test/resources/checks/v31/operations/OAR015/plain.yaml index e298945b..5e2889c3 100644 --- a/src/test/resources/checks/v31/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v31/operations/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/resources/OAR014/plain.json b/src/test/resources/checks/v31/resources/OAR014/plain.json index 973e4d92..63ada396 100644 --- a/src/test/resources/checks/v31/resources/OAR014/plain.json +++ b/src/test/resources/checks/v31/resources/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/resources/OAR014/plain.yaml b/src/test/resources/checks/v31/resources/OAR014/plain.yaml index 0e563616..f14772af 100644 --- a/src/test/resources/checks/v31/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v31/resources/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/resources/OAR015/plain.json b/src/test/resources/checks/v31/resources/OAR015/plain.json index 28fbb79d..f968f5c7 100644 --- a/src/test/resources/checks/v31/resources/OAR015/plain.json +++ b/src/test/resources/checks/v31/resources/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v31/resources/OAR015/plain.yaml b/src/test/resources/checks/v31/resources/OAR015/plain.yaml index e298945b..5e2889c3 100644 --- a/src/test/resources/checks/v31/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v31/resources/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v31/security/OAR082/valid-format.json b/src/test/resources/checks/v31/security/OAR082/valid-format.json index 23251d95..14f67df5 100644 --- a/src/test/resources/checks/v31/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v31/security/OAR082/valid-format.json @@ -16,11 +16,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v31/security/OAR082/valid-format.yaml b/src/test/resources/checks/v31/security/OAR082/valid-format.yaml index ec26b569..3eea1a41 100644 --- a/src/test/resources/checks/v31/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v31/security/OAR082/valid-format.yaml @@ -14,10 +14,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} price: type: string format: byte \ No newline at end of file diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json index 8174b636..6b6e1192 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : [ "ROLE_READ", "ROL€_V¡€U" ], # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml index d87427fd..7492553e 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-array-roles.yaml @@ -12,5 +12,5 @@ x-wso2-security: key: read roles: - ROLE_READ - - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + - ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json index 629afce2..a57822db 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.json @@ -12,7 +12,7 @@ "x-wso2-scopes" : [ { "name" : "read", "key" : "read", - "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + "roles" : "ROLE_READ, ROL€_V¡€U", # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} "description" : "Allows users to read records" } ] } diff --git a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml index e768acea..433013de 100644 --- a/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml +++ b/src/test/resources/checks/v32/apim/OAR004/with-invalid-roles.yaml @@ -10,5 +10,5 @@ x-wso2-security: x-wso2-scopes: - name: read key: read - roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope roles value is not valid}} + roles: ROLE_READ, ROL€_V¡€U # Noncompliant {{OAR004: WSO2 scope role does not match the required pattern: ^[a-zA-Z0-9_\-., ]+$}} description: Allows users to read records \ No newline at end of file diff --git a/src/test/resources/checks/v32/apim/OAR040/invalid.json b/src/test/resources/checks/v32/apim/OAR040/invalid.json index 2f56af18..4863c280 100644 --- a/src/test/resources/checks/v32/apim/OAR040/invalid.json +++ b/src/test/resources/checks/v32/apim/OAR040/invalid.json @@ -10,13 +10,13 @@ "x-wso2-security" : { "apim" : { "x-wso2-scopes" : [ { - "name" : "app" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "app1_sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "GENE_Sc_ran" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} }, { - "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} + "name" : "X_SC_A" # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} } ] } } diff --git a/src/test/resources/checks/v32/apim/OAR040/invalid.yaml b/src/test/resources/checks/v32/apim/OAR040/invalid.yaml index 177ea034..e060ba58 100644 --- a/src/test/resources/checks/v32/apim/OAR040/invalid.yaml +++ b/src/test/resources/checks/v32/apim/OAR040/invalid.yaml @@ -8,7 +8,7 @@ paths: x-wso2-security: apim: x-wso2-scopes: - - name: app # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} - - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name value is non compliant with the standard}} \ No newline at end of file + - name: app # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: app1_sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: GENE_Sc_ran # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} + - name: X_SC_A # Noncompliant {{OAR040: WSO2 scope name does not match the required pattern: ^[a-zA-Z]{4,}_(SC|sc)_[a-zA-Z0-9]{1,}$}} \ No newline at end of file diff --git a/src/test/resources/checks/v32/format/OAR037/complete.json b/src/test/resources/checks/v32/format/OAR037/complete.json index 74f1adcd..acc9ccc2 100644 --- a/src/test/resources/checks/v32/format/OAR037/complete.json +++ b/src/test/resources/checks/v32/format/OAR037/complete.json @@ -10,7 +10,7 @@ "in": "header", "name": "paramOne", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } }, @@ -18,7 +18,7 @@ "in": "header", "name": "paramTwo", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -34,7 +34,7 @@ "in": "header", "name": "paramThree", "schema": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } @@ -54,14 +54,14 @@ "type": "object", "properties": { "without": { - "type": "string" # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string" # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} }, "withPattern": { "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, "withInvalidPattern": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "pattern": "[" }, "date": { @@ -109,7 +109,7 @@ "format": "ipv6" }, "other": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" } } diff --git a/src/test/resources/checks/v32/format/OAR037/complete.yaml b/src/test/resources/checks/v32/format/OAR037/complete.yaml index 0e7f4cc7..ee64eb79 100644 --- a/src/test/resources/checks/v32/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v32/format/OAR037/complete.yaml @@ -8,13 +8,13 @@ components: in: header name: paramOne schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paramTwo: in: header name: paramTwo schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD paths: /invoices: @@ -23,7 +23,7 @@ paths: - in: header name: paramThree schema: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD get: parameters: @@ -37,12 +37,12 @@ paths: type: object properties: without: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' withInvalidPattern: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} pattern: '[' date: type: string @@ -78,5 +78,5 @@ paths: type: string format: ipv6 other: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD diff --git a/src/test/resources/checks/v32/format/OAR037/nested.json b/src/test/resources/checks/v32/format/OAR037/nested.json index 74e72c00..77f69c32 100644 --- a/src/test/resources/checks/v32/format/OAR037/nested.json +++ b/src/test/resources/checks/v32/format/OAR037/nested.json @@ -19,7 +19,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v32/format/OAR037/nested.yaml b/src/test/resources/checks/v32/format/OAR037/nested.yaml index a6fd15be..fcfd1a94 100644 --- a/src/test/resources/checks/v32/format/OAR037/nested.yaml +++ b/src/test/resources/checks/v32/format/OAR037/nested.yaml @@ -17,7 +17,7 @@ paths: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v32/format/OAR037/with-$ref.json b/src/test/resources/checks/v32/format/OAR037/with-$ref.json index 0589c17f..baca97c4 100644 --- a/src/test/resources/checks/v32/format/OAR037/with-$ref.json +++ b/src/test/resources/checks/v32/format/OAR037/with-$ref.json @@ -37,7 +37,7 @@ "type": "object", "properties": { "value": { - "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + "type": "string", # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} "format": "YYYY-MM-DD" }, "code": { diff --git a/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml b/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml index b631e251..bda454ab 100644 --- a/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml +++ b/src/test/resources/checks/v32/format/OAR037/with-$ref.yaml @@ -25,7 +25,7 @@ components: type: object properties: value: - type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} + type: string # Noncompliant {{OAR037: String types require one of the allowed formats (date,date-time,password,byte,binary,email,uuid,uri,hostname,ipv4,ipv6,HEX,HEX(16),json,xml,base64), or a valid pattern when no format is defined}} format: YYYY-MM-DD code: type: string diff --git a/src/test/resources/checks/v32/operations/OAR014/plain.json b/src/test/resources/checks/v32/operations/OAR014/plain.json index e5976e87..00c3d3dd 100644 --- a/src/test/resources/checks/v32/operations/OAR014/plain.json +++ b/src/test/resources/checks/v32/operations/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/operations/OAR014/plain.yaml b/src/test/resources/checks/v32/operations/OAR014/plain.yaml index a5037c89..3b82e7f5 100644 --- a/src/test/resources/checks/v32/operations/OAR014/plain.yaml +++ b/src/test/resources/checks/v32/operations/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/operations/OAR015/plain.json b/src/test/resources/checks/v32/operations/OAR015/plain.json index 97cb52fe..bb0e67b6 100644 --- a/src/test/resources/checks/v32/operations/OAR015/plain.json +++ b/src/test/resources/checks/v32/operations/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/operations/OAR015/plain.yaml b/src/test/resources/checks/v32/operations/OAR015/plain.yaml index f29ada81..a56a7dd6 100644 --- a/src/test/resources/checks/v32/operations/OAR015/plain.yaml +++ b/src/test/resources/checks/v32/operations/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/resources/OAR014/plain.json b/src/test/resources/checks/v32/resources/OAR014/plain.json index 2777ce2c..1cda79c9 100644 --- a/src/test/resources/checks/v32/resources/OAR014/plain.json +++ b/src/test/resources/checks/v32/resources/OAR014/plain.json @@ -32,7 +32,7 @@ } } }, - "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { @@ -41,7 +41,7 @@ } } }, - "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level should be smaller}} + "/one/two/three/four/five": { # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/resources/OAR014/plain.yaml b/src/test/resources/checks/v32/resources/OAR014/plain.yaml index a5037c89..3b82e7f5 100644 --- a/src/test/resources/checks/v32/resources/OAR014/plain.yaml +++ b/src/test/resources/checks/v32/resources/OAR014/plain.yaml @@ -18,12 +18,12 @@ paths: responses: default: description: Ok - /one/two/three/four: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: description: Ok - /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level should be smaller}} + /one/two/three/four/five: # Noncompliant {{OAR014: Resources depth level must not fall within the non-suggested range 4 to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/resources/OAR015/plain.json b/src/test/resources/checks/v32/resources/OAR015/plain.json index d2152946..57e193b5 100644 --- a/src/test/resources/checks/v32/resources/OAR015/plain.json +++ b/src/test/resources/checks/v32/resources/OAR015/plain.json @@ -50,7 +50,7 @@ } } }, - "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { @@ -59,7 +59,7 @@ } } }, - "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level should be smaller}} + "/one/two/three/four/five/six/seven": { # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} "get": { "responses": { "default": { diff --git a/src/test/resources/checks/v32/resources/OAR015/plain.yaml b/src/test/resources/checks/v32/resources/OAR015/plain.yaml index f29ada81..a56a7dd6 100644 --- a/src/test/resources/checks/v32/resources/OAR015/plain.yaml +++ b/src/test/resources/checks/v32/resources/OAR015/plain.yaml @@ -28,12 +28,12 @@ paths: responses: default: description: Ok - /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: description: Ok - /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level should be smaller}} + /one/two/three/four/five/six/seven: # Noncompliant {{OAR015: Resources depth level must be smaller than or equal to 5}} get: responses: default: diff --git a/src/test/resources/checks/v32/security/OAR082/valid-format.json b/src/test/resources/checks/v32/security/OAR082/valid-format.json index 9c00671e..39024bba 100644 --- a/src/test/resources/checks/v32/security/OAR082/valid-format.json +++ b/src/test/resources/checks/v32/security/OAR082/valid-format.json @@ -16,11 +16,11 @@ "type": "object", "properties": { "product": { - "type": "string", # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string", # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} "format": "int128" }, "line": { - "type": "string" # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + "type": "string" # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} }, "price": { "type": "string", diff --git a/src/test/resources/checks/v32/security/OAR082/valid-format.yaml b/src/test/resources/checks/v32/security/OAR082/valid-format.yaml index 6af346ba..aff701fa 100644 --- a/src/test/resources/checks/v32/security/OAR082/valid-format.yaml +++ b/src/test/resources/checks/v32/security/OAR082/valid-format.yaml @@ -14,10 +14,10 @@ paths: type: object properties: product: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} format: int128 line: - type: string # Noncompliant {{OAR082: The string properties of the specified parameters must define a byte or binary format.}} + type: string # Noncompliant {{OAR082: The string properties among product,line,price must define a byte or binary format}} price: type: string format: byte \ No newline at end of file From 10f2429db316e5d64abacdbb79181fe1799651f1 Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Mon, 27 Jul 2026 18:58:14 -0500 Subject: [PATCH 02/11] fix: oar044 media type validation --- CHANGELOG.md | 6 ++++++ pom.xml | 2 +- .../checks/format/OAR044MediaTypeCheck.java | 21 ++++++++++--------- .../checks/v2/format/OAR044/media-type.json | 4 ++-- .../checks/v2/format/OAR044/media-type.yaml | 3 +++ .../checks/v3/format/OAR044/media-type.json | 12 ++++++++--- .../checks/v3/format/OAR044/media-type.yaml | 8 ++++++- .../checks/v31/format/OAR044/media-type.json | 12 ++++++++--- .../checks/v31/format/OAR044/media-type.yaml | 8 ++++++- .../checks/v32/format/OAR044/media-type.json | 12 ++++++++--- .../checks/v32/format/OAR044/media-type.yaml | 8 ++++++- 11 files changed, 71 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21481194..9a1e2ead 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.5.0-beta-5] - 2026-07-27 + +### Fixed + +- OAR044 - MediaTypeCheck - Media type parameters now follow RFC 9110 (charset without space, other parameter names, multiple parameters); type/subtype can no longer start with `.`. + ## [1.5.0-beta-4] - 2026-07-14 ### Fixed diff --git a/pom.xml b/pom.xml index 161983e8..2942fd55 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.0-beta-4 + 1.5.0-beta-5 sonar-plugin SonarQube OpenAPI Community Rules diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR044MediaTypeCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR044MediaTypeCheck.java index 15d3a523..39656827 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR044MediaTypeCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR044MediaTypeCheck.java @@ -44,19 +44,20 @@ public class OAR044MediaTypeCheck extends BaseCheck { protected static final String MESSAGE_V3 = "OAR044.error.v3"; private final ExternalRefHandler handleExternalRef = new ExternalRefHandler(); + private static final String RESTRICTED_NAME = "[a-zA-Z0-9][a-zA-Z0-9.!#$&^_+\\-]*"; + private static final String OWS = "[ \\t]*"; + private static final String TOKEN = "[a-zA-Z0-9!#$%&'*+\\-.^_`|~]+"; + private static final String QUOTED_STRING = "\"(?:[^\"\\\\]|\\\\.)*\""; + private static final String PARAMETERS = + "(?:" + OWS + ";" + OWS + TOKEN + "=(?:" + TOKEN + "|" + QUOTED_STRING + "))*"; + @VisibleForTesting static final Pattern MIME_TYPE_PATTERN = Pattern.compile( - "[a-zA-Z0-9.][a-zA-Z0-9.!#$&_^+\\-]+/" + - "[a-zA-Z0-9.][a-zA-Z0-9.!#$&_^+\\-]+" + - "(; charset=[a-zA-Z0-9_\\-]+)?" + RESTRICTED_NAME + "/" + RESTRICTED_NAME + PARAMETERS ); @VisibleForTesting static final Pattern MEDIA_RANGE_PATTERN = Pattern.compile( - "(\\*|[a-zA-Z0-9.][a-zA-Z0-9.!#$&_^+\\-]+)/" + - "(\\*|" + - "[a-zA-Z0-9.][a-zA-Z0-9.!#$&_^+\\-]+" + - "(; charset=[a-zA-Z0-9_\\-]+)?" + - ")" + "(\\*|" + RESTRICTED_NAME + ")/(\\*|" + RESTRICTED_NAME + ")" + PARAMETERS ); @Override @@ -114,8 +115,8 @@ private void verifyParameterContent(JsonNode node) { for (JsonNode property : properties.values()) { JsonNode keyNode = property.key(); String key = keyNode.getTokenValue(); - if (!MIME_TYPE_PATTERN.matcher(key).matches()) { - addIssue(CHECK_KEY, translate(MESSAGE_V2), keyNode); + if (!MEDIA_RANGE_PATTERN.matcher(key).matches()) { + addIssue(CHECK_KEY, translate(MESSAGE_V3), keyNode); } } } diff --git a/src/test/resources/checks/v2/format/OAR044/media-type.json b/src/test/resources/checks/v2/format/OAR044/media-type.json index 216fca4c..c785305c 100644 --- a/src/test/resources/checks/v2/format/OAR044/media-type.json +++ b/src/test/resources/checks/v2/format/OAR044/media-type.json @@ -18,8 +18,8 @@ } }, "post" : { - "produces" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json", "text/csv", "image/png" ], - "consumes" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json" ], + "produces" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json", "text/csv", "image/png", "text/plain;charset=utf-8", "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" ], + "consumes" : [ "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "application/ld+json", "application/json; charset=utf-8; boundary=xyz" ], "responses" : { "200" : { "description" : "some operation" diff --git a/src/test/resources/checks/v2/format/OAR044/media-type.yaml b/src/test/resources/checks/v2/format/OAR044/media-type.yaml index fd2d08e0..aaabbad4 100644 --- a/src/test/resources/checks/v2/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v2/format/OAR044/media-type.yaml @@ -27,10 +27,13 @@ paths: - application/ld+json - text/csv - image/png + - text/plain;charset=utf-8 + - multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk consumes: - application/vnd.ms-excel - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet - application/ld+json + - application/json; charset=utf-8; boundary=xyz responses: '200': description: some operation \ No newline at end of file diff --git a/src/test/resources/checks/v3/format/OAR044/media-type.json b/src/test/resources/checks/v3/format/OAR044/media-type.json index 3d3b5d7a..560ca700 100644 --- a/src/test/resources/checks/v3/format/OAR044/media-type.json +++ b/src/test/resources/checks/v3/format/OAR044/media-type.json @@ -19,10 +19,11 @@ "name" : "someParam", "in" : "query", "content" : { - "application" : { }, # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + "text/*" : { }, "text/plain" : { } } - }, + }, { "name" : "otherParam", "in" : "path" @@ -32,12 +33,17 @@ "requestBody" : { "content" : { "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + ".text/plain" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} "text/*" : { }, "application/vnd.ms-excel" : { }, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : { }, "application/ld+json" : { }, "image/*" : { }, - "*/*" : { } + "*/*" : { }, + "text/plain;charset=utf-8" : { }, + "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" : { }, + "multipart/form-data; boundary=\"----abc 123\"" : { }, + "application/json; charset=utf-8; boundary=xyz" : { } } }, "responses" : { diff --git a/src/test/resources/checks/v3/format/OAR044/media-type.yaml b/src/test/resources/checks/v3/format/OAR044/media-type.yaml index 60d8c85a..91373ff4 100644 --- a/src/test/resources/checks/v3/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v3/format/OAR044/media-type.yaml @@ -14,7 +14,8 @@ paths: - name: someParam in: query content: - 'application': {} # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + 'application': {} # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + 'text/*': {} 'text/plain': {} # invalid (only 1 content allowed by spec), but should not be caught by this rule - name: otherParam in: path @@ -22,12 +23,17 @@ paths: requestBody: content: 'application': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + '.text/plain': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} 'text/*': { } 'application/vnd.ms-excel': {} 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': {} 'application/ld+json': {} 'image/*': {} '*/*': {} + 'text/plain;charset=utf-8': {} + 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk': {} + 'multipart/form-data; boundary="----abc 123"': {} + 'application/json; charset=utf-8; boundary=xyz': {} responses: '200': description: some operation diff --git a/src/test/resources/checks/v31/format/OAR044/media-type.json b/src/test/resources/checks/v31/format/OAR044/media-type.json index 05232934..97dd17e6 100644 --- a/src/test/resources/checks/v31/format/OAR044/media-type.json +++ b/src/test/resources/checks/v31/format/OAR044/media-type.json @@ -19,10 +19,11 @@ "name" : "someParam", "in" : "query", "content" : { - "application" : { }, # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + "text/*" : { }, "text/plain" : { } } - }, + }, { "name" : "otherParam", "in" : "path" @@ -32,12 +33,17 @@ "requestBody" : { "content" : { "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + ".text/plain" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} "text/*" : { }, "application/vnd.ms-excel" : { }, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : { }, "application/ld+json" : { }, "image/*" : { }, - "*/*" : { } + "*/*" : { }, + "text/plain;charset=utf-8" : { }, + "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" : { }, + "multipart/form-data; boundary=\"----abc 123\"" : { }, + "application/json; charset=utf-8; boundary=xyz" : { } } }, "responses" : { diff --git a/src/test/resources/checks/v31/format/OAR044/media-type.yaml b/src/test/resources/checks/v31/format/OAR044/media-type.yaml index 71f903d8..1de0edc8 100644 --- a/src/test/resources/checks/v31/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v31/format/OAR044/media-type.yaml @@ -14,7 +14,8 @@ paths: - name: someParam in: query content: - 'application': {} # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + 'application': {} # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + 'text/*': {} 'text/plain': {} # invalid (only 1 content allowed by spec), but should not be caught by this rule - name: otherParam in: path @@ -22,12 +23,17 @@ paths: requestBody: content: 'application': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + '.text/plain': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} 'text/*': { } 'application/vnd.ms-excel': {} 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': {} 'application/ld+json': {} 'image/*': {} '*/*': {} + 'text/plain;charset=utf-8': {} + 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk': {} + 'multipart/form-data; boundary="----abc 123"': {} + 'application/json; charset=utf-8; boundary=xyz': {} responses: '200': description: some operation diff --git a/src/test/resources/checks/v32/format/OAR044/media-type.json b/src/test/resources/checks/v32/format/OAR044/media-type.json index 0251e212..0b41954d 100644 --- a/src/test/resources/checks/v32/format/OAR044/media-type.json +++ b/src/test/resources/checks/v32/format/OAR044/media-type.json @@ -19,10 +19,11 @@ "name" : "someParam", "in" : "query", "content" : { - "application" : { }, # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + "text/*" : { }, "text/plain" : { } } - }, + }, { "name" : "otherParam", "in" : "path" @@ -32,12 +33,17 @@ "requestBody" : { "content" : { "application" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + ".text/plain" : { }, # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} "text/*" : { }, "application/vnd.ms-excel" : { }, "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" : { }, "application/ld+json" : { }, "image/*" : { }, - "*/*" : { } + "*/*" : { }, + "text/plain;charset=utf-8" : { }, + "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk" : { }, + "multipart/form-data; boundary=\"----abc 123\"" : { }, + "application/json; charset=utf-8; boundary=xyz" : { } } }, "responses" : { diff --git a/src/test/resources/checks/v32/format/OAR044/media-type.yaml b/src/test/resources/checks/v32/format/OAR044/media-type.yaml index 6e1cbd7d..7b19fa8f 100644 --- a/src/test/resources/checks/v32/format/OAR044/media-type.yaml +++ b/src/test/resources/checks/v32/format/OAR044/media-type.yaml @@ -14,7 +14,8 @@ paths: - name: someParam in: query content: - 'application': {} # Noncompliant {{OAR044: Declared mime type should conform to RFC6838}} + 'application': {} # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + 'text/*': {} 'text/plain': {} # invalid (only 1 content allowed by spec), but should not be caught by this rule - name: otherParam in: path @@ -22,12 +23,17 @@ paths: requestBody: content: 'application': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} + '.text/plain': { } # Noncompliant {{OAR044: Declared media type range should conform to RFC7231}} 'text/*': { } 'application/vnd.ms-excel': {} 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': {} 'application/ld+json': {} 'image/*': {} '*/*': {} + 'text/plain;charset=utf-8': {} + 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxk': {} + 'multipart/form-data; boundary="----abc 123"': {} + 'application/json; charset=utf-8; boundary=xyz': {} responses: '200': description: some operation From b5733666a3ef2cd6a890387d74c5ce018fb7ed22 Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Thu, 30 Jul 2026 17:46:24 -0500 Subject: [PATCH 03/11] fix: oar037 false positive on string enum without format --- CHANGELOG.md | 6 ++++++ pom.xml | 2 +- .../openapi/checks/format/OAR037StringFormatCheck.java | 9 +++++++++ .../l10n/es/openapi/rules/openapi/format/OAR037.html | 8 +++++++- .../sonar/l10n/openapi/rules/openapi/format/OAR037.html | 8 +++++++- src/test/resources/checks/v2/format/OAR037/plain.json | 4 ++++ src/test/resources/checks/v2/format/OAR037/plain.yaml | 5 +++++ src/test/resources/checks/v3/format/OAR037/complete.json | 4 ++++ src/test/resources/checks/v3/format/OAR037/complete.yaml | 5 +++++ .../resources/checks/v31/format/OAR037/complete.json | 4 ++++ .../resources/checks/v31/format/OAR037/complete.yaml | 5 +++++ .../resources/checks/v32/format/OAR037/complete.json | 4 ++++ .../resources/checks/v32/format/OAR037/complete.yaml | 5 +++++ 13 files changed, 66 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 888e9717..feb19cda 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.5.1-beta-1] + +### Fixed + +- OAR037 - StringFormatCheck - Fixed false positive on string schemas constrained by `enum`. The check only inspected `format`/`pattern`, so a string with a non-empty `enum` and no `format` was wrongly reported even though the `enum` already constrains the allowed values. When no `format` is declared, a non-empty `enum` now satisfies the rule (like a valid `pattern`); a present-but-invalid `format` still fires even when an `enum` is declared. + ## [1.5.0] - 2026-07-28 ### Added diff --git a/pom.xml b/pom.xml index 55865267..3fb1bbc9 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.0 + 1.5.1-beta-1 sonar-plugin SonarQube OpenAPI Community Rules diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java index 96e58d22..a6c4d66d 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/format/OAR037StringFormatCheck.java @@ -39,11 +39,20 @@ public void validate(String type, String format, JsonNode typeNode, JsonNode nod return; } + if (hasEnum(node)) { + return; + } + if (!hasValidPattern(node)) { addIssue(KEY, translate(MESSAGE), typeNode.key()); } } + private boolean hasEnum(JsonNode node) { + JsonNode enumNode = node.get("enum"); + return !enumNode.isMissing() && !enumNode.elements().isEmpty(); + } + private boolean hasValidPattern(JsonNode node) { JsonNode patternNode = node.get("pattern"); if (patternNode.isMissing()) { diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/format/OAR037.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/format/OAR037.html index ce3e0344..f331e256 100644 --- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/format/OAR037.html +++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/format/OAR037.html @@ -4,7 +4,8 @@
  • declarando un campo format con un valor reconocido, o
  • si no se declara format, declarando un campo pattern que sea una expresión regular no vacía y sintácticamente válida.
    • -

    La regla dispara cuando format está presente pero no es reconocido, o cuando format está ausente y pattern está ausente, vacío, o no es una expresión regular sintácticamente válida.

    +

    Cuando no se declara format, un enum no vacío también satisface la regla: el enum ya restringe los valores permitidos, por lo que no se exige un pattern. Un format presente pero no reconocido sigue disparando aunque haya un enum.

    +

    La regla dispara cuando format está presente pero no es reconocido, o cuando format está ausente y no hay un pattern válido ni un enum no vacío.

    Formatos válidos: date, date-time, password, byte, binary, email, uuid, uri, hostname, ipv4, ipv6, HEX, HEX(16), json, xml, base64.

    Configurable: formats-allowed — lista de formatos permitidos separados por coma (por defecto: la lista anterior).

    Ejemplo de código no compatible (OpenAPI 2)

    @@ -104,4 +105,9 @@

    Solución compatible (OpenAPI 3)

    date: type: string format: date + channelType: + type: string + enum: + - email + - sms diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html index 64fe2c3c..92136b4f 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/format/OAR037.html @@ -4,7 +4,8 @@
  • declare a format field with a recognized value, or
  • if no format is declared, declare a pattern field that is a non-empty, syntactically valid regular expression.
    • -

    The rule fires when format is present but not recognized, or when format is absent and pattern is missing, empty, or not a syntactically valid regular expression.

    +

    When no format is declared, a non-empty enum also satisfies the rule: the enum already constrains the allowed values, so a pattern is not required. A format that is present but not recognized still fires even when an enum is declared.

    +

    The rule fires when format is present but not recognized, or when format is absent and there is no valid pattern and no non-empty enum.

    Valid formats: date, date-time, password, byte, binary, email, uuid, uri, hostname, ipv4, ipv6, HEX, HEX(16), json, xml, base64.

    Configurable: formats-allowed — comma-separated list of allowed formats (default: the list above).

    Noncompliant Code Example (OpenAPI 2)

    @@ -104,4 +105,9 @@

    Compliant Solution (OpenAPI 3)

    date: type: string format: date + channelType: + type: string + enum: + - email + - sms diff --git a/src/test/resources/checks/v2/format/OAR037/plain.json b/src/test/resources/checks/v2/format/OAR037/plain.json index 31df3943..7a84dee3 100644 --- a/src/test/resources/checks/v2/format/OAR037/plain.json +++ b/src/test/resources/checks/v2/format/OAR037/plain.json @@ -20,6 +20,10 @@ "type" : "string", "pattern" : "^[A-Z]{3}-[0-9]+$" }, + "withEnum" : { + "type" : "string", + "enum" : ["email", "sms"] + }, "withInvalidPattern" : { "type" : "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} "pattern" : "[" diff --git a/src/test/resources/checks/v2/format/OAR037/plain.yaml b/src/test/resources/checks/v2/format/OAR037/plain.yaml index a09e36e2..0e7ee18c 100644 --- a/src/test/resources/checks/v2/format/OAR037/plain.yaml +++ b/src/test/resources/checks/v2/format/OAR037/plain.yaml @@ -16,6 +16,11 @@ paths: withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} pattern: '[' diff --git a/src/test/resources/checks/v3/format/OAR037/complete.json b/src/test/resources/checks/v3/format/OAR037/complete.json index 7c6f894f..918003a9 100644 --- a/src/test/resources/checks/v3/format/OAR037/complete.json +++ b/src/test/resources/checks/v3/format/OAR037/complete.json @@ -60,6 +60,10 @@ "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, + "withEnum": { + "type": "string", + "enum": ["email", "sms"] + }, "withInvalidPattern": { "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} "pattern": "[" diff --git a/src/test/resources/checks/v3/format/OAR037/complete.yaml b/src/test/resources/checks/v3/format/OAR037/complete.yaml index 0008a528..a5732556 100644 --- a/src/test/resources/checks/v3/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v3/format/OAR037/complete.yaml @@ -41,6 +41,11 @@ paths: withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} pattern: '[' diff --git a/src/test/resources/checks/v31/format/OAR037/complete.json b/src/test/resources/checks/v31/format/OAR037/complete.json index 6584f397..f0149f40 100644 --- a/src/test/resources/checks/v31/format/OAR037/complete.json +++ b/src/test/resources/checks/v31/format/OAR037/complete.json @@ -60,6 +60,10 @@ "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, + "withEnum": { + "type": "string", + "enum": ["email", "sms"] + }, "withInvalidPattern": { "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} "pattern": "[" diff --git a/src/test/resources/checks/v31/format/OAR037/complete.yaml b/src/test/resources/checks/v31/format/OAR037/complete.yaml index e75afc02..4f7d260c 100644 --- a/src/test/resources/checks/v31/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v31/format/OAR037/complete.yaml @@ -41,6 +41,11 @@ paths: withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} pattern: '[' diff --git a/src/test/resources/checks/v32/format/OAR037/complete.json b/src/test/resources/checks/v32/format/OAR037/complete.json index 74f1adcd..fb76cb23 100644 --- a/src/test/resources/checks/v32/format/OAR037/complete.json +++ b/src/test/resources/checks/v32/format/OAR037/complete.json @@ -60,6 +60,10 @@ "type": "string", "pattern": "^[A-Z]{3}-[0-9]+$" }, + "withEnum": { + "type": "string", + "enum": ["email", "sms"] + }, "withInvalidPattern": { "type": "string", # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} "pattern": "[" diff --git a/src/test/resources/checks/v32/format/OAR037/complete.yaml b/src/test/resources/checks/v32/format/OAR037/complete.yaml index 0e7f4cc7..c7509fd6 100644 --- a/src/test/resources/checks/v32/format/OAR037/complete.yaml +++ b/src/test/resources/checks/v32/format/OAR037/complete.yaml @@ -41,6 +41,11 @@ paths: withPattern: type: string pattern: '^[A-Z]{3}-[0-9]+$' + withEnum: + type: string + enum: + - email + - sms withInvalidPattern: type: string # Noncompliant {{OAR037: String types require a valid format, or a valid pattern when no format is defined}} pattern: '[' From 3fe91d92a0260819122fafbd21c160095702e342 Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Mon, 3 Aug 2026 14:49:02 -0500 Subject: [PATCH 04/11] fix: OAR085 message shows the OpenAPI version --- src/main/resources/messages/errors.properties | 2 +- src/main/resources/messages/errors_es.properties | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/resources/messages/errors.properties b/src/main/resources/messages/errors.properties index 78ab417f..d99fc3c4 100644 --- a/src/main/resources/messages/errors.properties +++ b/src/main/resources/messages/errors.properties @@ -95,7 +95,7 @@ OAR081.error=Fields of type password should be string with format password OAR082.error=The string properties of the specified parameters must define a byte or binary format. OAR083.error=The parameter {0} should not pass through this querystring OAR084.error=The format {0} should not pass through this querystring -OAR085.error=The OpenAPI version should be one of the allowed by the organization +OAR085.error=The OpenAPI version {0} should be one of the allowed by the organization OAR086.error=Descriptions must begin with a capital letter, end with a period and not be empty OAR087.error=Summaries must begin with a capital letter, end with a period and not be empty OAR088.error=The $ref of a parameter must end with the suffix {0} diff --git a/src/main/resources/messages/errors_es.properties b/src/main/resources/messages/errors_es.properties index 7b509b68..c48d4450 100644 --- a/src/main/resources/messages/errors_es.properties +++ b/src/main/resources/messages/errors_es.properties @@ -95,7 +95,7 @@ OAR081.error=Los campos de tipo password deben ser string con formato password OAR082.error=Las propiedades de tipo string de los parámetros especificados,deben definir un formato bite o binary OAR083.error=El parámetro {0} no debe pasar por este querystring OAR084.error=El formato {0} no debe pasar por este querystring -OAR085.error=La versión del OpenAPI debe estar entre los permitidos de la organización +OAR085.error=La versión del OpenAPI {0} debe estar entre los permitidos de la organización OAR086.error=Las descripciones no pueden estar vacías, deben empezar con mayúsculas y terminar con un punto OAR087.error=Los summary no pueden estar vacíos, deben empezar con mayúsculas y terminar con un punto OAR088.error=El $ref de un parámetro debe terminar con el sufijo {0} From 3b99a3d1bc5f8f5a5e80051f8716993ef8aa782c Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Tue, 4 Aug 2026 12:25:08 -0500 Subject: [PATCH 05/11] update changelog --- CHANGELOG.md | 1 - 1 file changed, 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 91c6f1b1..d532ac70 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - OAR038 - StandardCreateResponse - Issue message now interpolates the configured `data-property` instead of the hardcoded `data`. - OAR082 - BinaryOrByteFormat - Issue message now shows the configured `fields-to-apply`. - OAR085 - OpenAPIVersion - Issue message now shows the configured `valid-versions`. -- OAR037 - StringFormat - Issue message now interpolates the configured `formats-allowed`. - OAR037 - StringFormat - Fixed false positive on string schemas constrained by `enum`. The check only inspected `format`/`pattern`, so a string with a non-empty `enum` and no `format` was wrongly reported even though the `enum` already constrains the allowed values. When no `format` is declared, a non-empty `enum` now satisfies the rule (like a valid `pattern`); a present-but-invalid `format` still fires even when an `enum` is declared. - OAR044 - MediaTypeCheck - Media type parameters now follow RFC 9110 (charset without space, other parameter names, multiple parameters); type/subtype can no longer start with `.`. From 717a7487c80c6c94449705463cd0c1bdc43a9588 Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Mon, 10 Aug 2026 16:45:59 -0500 Subject: [PATCH 06/11] fix: correct security opt-out handling and document rule behaviors --- CHANGELOG.md | 8 ++++ pom.xml | 2 +- .../AbstractSecurityResponseCheck.java | 9 +++++ ...OAR035AuthorizationResponsesCheckTest.java | 5 +++ .../OAR096ForbiddenResponseCheckTest.java | 5 +++ .../v3/security/OAR035/security-opt-out.json | 40 +++++++++++++++++++ .../v3/security/OAR035/security-opt-out.yaml | 26 ++++++++++++ .../v3/security/OAR096/security-opt-out.json | 40 +++++++++++++++++++ .../v3/security/OAR096/security-opt-out.yaml | 26 ++++++++++++ 9 files changed, 160 insertions(+), 1 deletion(-) create mode 100644 src/test/resources/checks/v3/security/OAR035/security-opt-out.json create mode 100644 src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml create mode 100644 src/test/resources/checks/v3/security/OAR096/security-opt-out.json create mode 100644 src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index d532ac70..40ef5475 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.5.1-beta-2] + +### Fixed + +- OAR035 - AuthorizationResponses - Honor an operation-level `security: []` explicit opt-out: the operation is unsecured, so no 401 is required even under global security. Added `security-opt-out` (v3) fixtures and test. +- OAR096 - ForbiddenResponses - Same `security: []` opt-out fix in the shared `AbstractSecurityResponseCheck`: no 403 required for opted-out operations. Added `security-opt-out` (v3) fixtures and test. + + ## [1.5.1-beta-1] - 2026-08-04 ### Fixed diff --git a/pom.xml b/pom.xml index 3fb1bbc9..41d2b466 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.1-beta-1 + 1.5.1-beta-2 sonar-plugin SonarQube OpenAPI Community Rules diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/security/AbstractSecurityResponseCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/security/AbstractSecurityResponseCheck.java index af301d44..16177771 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/security/AbstractSecurityResponseCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/security/AbstractSecurityResponseCheck.java @@ -56,6 +56,10 @@ public void visitNode(JsonNode node) { } private void validateSecurityResponse(JsonNode node) { + if (isExplicitSecurityOptOut(node)) { + return; + } + JsonNode responsesNode = node.get("responses"); Set currentCodes = responsesNode.properties().stream() .map(JsonNode::key) @@ -81,4 +85,9 @@ protected boolean hasSecurity(JsonNode node) { JsonNode security = node.get("security"); return !security.isMissing() && !security.isNull() && !security.elements().isEmpty(); } + + private boolean isExplicitSecurityOptOut(JsonNode node) { + JsonNode security = node.get("security"); + return !security.isMissing() && !security.isNull() && security.elements().isEmpty(); + } } \ No newline at end of file diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java index cdd82acd..84a65668 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR035AuthorizationResponsesCheckTest.java @@ -46,6 +46,11 @@ public void verifyInV32() { public void verifyInV3WithoutAuthorizationResponses() { verifyV3("without-authorization-responses"); } + + @Test + public void verifyInV3SecurityOptOut() { + verifyV3("security-opt-out"); + } @Test public void verifyInV31WithoutAuthorizationResponses() { verifyV31("without-authorization-responses"); diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java index 7785ea2d..923362fb 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/security/OAR096ForbiddenResponseCheckTest.java @@ -46,6 +46,11 @@ public void verifyInV32() { public void verifyInV3WithoutAuthorizationResponses() { verifyV3("without-authorization-responses"); } + + @Test + public void verifyInV3SecurityOptOut() { + verifyV3("security-opt-out"); + } @Test public void verifyInV31WithoutAuthorizationResponses() { verifyV31("without-authorization-responses"); diff --git a/src/test/resources/checks/v3/security/OAR035/security-opt-out.json b/src/test/resources/checks/v3/security/OAR035/security-opt-out.json new file mode 100644 index 00000000..6c37de49 --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR035/security-opt-out.json @@ -0,0 +1,40 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "OAR035 - security opt-out" + }, + "components": { + "securitySchemes": { + "ApiKeyAuth": { + "type": "apiKey", + "in": "header", + "name": "X-API-Key" + } + } + }, + "security": [ + { "ApiKeyAuth": [] } + ], + "paths": { + "/public": { + "get": { + "security": [], + "responses": { + "200": { + "description": "Ok" + } + } + } + }, + "/secured": { + "get": { + "responses": { # Noncompliant {{OAR035: Response code 401 must be defined for operations with security schemes defined}} + "200": { + "description": "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml b/src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml new file mode 100644 index 00000000..92e6e6d6 --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR035/security-opt-out.yaml @@ -0,0 +1,26 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: OAR035 - security opt-out +components: + securitySchemes: + ApiKeyAuth: + type: apiKey + in: header + name: X-API-Key +security: + - ApiKeyAuth: [] +paths: + /public: + get: + # Explicit opt-out: `security: []` disables the global security for this + # operation, so it is unsecured and no 401 is required (compliant). + security: [] + responses: + 200: + description: Ok + /secured: + get: + responses: # Noncompliant {{OAR035: Response code 401 must be defined for operations with security schemes defined}} + 200: + description: Ok diff --git a/src/test/resources/checks/v3/security/OAR096/security-opt-out.json b/src/test/resources/checks/v3/security/OAR096/security-opt-out.json new file mode 100644 index 00000000..d11ba4b4 --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR096/security-opt-out.json @@ -0,0 +1,40 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "OAR096 - security opt-out" + }, + "components": { + "securitySchemes": { + "ApiKeyAuth": { + "type": "apiKey", + "in": "header", + "name": "X-API-Key" + } + } + }, + "security": [ + { "ApiKeyAuth": [] } + ], + "paths": { + "/public": { + "get": { + "security": [], + "responses": { + "200": { + "description": "Ok" + } + } + } + }, + "/secured": { + "get": { + "responses": { # Noncompliant {{OAR096: Response code 403 must be defined for operations with security schemes defined}} + "200": { + "description": "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml b/src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml new file mode 100644 index 00000000..4a06da4b --- /dev/null +++ b/src/test/resources/checks/v3/security/OAR096/security-opt-out.yaml @@ -0,0 +1,26 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: OAR096 - security opt-out +components: + securitySchemes: + ApiKeyAuth: + type: apiKey + in: header + name: X-API-Key +security: + - ApiKeyAuth: [] +paths: + /public: + get: + # Explicit opt-out: `security: []` disables the global security for this + # operation, so it is unsecured and no 403 is required (compliant). + security: [] + responses: + 200: + description: Ok + /secured: + get: + responses: # Noncompliant {{OAR096: Response code 403 must be defined for operations with security schemes defined}} + 200: + description: Ok From e63d1294cc0894507feab55097cde689de9fdf1f Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Fri, 14 Aug 2026 20:39:32 -0500 Subject: [PATCH 07/11] feat: gate OAR022/OAR025 to paginated --- CHANGELOG.md | 12 +- pom.xml | 2 +- .../AbstractQueryParameterCheck.java | 23 +++ .../OAR022OrderbyParameterCheck.java | 5 + .../parameters/OAR025LimitParameterCheck.java | 5 + .../rules/openapi/parameters/OAR020.html | 8 +- .../rules/openapi/parameters/OAR021.html | 8 +- .../rules/openapi/parameters/OAR022.html | 191 +++++++++--------- .../rules/openapi/parameters/OAR025.html | 191 +++++++++--------- .../rules/openapi/parameters/OAR020.html | 8 +- .../rules/openapi/parameters/OAR021.html | 8 +- .../rules/openapi/parameters/OAR022.html | 185 ++++++++--------- .../rules/openapi/parameters/OAR025.html | 185 ++++++++--------- .../OAR022OrderbyParameterCheckTest.java | 9 + .../OAR025LimitParameterCheckTest.java | 9 + .../v2/parameters/OAR022/no-pagination.json | 18 ++ .../v2/parameters/OAR022/no-pagination.yaml | 10 + .../v2/parameters/OAR025/no-pagination.json | 18 ++ .../v2/parameters/OAR025/no-pagination.yaml | 10 + .../v3/parameters/OAR022/no-pagination.json | 18 ++ .../v3/parameters/OAR022/no-pagination.yaml | 10 + .../v3/parameters/OAR025/no-pagination.json | 18 ++ .../v3/parameters/OAR025/no-pagination.yaml | 10 + 23 files changed, 573 insertions(+), 388 deletions(-) create mode 100644 src/test/resources/checks/v2/parameters/OAR022/no-pagination.json create mode 100644 src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml create mode 100644 src/test/resources/checks/v2/parameters/OAR025/no-pagination.json create mode 100644 src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR022/no-pagination.json create mode 100644 src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR025/no-pagination.json create mode 100644 src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 40ef5475..313f1068 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [1.5.1-beta-2] +## [1.5.1-beta-3] - 2026-08-14 + +### Changed + +- OAR022 - OrderbyParameterCheck - Now only applies to paginated collections (operations declaring a 206 response); added `no-pagination` fixtures/tests and corrected the HTML docs (real defaults + 206 condition). +- OAR025 - LimitParameterCheck - Same 206 gating for `$limit`; added `no-pagination` fixtures/tests and corrected the HTML docs. +- OAR020 - ExpandParameterCheck - Corrected the HTML docs to the real defaults (`/me,/health,/ping,/status`, `/exclude`). +- OAR021 - ExcludeParameterCheck - Corrected the HTML docs to the real defaults (`/me,/health,/ping,/status`, `/exclude`). + + +## [1.5.1-beta-2] - 2026-08-12 ### Fixed diff --git a/pom.xml b/pom.xml index 41d2b466..89572cfa 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.1-beta-2 + 1.5.1-beta-3 sonar-plugin SonarQube OpenAPI Community Rules diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java index 7d4fb2d4..3e79f389 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java @@ -24,6 +24,8 @@ public abstract class AbstractQueryParameterCheck extends BaseCheck { protected static final String PATH_STRATEGY_EXCLUDE = "/exclude"; protected static final String PATH_STRATEGY_INCLUDE = "/include"; + protected static final String PAGINATED_RESPONSE_CODE = "206"; + protected final String ruleKey; protected final String messageKey; protected final String defaultParameterName; @@ -76,6 +78,10 @@ public void visitNode(JsonNode node) { return; } + if (requiresPaginatedResponse() && !hasPaginatedResponse(node)) { + return; + } + boolean hasParameter = hasParameterInNode(node); if (shouldIncludePath(path) && !hasParameter) { @@ -136,6 +142,23 @@ protected String getPath(JsonNode node) { return pathBuilder.toString(); } + protected boolean requiresPaginatedResponse() { + return false; + } + + protected boolean hasPaginatedResponse(JsonNode node) { + JsonNode responses = node.get("responses"); + if (responses == null || responses.isMissing()) { + return false; + } + for (JsonNode responseNode : responses.propertyMap().values()) { + if (PAGINATED_RESPONSE_CODE.equals(responseNode.key().getTokenValue())) { + return true; + } + } + return false; + } + protected boolean shouldIncludePath(String path) { if (paths.isEmpty()) { return getPathCheckStrategy().equals(PATH_STRATEGY_EXCLUDE); diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheck.java index ea2c70fc..b3426978 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheck.java @@ -42,4 +42,9 @@ protected String getPathsStr() { protected String getPathCheckStrategy() { return pathCheckStrategy; } + + @Override + protected boolean requiresPaginatedResponse() { + return true; + } } diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java index 8268f050..18c81a5f 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java @@ -42,4 +42,9 @@ protected String getPathsStr() { protected String getPathCheckStrategy() { return pathCheckStrategy; } + + @Override + protected boolean requiresPaginatedResponse() { + return true; + } } \ No newline at end of file diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR020.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR020.html index cc1a5895..675370b4 100644 --- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR020.html +++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR020.html @@ -1,10 +1,10 @@

    Toda operación GET de colección debe definir $expand como parámetro de consulta.

    -

    Se aplica a: operaciones GET en rutas de colección (rutas que no terminan en un parámetro de ruta como /{id}).

    -

    Excluidos automáticamente: endpoints de detalle (ruta termina en /{param}), rutas que contienen /me, y rutas de health-check que contienen status, health o ping.

    +

    Se aplica a: por defecto, todas las operaciones GET en rutas de colección, excepto las rutas excluidas más abajo.

    +

    Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}) y, por defecto, las rutas que contienen /me, /health, /ping o /status.

    Parámetros configurables:

      -
    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).
      • -
    • pathValidationStrategy — /include o /exclude (por defecto: /include).
      • +
    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /me,/health,/ping,/status).
      • +
    • pathValidationStrategy — /include o /exclude (por defecto: /exclude).

    Ejemplo de código no compatible (OpenAPI 2)

    diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html
index d6fac197..e9740a8f 100644
--- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html
+++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR021.html
@@ -1,10 +1,10 @@
 
    Toda operación GET de colección debe definir $exclude como parámetro de consulta.
    
-
    Se aplica a: operaciones GET en rutas de colección (rutas que no terminan en un parámetro de ruta como /{id}).
    
-
    Excluidos automáticamente: endpoints de detalle (ruta termina en /{param}), rutas que contienen /me, y rutas de health-check que contienen status, health o ping.
    
+
    Se aplica a: por defecto, todas las operaciones GET en rutas de colección, excepto las rutas excluidas más abajo.
    
+
    Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}) y, por defecto, las rutas que contienen /me, /health, /ping o /status.
    
 
    Parámetros configurables:
    
 
      
-  
    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).
      • 
-  
    • pathValidationStrategy — /include o /exclude (por defecto: /include).
      • 
+  
    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /me,/health,/ping,/status).
      • 
+  
    • pathValidationStrategy — /include o /exclude (por defecto: /exclude).
      • 
 
    
 
    Ejemplo de código no compatible (OpenAPI 2)
    
 
    diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html
index f0b86367..e18bde44 100644
--- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html
+++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR022.html
@@ -1,102 +1,105 @@
-
    El parámetro elegido debe definirse en esta operación. Por defecto, $orderby
    
-
    Esta regla se aplica únicamente a endpoints GET de colección. Los paths que terminan con un parámetro de ruta (p. ej. /examples/{id}) se consideran endpoints de recurso único y quedan excluidos automáticamente.
    
+
    Toda operación GET de colección dentro del alcance debe definir $orderby como parámetro de consulta.
    
+
    Se aplica a: por defecto, solo a las operaciones GET en rutas que contienen el segmento /examples que declaran una respuesta 206. Las operaciones sin respuesta 206 no se comprueban, y el resto de rutas queda fuera de alcance.
    
+
    Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}, p. ej. /examples/{id}).
    
+
    Parámetros configurables:
    
+
      
+  
    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).
      • 
+  
    • pathValidationStrategy — /include o /exclude (por defecto: /include).
      • 
+
    
 
    Ejemplo de código no compatible (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other 
-            type: array
-            items:
-              type: string
-          - in: query
-            name: hola 
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
 
    
-
    Compliant Solution (OpenAPI 2)
    
+
    Solución compatible (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $orderby
-            type: array
-            items:
-              type: string
-          - in: query
-            name: $orderby
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $orderby
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - in: path
+          name: id
+          type: integer
+          required: true
+      responses:
+        206:
+          description: Ok
 
    
-
    Noncompliant Code Example (OpenAPI 3)
    
+
    Ejemplo de código no compatible (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other 
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: select 
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          schema:
+            type: string
+      responses:
+        "206":
+          description: Ok
 
    
-
    Compliant Solution (OpenAPI 3)
    
+
    Solución compatible (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $orderby
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: $orderby
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
-
    
\ No newline at end of file
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $orderby
+          schema:
+            type: array
+            items:
+              type: string
+      responses:
+        "206":
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        "206":
+          description: Ok
+
    
diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html
index 84e5d1bc..c866502f 100644
--- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html
+++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html
@@ -1,102 +1,105 @@
-
    El parámetro elegido debe definirse en esta operación. Por defecto, $limit
    
-
    Esta regla se aplica únicamente a endpoints GET de colección. Los paths que terminan con un parámetro de ruta (p. ej. /examples/{id}) se consideran endpoints de recurso único y quedan excluidos automáticamente.
    
+
    Toda operación GET de colección dentro del alcance debe definir $limit como parámetro de consulta.
    
+
    Se aplica a: por defecto, solo a las operaciones GET en rutas que contienen el segmento /examples que declaran una respuesta 206. Las operaciones sin respuesta 206 no se comprueban, y el resto de rutas queda fuera de alcance.
    
+
    Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}, p. ej. /examples/{id}).
    
+
    Parámetros configurables:
    
+
      
+  
    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).
      • 
+  
    • pathValidationStrategy — /include o /exclude (por defecto: /include).
      • 
+
    
 
    Ejemplo de código no compatible (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other 
-            type: array
-            items:
-              type: string
-          - in: query
-            name: hola 
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
 
    
-
    Compliant Solution (OpenAPI 2)
    
+
    Solución compatible (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $limit
-            type: array
-            items:
-              type: string
-          - in: query
-            name: $limit
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $limit
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - in: path
+          name: id
+          type: integer
+          required: true
+      responses:
+        206:
+          description: Ok
 
    
-
    Noncompliant Code Example (OpenAPI 3)
    
+
    Ejemplo de código no compatible (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other 
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: select 
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          schema:
+            type: string
+      responses:
+        "206":
+          description: Ok
 
    
-
    Compliant Solution (OpenAPI 3)
    
+
    Solución compatible (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $limit
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: $limit
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
-
    
\ No newline at end of file
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $limit
+          schema:
+            type: array
+            items:
+              type: string
+      responses:
+        "206":
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        "206":
+          description: Ok
+
    diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR020.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR020.html index c8c7dd3e..f9ff0d96 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR020.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR020.html @@ -1,10 +1,10 @@

    Every GET collection operation must define $expand as a query parameter.

    -

    Applies to: GET operations on collection paths (paths that do not end with a path parameter such as /{id}).

    -

    Excluded automatically: detail endpoints (path ends with /{param}), paths containing /me, and health-check paths containing status, health, or ping.

    +

    Applies to: by default, all GET operations on collection paths, except the paths excluded below.

    +

    Excluded automatically: detail endpoints (path ends with /{param}), plus (by default) paths containing /me, /health, /ping, or /status.

    Configurable parameters:

      -
    • paths — list of explicit paths to include/exclude (default: /examples).
      • -
    • pathValidationStrategy — /include or /exclude (default: /include).
      • +
    • paths — comma-separated list of paths to include/exclude (default: /me,/health,/ping,/status).
      • +
    • pathValidationStrategy — /include or /exclude (default: /exclude).

    Noncompliant Code Example (OpenAPI 2)

    diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html
index c39836cc..71e1f904 100644
--- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html
+++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR021.html
@@ -1,10 +1,10 @@
 
    Every GET collection operation must define $exclude as a query parameter.
    
-
    Applies to: GET operations on collection paths (paths that do not end with a path parameter such as /{id}).
    
-
    Excluded automatically: detail endpoints (path ends with /{param}), paths containing /me, and health-check paths containing status, health, or ping.
    
+
    Applies to: by default, all GET operations on collection paths, except the paths excluded below.
    
+
    Excluded automatically: detail endpoints (path ends with /{param}), plus (by default) paths containing /me, /health, /ping, or /status.
    
 
    Configurable parameters:
    
 
      
-  
    • paths — list of explicit paths to include/exclude (default: /examples).
      • 
-  
    • pathValidationStrategy — /include or /exclude (default: /include).
      • 
+  
    • paths — comma-separated list of paths to include/exclude (default: /me,/health,/ping,/status).
      • 
+  
    • pathValidationStrategy — /include or /exclude (default: /exclude).
      • 
 
    
 
    Noncompliant Code Example (OpenAPI 2)
    
 
    diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html
index 2d816f82..83dd2e79 100644
--- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html
+++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR022.html
@@ -1,102 +1,105 @@
-
    The chosen parameter must be defined in this operation. By default, $orderby
    
-
    This rule applies only to collection GET endpoints. Paths ending with a path parameter (e.g. /examples/{id}) are treated as single-resource endpoints and are automatically excluded.
    
+
    Every GET collection operation in scope must define $orderby as a query parameter.
    
+
    Applies to: by default, only GET operations on paths containing the /examples segment that declare a 206 response. Operations without a 206 response are not checked, and every other path is out of scope.
    
+
    Excluded automatically: detail endpoints (path ends with /{param}, e.g. /examples/{id}).
    
+
    Configurable parameters:
    
+
      
+  
    • paths — comma-separated list of paths to include/exclude (default: /examples).
      • 
+  
    • pathValidationStrategy — /include or /exclude (default: /include).
      • 
+
    
 
    Noncompliant Code Example (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
-            type: array
-            items:
-              type: string
-          - in: query
-            name: hola # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
 
    
 
    Compliant Solution (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $orderby
-            type: array
-            items:
-              type: string
-          - in: query
-            name: $orderby
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $orderby
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - in: path
+          name: id
+          type: integer
+          required: true
+      responses:
+        206:
+          description: Ok
 
    
 
    Noncompliant Code Example (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: select # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR022: $orderby must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          schema:
+            type: string
+      responses:
+        "206":
+          description: Ok
 
    
 
    Compliant Solution (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $orderby
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: $orderby
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
-
    
\ No newline at end of file
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $orderby
+          schema:
+            type: array
+            items:
+              type: string
+      responses:
+        "206":
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        "206":
+          description: Ok
+
    
diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html
index 40d0873f..fcc14411 100644
--- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html
+++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html
@@ -1,102 +1,105 @@
-
    The chosen parameter must be defined in this operation. By default, $limit
    
-
    This rule applies only to collection GET endpoints. Paths ending with a path parameter (e.g. /examples/{id}) are treated as single-resource endpoints and are automatically excluded.
    
+
    Every GET collection operation in scope must define $limit as a query parameter.
    
+
    Applies to: by default, only GET operations on paths containing the /examples segment that declare a 206 response. Operations without a 206 response are not checked, and every other path is out of scope.
    
+
    Excluded automatically: detail endpoints (path ends with /{param}, e.g. /examples/{id}).
    
+
    Configurable parameters:
    
+
      
+  
    • paths — comma-separated list of paths to include/exclude (default: /examples).
      • 
+  
    • pathValidationStrategy — /include or /exclude (default: /include).
      • 
+
    
 
    Noncompliant Code Example (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
-            type: array
-            items:
-              type: string
-          - in: query
-            name: hola # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
 
    
 
    Compliant Solution (OpenAPI 2)
    
 
    -  swagger: "2.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $limit
-            type: array
-            items:
-              type: string
-          - in: query
-            name: $limit
-            type: array
-            items:
-              type: string
-        responses:
-          206:
-            description: Ok
+swagger: "2.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $limit
+          type: array
+          items:
+            type: string
+      responses:
+        206:
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - in: path
+          name: id
+          type: integer
+          required: true
+      responses:
+        206:
+          description: Ok
 
    
 
    Noncompliant Code Example (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters: 
-          - in: query
-            name: other # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: select # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get: # Noncompliant {{OAR025: $limit must be defined as a parameter in this operation}}
+      parameters:
+        - in: query
+          name: other
+          schema:
+            type: string
+      responses:
+        "206":
+          description: Ok
 
    
 
    Compliant Solution (OpenAPI 3)
    
 
    -  openapi: "3.0.0"
-  info:
-    version: 1.0.0
-    title: Swagger Petstore
-  paths:
-    /pets:
-      get:
-        parameters:
-          - in: query
-            name: $limit
-            schema:
-              type: array
-              items:
-                type: string
-          - in: query
-            name: $limit
-            schema:
-              type: array
-              items:
-                type: string
-        responses:
-          206:
-            description: Ok
-
    
\ No newline at end of file
+openapi: "3.0.0"
+info:
+  version: 1.0.0
+  title: Swagger Petstore
+paths:
+  /examples:
+    get:
+      parameters:
+        - in: query
+          name: $limit
+          schema:
+            type: array
+            items:
+              type: string
+      responses:
+        "206":
+          description: Ok
+  /examples/{id}:
+    get:
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        "206":
+          description: Ok
+
    diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java index 89c741be..6f9e281e 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR022OrderbyParameterCheckTest.java @@ -72,6 +72,15 @@ public void verifyInV32Without() { verifyV32("plain-without"); } + @Test + public void verifyInV2NoPagination() { + verifyV2("no-pagination"); + } + @Test + public void verifyInV3NoPagination() { + verifyV3("no-pagination"); + } + @Test public void verifyInV2SingleResource() { verifyV2("single-resource"); diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java index 463dfe8c..6d3fc698 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java @@ -72,6 +72,15 @@ public void verifyInV32Without() { verifyV32("plain-without"); } + @Test + public void verifyInV2NoPagination() { + verifyV2("no-pagination"); + } + @Test + public void verifyInV3NoPagination() { + verifyV3("no-pagination"); + } + @Test public void verifyInV2SingleResource() { verifyV2("single-resource"); diff --git a/src/test/resources/checks/v2/parameters/OAR022/no-pagination.json b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.json new file mode 100644 index 00000000..0fa286cd --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.json @@ -0,0 +1,18 @@ +{ + "swagger": "2.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml new file mode 100644 index 00000000..0c668a99 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR022/no-pagination.yaml @@ -0,0 +1,10 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/no-pagination.json b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.json new file mode 100644 index 00000000..0fa286cd --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.json @@ -0,0 +1,18 @@ +{ + "swagger": "2.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml new file mode 100644 index 00000000..0c668a99 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/no-pagination.yaml @@ -0,0 +1,10 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR022/no-pagination.json b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.json new file mode 100644 index 00000000..68b6c31b --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.json @@ -0,0 +1,18 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml new file mode 100644 index 00000000..e3e4265e --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR022/no-pagination.yaml @@ -0,0 +1,10 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-pagination.json b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.json new file mode 100644 index 00000000..68b6c31b --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.json @@ -0,0 +1,18 @@ +{ + "openapi": "3.0.0", + "info": { + "version": "1.0.0", + "title": "Swagger Petstore" + }, + "paths": { + "/examples": { + "get": { + "responses": { + "200": { + "description": "in scope but not paginated (no 206 response) -> rule does not apply" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml new file mode 100644 index 00000000..e3e4265e --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-pagination.yaml @@ -0,0 +1,10 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # in scope but not paginated (no 206 response) -> rule does not apply + responses: + 200: + description: Ok From 4a9cebbc692571c6bb5dc15ae28311ba1905cc2c Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Mon, 24 Aug 2026 16:42:47 -0500 Subject: [PATCH 08/11] fix: oar025 integer type validation --- CHANGELOG.md | 7 ++ pom.xml | 2 +- .../AbstractQueryParameterCheck.java | 78 ++++++++++++++----- .../parameters/OAR025LimitParameterCheck.java | 12 +++ src/main/resources/messages/errors.properties | 1 + .../resources/messages/errors_es.properties | 1 + .../rules/openapi/parameters/OAR025.html | 11 +-- .../rules/openapi/parameters/OAR025.html | 11 +-- .../OAR025LimitParameterCheckTest.java | 34 ++++++++ .../checks/v2/parameters/OAR025/plain.json | 16 ++-- .../checks/v2/parameters/OAR025/plain.yaml | 10 +-- .../v2/parameters/OAR025/wrong-type-ref.json | 28 +++++++ .../v2/parameters/OAR025/wrong-type-ref.yaml | 17 ++++ .../v2/parameters/OAR025/wrong-type.json | 23 ++++++ .../v2/parameters/OAR025/wrong-type.yaml | 14 ++++ .../checks/v3/parameters/OAR025/plain.json | 12 +-- .../checks/v3/parameters/OAR025/plain.yaml | 10 +-- .../v3/parameters/OAR025/wrong-type-ref.json | 32 ++++++++ .../v3/parameters/OAR025/wrong-type-ref.yaml | 19 +++++ .../v3/parameters/OAR025/wrong-type.json | 25 ++++++ .../v3/parameters/OAR025/wrong-type.yaml | 15 ++++ .../checks/v31/parameters/OAR025/plain.json | 12 +-- .../checks/v31/parameters/OAR025/plain.yaml | 10 +-- .../v31/parameters/OAR025/wrong-type-ref.json | 32 ++++++++ .../v31/parameters/OAR025/wrong-type-ref.yaml | 19 +++++ .../v31/parameters/OAR025/wrong-type.json | 25 ++++++ .../v31/parameters/OAR025/wrong-type.yaml | 15 ++++ .../checks/v32/parameters/OAR025/plain.json | 12 +-- .../checks/v32/parameters/OAR025/plain.yaml | 10 +-- .../v32/parameters/OAR025/wrong-type-ref.json | 32 ++++++++ .../v32/parameters/OAR025/wrong-type-ref.yaml | 19 +++++ .../v32/parameters/OAR025/wrong-type.json | 25 ++++++ .../v32/parameters/OAR025/wrong-type.yaml | 15 ++++ 33 files changed, 503 insertions(+), 101 deletions(-) create mode 100644 src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json create mode 100644 src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml create mode 100644 src/test/resources/checks/v2/parameters/OAR025/wrong-type.json create mode 100644 src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json create mode 100644 src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR025/wrong-type.json create mode 100644 src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml create mode 100644 src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json create mode 100644 src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml create mode 100644 src/test/resources/checks/v31/parameters/OAR025/wrong-type.json create mode 100644 src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml create mode 100644 src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json create mode 100644 src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml create mode 100644 src/test/resources/checks/v32/parameters/OAR025/wrong-type.json create mode 100644 src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 313f1068..308695c4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.5.1-beta-4] - 2026-08-24 + +### Changed + +- OAR025 - The shared `apq-collection-query-param-required` function now also validates the parameter type for OAR025, keyed by rule code; when `$limit` is present but its type is not `integer`, a distinct type message is emitted. + + ## [1.5.1-beta-3] - 2026-08-14 ### Changed diff --git a/pom.xml b/pom.xml index 89572cfa..0f9db72d 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.1-beta-3 + 1.5.1-beta-4 sonar-plugin SonarQube OpenAPI Community Rules diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java index 3e79f389..1da56dc2 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java @@ -82,52 +82,90 @@ public void visitNode(JsonNode node) { return; } - boolean hasParameter = hasParameterInNode(node); + if (!shouldIncludePath(path)) { + return; + } + + JsonNode parameterNode = findMatchingParameter(node); - if (shouldIncludePath(path) && !hasParameter) { + if (parameterNode == null) { addIssue( ruleKey, translate(messageKey, getParameterName()), node.key() ); + } else if (getExpectedType() != null && !hasExpectedType(parameterNode)) { + addIssue( + ruleKey, + translate(getTypeMessageKey(), getParameterName()), + node.key() + ); } } protected boolean hasParameterInNode(JsonNode node) { + return findMatchingParameter(node) != null; + } + + protected JsonNode findMatchingParameter(JsonNode node) { JsonNode parametersNode = node.get("parameters"); if (parametersNode != null) { - for (JsonNode parameterNode : parametersNode.elements()) { - if (isRefParameter(parameterNode) && hasNamedRefParameter(parameterNode)) { - return true; - } - if (hasDirectParameter(parameterNode)) { - return true; - } + if (isRefParameter(parameterNode)) { + JsonNode refParameterNode = resolveReference(parameterNode.get("$ref").getTokenValue(), rootNode); + if (refParameterNode != null && matchesNameAndIn(refParameterNode)) { + return refParameterNode; + } + } else if (matchesNameAndIn(parameterNode)) { + return parameterNode; + } } } - return false; + return null; } protected boolean isRefParameter(JsonNode parameterNode) { - return parameterNode.get("$ref") != null; + JsonNode refNode = parameterNode.get("$ref"); + return refNode != null && !refNode.isMissing(); } protected boolean hasNamedRefParameter(JsonNode parameterNode) { - String refValue = parameterNode.get("$ref").getTokenValue(); - JsonNode refParameterNode = resolveReference(refValue, rootNode); - if (refParameterNode != null) { - JsonNode nameNode = refParameterNode.get("name"); - JsonNode inNode = refParameterNode.get("in"); - return inNode != null && "query".equals(inNode.getTokenValue()) && nameNode != null && getParameterName().equals(nameNode.getTokenValue()); - } - return false; + JsonNode refParameterNode = resolveReference(parameterNode.get("$ref").getTokenValue(), rootNode); + return refParameterNode != null && matchesNameAndIn(refParameterNode); } protected boolean hasDirectParameter(JsonNode parameterNode) { + return matchesNameAndIn(parameterNode); + } + + protected boolean matchesNameAndIn(JsonNode parameterNode) { JsonNode nameNode = parameterNode.get("name"); JsonNode inNode = parameterNode.get("in"); - return inNode != null && "query".equals(inNode.getTokenValue()) && nameNode != null && getParameterName().equals(nameNode.getTokenValue()); + return inNode != null && "query".equals(inNode.getTokenValue()) + && nameNode != null && getParameterName().equals(nameNode.getTokenValue()); + } + + protected String getExpectedType() { + return null; + } + + protected String getTypeMessageKey() { + return null; + } + + protected boolean hasExpectedType(JsonNode parameterNode) { + String expected = getExpectedType(); + if (expected == null) { + return true; + } + JsonNode schemaNode = parameterNode.get("schema"); + JsonNode typeNode; + if (schemaNode != null && !schemaNode.isMissing()) { + typeNode = schemaNode.get("type"); // OpenAPI 3.x + } else { + typeNode = parameterNode.get("type"); // OpenAPI 2.0 + } + return typeNode != null && !typeNode.isMissing() && expected.equals(typeNode.getTokenValue()); } protected String getPath(JsonNode node) { diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java index 18c81a5f..865ac31d 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheck.java @@ -8,7 +8,9 @@ public class OAR025LimitParameterCheck extends AbstractQueryParameterCheck { public static final String KEY = "OAR025"; private static final String MESSAGE = "OAR025.error"; + private static final String TYPE_MESSAGE = "OAR025.type.error"; private static final String PARAM_NAME = "$limit"; + private static final String EXPECTED_TYPE = "integer"; @RuleProperty( key = "paths", @@ -47,4 +49,14 @@ protected String getPathCheckStrategy() { protected boolean requiresPaginatedResponse() { return true; } + + @Override + protected String getExpectedType() { + return EXPECTED_TYPE; + } + + @Override + protected String getTypeMessageKey() { + return TYPE_MESSAGE; + } } \ No newline at end of file diff --git a/src/main/resources/messages/errors.properties b/src/main/resources/messages/errors.properties index 94b9fb2d..22094345 100644 --- a/src/main/resources/messages/errors.properties +++ b/src/main/resources/messages/errors.properties @@ -25,6 +25,7 @@ OAR022.error={0} must be defined as a parameter in this operation OAR023.error={0} must be defined as a parameter in this operation OAR024.error={0} must be defined as a parameter in this operation OAR025.error={0} must be defined as a parameter in this operation +OAR025.type.error={0} must be defined as a parameter of type integer in this operation OAR026.error=The $total parameter default value should be false OAR027.error=Location header is required in responses with code 201 from POST operations OAR028.error={0} must be defined as a parameter in this operation diff --git a/src/main/resources/messages/errors_es.properties b/src/main/resources/messages/errors_es.properties index ed00285c..9204c4a3 100644 --- a/src/main/resources/messages/errors_es.properties +++ b/src/main/resources/messages/errors_es.properties @@ -25,6 +25,7 @@ OAR022.error={0} debe ser definido como un parámetro en esta operación OAR023.error={0} debe ser definido como un parámetro en esta operación OAR024.error={0} debe ser definido como un parámetro en esta operación OAR025.error={0} debe ser definido como un parámetro en esta operación +OAR025.type.error={0} debe ser definido como un parámetro de tipo integer en esta operación OAR026.error=El valor por defecto del parámetro $total debe ser falso OAR027.error=La cabecera Location es obligatoria en las respuestas con el código 201 de las operaciones POST OAR028.error={0} debe ser definido como un parámetro en esta operación diff --git a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html index c866502f..02879292 100644 --- a/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html +++ b/src/main/resources/org/sonar/l10n/es/openapi/rules/openapi/parameters/OAR025.html @@ -1,6 +1,7 @@ -

    Toda operación GET de colección dentro del alcance debe definir $limit como parámetro de consulta.

    +

    Toda operación GET de colección dentro del alcance debe definir $limit como parámetro de consulta de tipo integer.

    Se aplica a: por defecto, solo a las operaciones GET en rutas que contienen el segmento /examples que declaran una respuesta 206. Las operaciones sin respuesta 206 no se comprueban, y el resto de rutas queda fuera de alcance.

    Excluidos automáticamente: endpoints de detalle (la ruta termina en /{param}, p. ej. /examples/{id}).

    +

    También se reporta: cuando $limit está presente pero su tipo no es integer.

    Parámetros configurables:

    • paths — lista de rutas a incluir/excluir separadas por coma (por defecto: /examples).
      • @@ -37,9 +38,7 @@

      Solución compatible (OpenAPI 2)

      parameters: - in: query name: $limit - type: array - items: - type: string + type: integer responses: 206: description: Ok @@ -85,9 +84,7 @@

      Solución compatible (OpenAPI 3)

      - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: "206": description: Ok diff --git a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html index fcc14411..d15c78ac 100644 --- a/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html +++ b/src/main/resources/org/sonar/l10n/openapi/rules/openapi/parameters/OAR025.html @@ -1,6 +1,7 @@ -

      Every GET collection operation in scope must define $limit as a query parameter.

      +

      Every GET collection operation in scope must define $limit as a query parameter of type integer.

      Applies to: by default, only GET operations on paths containing the /examples segment that declare a 206 response. Operations without a 206 response are not checked, and every other path is out of scope.

      Excluded automatically: detail endpoints (path ends with /{param}, e.g. /examples/{id}).

      +

      Also reported: when $limit is present but its type is not integer.

      Configurable parameters:

      • paths — comma-separated list of paths to include/exclude (default: /examples).
        • @@ -37,9 +38,7 @@

        Compliant Solution (OpenAPI 2)

        parameters: - in: query name: $limit - type: array - items: - type: string + type: integer responses: 206: description: Ok @@ -85,9 +84,7 @@

        Compliant Solution (OpenAPI 3)

        - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: "206": description: Ok diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java index 6d3fc698..0cc8220c 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java @@ -98,6 +98,40 @@ public void verifyInV32SingleResource() { verifyV32("single-resource"); } + @Test + public void verifyInV2WrongType() { + verifyV2("wrong-type"); + } + @Test + public void verifyInV3WrongType() { + verifyV3("wrong-type"); + } + @Test + public void verifyInV31WrongType() { + verifyV31("wrong-type"); + } + @Test + public void verifyInV32WrongType() { + verifyV32("wrong-type"); + } + + @Test + public void verifyInV2WrongTypeRef() { + verifyV2("wrong-type-ref"); + } + @Test + public void verifyInV3WrongTypeRef() { + verifyV3("wrong-type-ref"); + } + @Test + public void verifyInV31WrongTypeRef() { + verifyV31("wrong-type-ref"); + } + @Test + public void verifyInV32WrongTypeRef() { + verifyV32("wrong-type-ref"); + } + @Override public void verifyRule() { assertRuleProperties("OAR025 - LimitParameter - the chosen parameter must be defined in this operation", RuleType.BUG, Severity.MAJOR, tags("parameters")); diff --git a/src/test/resources/checks/v2/parameters/OAR025/plain.json b/src/test/resources/checks/v2/parameters/OAR025/plain.json index 609a66fb..008f8f58 100644 --- a/src/test/resources/checks/v2/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v2/parameters/OAR025/plain.json @@ -9,18 +9,12 @@ "get" : { "parameters" : [ { "in" : "query", - "name" : "$limit", - "type" : "array", - "items" : { - "type" : "string" - } + "name" : "$limit", + "type" : "integer" }, { "in" : "query", - "name" : "$limit", - "type" : "array", - "items" : { - "type" : "string" - } + "name" : "$limit", + "type" : "integer" } ], "responses" : { "206" : { @@ -30,4 +24,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/plain.yaml b/src/test/resources/checks/v2/parameters/OAR025/plain.yaml index 4d2fd9a5..3c641624 100644 --- a/src/test/resources/checks/v2/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v2/parameters/OAR025/plain.yaml @@ -8,14 +8,10 @@ paths: parameters: - in: query name: $limit - type: array - items: - type: string + type: integer - in: query name: $limit - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..861b5308 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,28 @@ +{ + "swagger" : "2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "type" : "string" + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..f80d9f35 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,17 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +parameters: + limit: + in: query + name: $limit + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..36aeb1c1 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.json @@ -0,0 +1,23 @@ +{ + "swagger" : "2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "type" : "string" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..f61b299b --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,14 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/plain.json b/src/test/resources/checks/v3/parameters/OAR025/plain.json index b853da7f..b530779a 100644 --- a/src/test/resources/checks/v3/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v3/parameters/OAR025/plain.json @@ -11,19 +11,13 @@ "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } }, { "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } } ], "responses" : { @@ -34,4 +28,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/plain.yaml b/src/test/resources/checks/v3/parameters/OAR025/plain.yaml index 7eebb8fa..6083aa20 100644 --- a/src/test/resources/checks/v3/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v3/parameters/OAR025/plain.yaml @@ -9,15 +9,11 @@ paths: - in: query name: $limit schema: - type: array - items: - type: string + type: integer - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..f607f779 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,32 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..c4ccd59a --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,19 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/components/parameters/limit' + responses: + "206": + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..dcae46f1 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..48d38b43 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/plain.json b/src/test/resources/checks/v31/parameters/OAR025/plain.json index 96bc8d9a..6acf169c 100644 --- a/src/test/resources/checks/v31/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v31/parameters/OAR025/plain.json @@ -11,19 +11,13 @@ "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } }, { "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } } ], "responses" : { @@ -34,4 +28,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/plain.yaml b/src/test/resources/checks/v31/parameters/OAR025/plain.yaml index 3bf57ba7..211962c6 100644 --- a/src/test/resources/checks/v31/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v31/parameters/OAR025/plain.yaml @@ -9,15 +9,11 @@ paths: - in: query name: $limit schema: - type: array - items: - type: string + type: integer - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..813e37f5 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,32 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..4352ade3 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,19 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/components/parameters/limit' + responses: + "206": + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..aa97f48d --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..8c41be46 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: string + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/plain.json b/src/test/resources/checks/v32/parameters/OAR025/plain.json index 33ee1029..636a365c 100644 --- a/src/test/resources/checks/v32/parameters/OAR025/plain.json +++ b/src/test/resources/checks/v32/parameters/OAR025/plain.json @@ -11,19 +11,13 @@ "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } }, { "in" : "query", "name" : "$limit", "schema": { - "type" : "array", - "items" : { - "type" : "string" - } + "type" : "integer" } } ], "responses" : { @@ -34,4 +28,4 @@ } } } -} \ No newline at end of file +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/plain.yaml b/src/test/resources/checks/v32/parameters/OAR025/plain.yaml index ffee1572..4757b7d5 100644 --- a/src/test/resources/checks/v32/parameters/OAR025/plain.yaml +++ b/src/test/resources/checks/v32/parameters/OAR025/plain.yaml @@ -9,15 +9,11 @@ paths: - in: query name: $limit schema: - type: array - items: - type: string + type: integer - in: query name: $limit schema: - type: array - items: - type: string + type: integer responses: 206: - description: Ok \ No newline at end of file + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json new file mode 100644 index 00000000..1e384bbf --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.json @@ -0,0 +1,32 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml new file mode 100644 index 00000000..6dad83c0 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type-ref.yaml @@ -0,0 +1,19 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: string +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - $ref: '#/components/parameters/limit' + responses: + "206": + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type.json b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.json new file mode 100644 index 00000000..09d692a1 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema": { + "type" : "string" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml new file mode 100644 index 00000000..2b925542 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/wrong-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: string + responses: + 206: + description: Ok From d90cc870771c52fc0ec96e34865f973a1c7c01c5 Mon Sep 17 00:00:00 2001 From: Melsy Huamani Date: Mon, 24 Aug 2026 18:50:36 -0500 Subject: [PATCH 09/11] fix: resolve schema-level $ref in OAR025 $limit type check --- .../AbstractQueryParameterCheck.java | 6 ++- .../OAR025LimitParameterCheckTest.java | 44 +++++++++++++++++++ .../checks/v2/parameters/OAR025/ok-ref.json | 29 ++++++++++++ .../checks/v2/parameters/OAR025/ok-ref.yaml | 18 ++++++++ .../checks/v3/parameters/OAR025/no-type.json | 25 +++++++++++ .../checks/v3/parameters/OAR025/no-type.yaml | 15 +++++++ .../checks/v3/parameters/OAR025/ok-ref.json | 33 ++++++++++++++ .../checks/v3/parameters/OAR025/ok-ref.yaml | 20 +++++++++ .../v3/parameters/OAR025/schema-ref.json | 33 ++++++++++++++ .../v3/parameters/OAR025/schema-ref.yaml | 20 +++++++++ .../v31/parameters/OAR025/array-type.json | 25 +++++++++++ .../v31/parameters/OAR025/array-type.yaml | 17 +++++++ .../checks/v31/parameters/OAR025/ok-ref.json | 33 ++++++++++++++ .../checks/v31/parameters/OAR025/ok-ref.yaml | 20 +++++++++ .../v31/parameters/OAR025/schema-ref.json | 33 ++++++++++++++ .../v31/parameters/OAR025/schema-ref.yaml | 20 +++++++++ .../v32/parameters/OAR025/array-type.json | 25 +++++++++++ .../v32/parameters/OAR025/array-type.yaml | 17 +++++++ .../checks/v32/parameters/OAR025/ok-ref.json | 33 ++++++++++++++ .../checks/v32/parameters/OAR025/ok-ref.yaml | 20 +++++++++ .../v32/parameters/OAR025/schema-ref.json | 33 ++++++++++++++ .../v32/parameters/OAR025/schema-ref.yaml | 20 +++++++++ 22 files changed, 538 insertions(+), 1 deletion(-) create mode 100644 src/test/resources/checks/v2/parameters/OAR025/ok-ref.json create mode 100644 src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR025/no-type.json create mode 100644 src/test/resources/checks/v3/parameters/OAR025/no-type.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR025/ok-ref.json create mode 100644 src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml create mode 100644 src/test/resources/checks/v3/parameters/OAR025/schema-ref.json create mode 100644 src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml create mode 100644 src/test/resources/checks/v31/parameters/OAR025/array-type.json create mode 100644 src/test/resources/checks/v31/parameters/OAR025/array-type.yaml create mode 100644 src/test/resources/checks/v31/parameters/OAR025/ok-ref.json create mode 100644 src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml create mode 100644 src/test/resources/checks/v31/parameters/OAR025/schema-ref.json create mode 100644 src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml create mode 100644 src/test/resources/checks/v32/parameters/OAR025/array-type.json create mode 100644 src/test/resources/checks/v32/parameters/OAR025/array-type.yaml create mode 100644 src/test/resources/checks/v32/parameters/OAR025/ok-ref.json create mode 100644 src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml create mode 100644 src/test/resources/checks/v32/parameters/OAR025/schema-ref.json create mode 100644 src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml diff --git a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java index 1da56dc2..36c61941 100644 --- a/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java +++ b/src/main/java/apiaddicts/sonar/openapi/checks/parameters/AbstractQueryParameterCheck.java @@ -161,7 +161,11 @@ protected boolean hasExpectedType(JsonNode parameterNode) { JsonNode schemaNode = parameterNode.get("schema"); JsonNode typeNode; if (schemaNode != null && !schemaNode.isMissing()) { - typeNode = schemaNode.get("type"); // OpenAPI 3.x + JsonNode schemaRef = schemaNode.get("$ref"); + if (schemaRef != null && !schemaRef.isMissing()) { + schemaNode = resolveReference(schemaRef.getTokenValue(), rootNode); + } + typeNode = schemaNode != null ? schemaNode.get("type") : null; } else { typeNode = parameterNode.get("type"); // OpenAPI 2.0 } diff --git a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java index 0cc8220c..a044b481 100644 --- a/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java +++ b/src/test/java/apiaddicts/sonar/openapi/checks/parameters/OAR025LimitParameterCheckTest.java @@ -132,6 +132,50 @@ public void verifyInV32WrongTypeRef() { verifyV32("wrong-type-ref"); } + @Test + public void verifyInV3SchemaRef() { + verifyV3("schema-ref"); + } + @Test + public void verifyInV31SchemaRef() { + verifyV31("schema-ref"); + } + @Test + public void verifyInV32SchemaRef() { + verifyV32("schema-ref"); + } + + @Test + public void verifyInV2OkRef() { + verifyV2("ok-ref"); + } + @Test + public void verifyInV3OkRef() { + verifyV3("ok-ref"); + } + @Test + public void verifyInV31OkRef() { + verifyV31("ok-ref"); + } + @Test + public void verifyInV32OkRef() { + verifyV32("ok-ref"); + } + + @Test + public void verifyInV31ArrayType() { + verifyV31("array-type"); + } + @Test + public void verifyInV32ArrayType() { + verifyV32("array-type"); + } + + @Test + public void verifyInV3NoType() { + verifyV3("no-type"); + } + @Override public void verifyRule() { assertRuleProperties("OAR025 - LimitParameter - the chosen parameter must be defined in this operation", RuleType.BUG, Severity.MAJOR, tags("parameters")); diff --git a/src/test/resources/checks/v2/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..401fe997 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.json @@ -0,0 +1,29 @@ +{ + "swagger" : "2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "type" : "integer", + "format" : "int64" + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..39171d70 --- /dev/null +++ b/src/test/resources/checks/v2/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,18 @@ +swagger: "2.0" +info: + version: 1.0.0 + title: Swagger Petstore +parameters: + limit: + in: query + name: $limit + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-type.json b/src/test/resources/checks/v3/parameters/OAR025/no-type.json new file mode 100644 index 00000000..85760114 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "format" : "int64" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/no-type.yaml b/src/test/resources/checks/v3/parameters/OAR025/no-type.yaml new file mode 100644 index 00000000..f58f3717 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/no-type.yaml @@ -0,0 +1,15 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + format: int64 + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..07a916d8 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : "integer", + "format" : "int64" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..f5e2ddd5 --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/components/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v3/parameters/OAR025/schema-ref.json b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.json new file mode 100644 index 00000000..17c0f3cc --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.0.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "schemas" : { + "LimitType" : { + "type" : "integer", + "format" : "int64" + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "$ref" : "#/components/schemas/LimitType" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml new file mode 100644 index 00000000..e21c405c --- /dev/null +++ b/src/test/resources/checks/v3/parameters/OAR025/schema-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.0.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + schemas: + LimitType: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + $ref: '#/components/schemas/LimitType' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/array-type.json b/src/test/resources/checks/v31/parameters/OAR025/array-type.json new file mode 100644 index 00000000..9cc98ddb --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/array-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : [ "integer", "null" ] + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/array-type.yaml b/src/test/resources/checks/v31/parameters/OAR025/array-type.yaml new file mode 100644 index 00000000..91d0cad7 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/array-type.yaml @@ -0,0 +1,17 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: + - integer + - "null" + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..d0716f34 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : "integer", + "format" : "int64" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..4a465d0b --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/components/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v31/parameters/OAR025/schema-ref.json b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.json new file mode 100644 index 00000000..94d74d36 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.1.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "schemas" : { + "LimitType" : { + "type" : "integer", + "format" : "int64" + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "$ref" : "#/components/schemas/LimitType" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml new file mode 100644 index 00000000..9205f523 --- /dev/null +++ b/src/test/resources/checks/v31/parameters/OAR025/schema-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.1.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + schemas: + LimitType: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + $ref: '#/components/schemas/LimitType' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/array-type.json b/src/test/resources/checks/v32/parameters/OAR025/array-type.json new file mode 100644 index 00000000..bc82d1d7 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/array-type.json @@ -0,0 +1,25 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "paths" : { + "/examples" : { + "get" : { # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : [ "integer", "null" ] + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/array-type.yaml b/src/test/resources/checks/v32/parameters/OAR025/array-type.yaml new file mode 100644 index 00000000..d22ea694 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/array-type.yaml @@ -0,0 +1,17 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +paths: + /examples: + get: # Noncompliant {{OAR025: $limit must be defined as a parameter of type integer in this operation}} + parameters: + - in: query + name: $limit + schema: + type: + - integer + - "null" + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/ok-ref.json b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.json new file mode 100644 index 00000000..dea24726 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "parameters" : { + "limit" : { + "in" : "query", + "name" : "$limit", + "schema" : { + "type" : "integer", + "format" : "int64" + } + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "$ref" : "#/components/parameters/limit" + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml new file mode 100644 index 00000000..d5e87eab --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/ok-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + parameters: + limit: + in: query + name: $limit + schema: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - $ref: '#/components/parameters/limit' + responses: + 206: + description: Ok diff --git a/src/test/resources/checks/v32/parameters/OAR025/schema-ref.json b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.json new file mode 100644 index 00000000..f1c3a243 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.json @@ -0,0 +1,33 @@ +{ + "openapi" : "3.2.0", + "info" : { + "version" : "1.0.0", + "title" : "Swagger Petstore" + }, + "components" : { + "schemas" : { + "LimitType" : { + "type" : "integer", + "format" : "int64" + } + } + }, + "paths" : { + "/examples" : { + "get" : { + "parameters" : [ { + "in" : "query", + "name" : "$limit", + "schema" : { + "$ref" : "#/components/schemas/LimitType" + } + } ], + "responses" : { + "206" : { + "description" : "Ok" + } + } + } + } + } +} diff --git a/src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml new file mode 100644 index 00000000..67fb80d2 --- /dev/null +++ b/src/test/resources/checks/v32/parameters/OAR025/schema-ref.yaml @@ -0,0 +1,20 @@ +openapi: "3.2.0" +info: + version: 1.0.0 + title: Swagger Petstore +components: + schemas: + LimitType: + type: integer + format: int64 +paths: + /examples: + get: + parameters: + - in: query + name: $limit + schema: + $ref: '#/components/schemas/LimitType' + responses: + 206: + description: Ok From e1c127a03cd883b665e9dea8fb7e79c06473c81b Mon Sep 17 00:00:00 2001 From: Sebastian Diaz Torres Date: Tue, 25 Aug 2026 11:44:10 -0500 Subject: [PATCH 10/11] Release 1.5.1 --- CHANGELOG.md | 23 +++++++++++++++++++++++ pom.xml | 2 +- 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 308695c4..3cdf83d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,29 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.5.1-beta-4] - 2026-08-25 + +### Changed + +- OAR025 - The shared `apq-collection-query-param-required` function now also validates the parameter type for OAR025, keyed by rule code; when `$limit` is present but its type is not `integer`, a distinct type message is emitted. +- OAR022 - OrderbyParameterCheck - Now only applies to paginated collections (operations declaring a 206 response); added `no-pagination` fixtures/tests and corrected the HTML docs (real defaults + 206 condition). +- OAR025 - LimitParameterCheck - Same 206 gating for `$limit`; added `no-pagination` fixtures/tests and corrected the HTML docs. +- OAR020 - ExpandParameterCheck - Corrected the HTML docs to the real defaults (`/me,/health,/ping,/status`, `/exclude`). +- OAR021 - ExcludeParameterCheck - Corrected the HTML docs to the real defaults (`/me,/health,/ping,/status`, `/exclude`). + +### Fixed + +- OAR035 - AuthorizationResponses - Honor an operation-level `security: []` explicit opt-out: the operation is unsecured, so no 401 is required even under global security. Added `security-opt-out` (v3) fixtures and test. +- OAR096 - ForbiddenResponses - Same `security: []` opt-out fix in the shared `AbstractSecurityResponseCheck`: no 403 required for opted-out operations. Added `security-opt-out` (v3) fixtures and test. +- OAR014 / OAR015 - ResourceLevel - Issue message now interpolates the configured level values (min-level/max-level for OAR014, max-level-allowed for OAR015). +- OAR004 / OAR040 - Wso2Scopes - Issue message now includes the configured `pattern` (passed through `AbstractPatternWso2ScopesCheck`). +- OAR038 - StandardCreateResponse - Issue message now interpolates the configured `data-property` instead of the hardcoded `data`. +- OAR082 - BinaryOrByteFormat - Issue message now shows the configured `fields-to-apply`. +- OAR085 - OpenAPIVersion - Issue message now shows the configured `valid-versions`. +- OAR037 - StringFormat - Fixed false positive on string schemas constrained by `enum`. The check only inspected `format`/`pattern`, so a string with a non-empty `enum` and no `format` was wrongly reported even though the `enum` already constrains the allowed values. When no `format` is declared, a non-empty `enum` now satisfies the rule (like a valid `pattern`); a present-but-invalid `format` still fires even when an `enum` is declared. +- OAR044 - MediaTypeCheck - Media type parameters now follow RFC 9110 (charset without space, other parameter names, multiple parameters); type/subtype can no longer start with `.`. + + ## [1.5.1-beta-4] - 2026-08-24 ### Changed diff --git a/pom.xml b/pom.xml index 0f9db72d..de86ba15 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 org.apiaddicts.apitools.dosonarapi sonaropenapi-rules-community - 1.5.1-beta-4 + 1.5.1 sonar-plugin SonarQube OpenAPI Community Rules From e44876fbe444defd1691f2f6087ed9bfb7e401f1 Mon Sep 17 00:00:00 2001 From: Sebastian Diaz Torres Date: Tue, 25 Aug 2026 11:52:43 -0500 Subject: [PATCH 11/11] fix: Update changelog version --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3cdf83d9..ed5617c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [1.5.1-beta-4] - 2026-08-25 +## [1.5.1] - 2026-08-25 ### Changed