When a schema component that has a string property is referenced only from GET endpoints, should Spectral flag it as an error?
Example Schema
paths:
/persons:
get:
responses:
'200':
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/person'
post:
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/createPerson'
components:
schemas:
person:
type: object
properties:
name:
type:string
createPerson:
type: object
required:
- name
properties:
name:
type:string
minLength: 1
maxLength: 1000
When linting this definition with Spectral, it is generating owasp:api4:2019-string-limit errors for the person.name property; if this schema is only being used on a GET endpoint, does specifying a maxLength provide any value? It's fine for writeable endpoints, where I have a specific request object.
Thinking about it, this probably also applies to owasp:api4:2019-array-limit
Current behaviour
Spectral will return the following error:
error owasp:api4:2019-string-limit Schema of type string must specify maxLength, enum, or const. components.schemas.person.properties.name
Expected behaviour
Spectral will not treat it as an error.
- Spectral: 6.8.0
- spectral-owasp-ruleset: 1.4.3
- Node: 18.16.0
When a schema component that has a string property is referenced only from
GETendpoints, should Spectral flag it as an error?Example Schema
When linting this definition with Spectral, it is generating
owasp:api4:2019-string-limiterrors for theperson.nameproperty; if this schema is only being used on aGETendpoint, does specifying amaxLengthprovide any value? It's fine for writeable endpoints, where I have a specific request object.Thinking about it, this probably also applies to
owasp:api4:2019-array-limitCurrent behaviour
Spectral will return the following error:
Expected behaviour
Spectral will not treat it as an error.