Fixes #49 by adding rules for JSON Schema unevaluatedProperties keyword

__tests__/owasp-api6-2019-no-unevaluatedProperties.test.ts

@@ -0,0 +1,79 @@
+import { DiagnosticSeverity } from "@stoplight/types";
+import testRule from "./__helpers__/helper";
+
+testRule("owasp:api6:2019-no-unevaluatedProperties", [
+
+  {
+    name: "valid case: oas3_1",
+    document: {
+      openapi: "3.1.0",
+      info: { version: "1.0" },
+      components: {
+        schemas: {
+          Foo: {
+            type: "object",
+            unevaluatedProperties: false,
+          },
+        },
+      },
+    },
+    errors: [],
+  },
+
+  {
+    name: "valid case: no unevaluatedProperties defined (oas3_1)",
+    document: {
+      openapi: "3.1.0",
+      info: { version: "1.0" },
+      components: {
+        schemas: {
+          Foo: {
+            type: "object",
+          },
+        },
+      },
+    },
+    errors: [],
+  },
+
+  {
+    name: "valid case: unevaluatedProperties set to false (oas3_1)",
+    document: {
+      openapi: "3.1.0",
+      info: { version: "1.0" },
+      components: {
+        schemas: {
+          Foo: {
+            type: "object",
+            unevaluatedProperties: false,
+          },
+        },
+      },
+    },
+    errors: [{}],
+  },
+
+  {
+    name: "invalid case: unevaluatedProperties set to true (oas3_1)",
+    document: {
+      openapi: "3.1.0",
+      info: { version: "1.0" },
+      components: {
+        schemas: {
+          Foo: {
+            type: "object",
+            unevaluatedProperties: true,
+          },
+        },
+      },
+    },
+    errors: [
+      {
+        message:
+          "If the unevaluatedProperties keyword is used it must be set to false.",
+        path: ["components", "schemas", "Foo", "unevaluatedProperties"],
+        severity: DiagnosticSeverity.Warning,
+      },
+    ],
+  },
+]);

src/ruleset.ts

@@ -691,6 +691,27 @@ export default {
       ],
     },
 
+    /**
+     * @author: David Biesack <https://github.com/DavidBiesack>,
+     * derived from owasp:api6:2019-no-additionalProperties
+     * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
+     */
+    "owasp:api6:2019-no-unevaluatedProperties": {
+      message:
+        "If the unevaluatedProperties keyword is used it must be set to false.",
+      description:
+        "By default JSON Schema allows unevaluated properties, which can potentially lead to mass assignment issues, where unspecified fields are passed to the API without validation. Disable them with `unevaluatedProperties: false` or add `maxProperties`.",
+      severity: DiagnosticSeverity.Warning,
+      formats: [oas3_1],
+      given: '$..[?(@ && @.type=="object" && @.unevaluatedProperties)]',
+      then: [
+        {
+          field: "unevaluatedProperties",
+          function: falsy,
+        },
+      ],
+    },
+
     /**
      * @author: Roberto Polli <https://github.com/ioggstream>
      * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
@@ -711,6 +732,27 @@ export default {
       ],
     },
 
+    /**
+     * @author: David Biesack <https://github.com/DavidBiesack>,
+     * derived from owasp:api6:2019-constrained-additionalProperties
+     * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
+     */
+    "owasp:api6:2019-constrained-unevaluatedProperties": {
+      message: "Objects should not allow unconstrained unevaluatedProperties.",
+      description:
+        "By default JSON Schema allows unevaluated properties, which can potentially lead to mass assignment issues, where unspecified fields are passed to the API without validation. Disable them with `unevaluatedProperties: false` or add `maxProperties`",
+      severity: DiagnosticSeverity.Warning,
+      formats: [oas3_1],
+      given:
+        '$..[?(@ && @.type=="object" && @.unevaluatedProperties &&  @.unevaluatedProperties!=true &&  @.unevaluatedProperties!=false )]',
+      then: [
+        {
+          field: "maxProperties",
+          function: defined,
+        },
+      ],
+    },
+
     /**
      * API7:2019 — Security misconfiguration
      *