UNPKG

@stoplight/spectral-owasp-ruleset

Version:

Probably don't want to beg hackers to come and take your stuff.

682 lines (679 loc) 28.2 kB
import * as _stoplight_spectral_functions from '@stoplight/spectral-functions'; import * as _stoplight_spectral_core from '@stoplight/spectral-core'; import { DiagnosticSeverity } from '@stoplight/types'; declare const _default: { formats: _stoplight_spectral_core.Format<void>[]; aliases: { ArrayProperties: { targets: { formats: _stoplight_spectral_core.Format<void>[]; given: string[]; }[]; }; IntegerProperties: { targets: { formats: _stoplight_spectral_core.Format<void>[]; given: string[]; }[]; }; StringProperties: { targets: { formats: _stoplight_spectral_core.Format<void>[]; given: string[]; }[]; }; }; rules: { /** * API1:2023 - Broken Object Level Authorization * https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ * * Use case * - API call parameters use the ID of the resource accessed through the API /api/shop1/financial_info. * - Attackers replace the IDs of their resources with a different one which they guessed through /api/shop2/financial_info. * - The API does not check permissions and lets the call through. * - Problem is aggravated if IDs can be enumerated /api/123/financial_info. * * How to prevent * - Implement authorization checks with user policies and hierarchy. * - Do not rely on IDs that the client sends. Use IDs stored in the session object instead. * - Check authorization for each client request to access database. * - Use random IDs that cannot be guessed (UUIDs). */ /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api1:2023-no-numeric-ids": { description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>; functionOptions: { schema: { type: string; not: { properties: { type: { const: string; }; }; }; }; }; }; }; /** * API2:2023 Broken Authentication * https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ * * Use case * - Unprotected APIs that are considered “internal” * - Weak authentication that does not follow industry best practices * - Weak API keys that are not rotated * - Passwords that are weak, plain text, encrypted, poorly hashed, shared, or default passwords * - 🤷 Authentication susceptible to brute force attacks and credential stuffing * - Credentials and keys included in URLs * - Lack of access token validation (including JWT validation) * - Unsigned or weakly signed non-expiring JWTs * * How to prevent * - APIs for password reset and one-time links also allow users to authenticate, and should be protected just as rigorously. * - Use standard authentication, token generation, password storage, and multi-factor authentication (MFA). * - Use short-lived access tokens. * - Authenticate your apps (so you know who is talking to you). * - Use stricter rate-limiting for authentication, and implement lockout policies and weak password checks. */ /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api2:2023-no-http-basic": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { notMatch: string; }; }; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/rules/secrets-parameters.yml */ "owasp:api2:2023-no-api-keys-in-url": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string[]; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { notMatch: string; }; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/rules/secrets-parameters.yml */ "owasp:api2:2023-no-credentials-in-url": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string[]; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { notMatch: string; }; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/securitySchemes_insecure.yml#L38 */ "owasp:api2:2023-auth-insecure-schemes": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string[]; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { notMatch: string; }; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/securitySchemes.yml */ "owasp:api2:2023-jwt-best-practices": { message: string; description: string; severity: DiagnosticSeverity; given: string[]; then: ({ field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; functionOptions?: undefined; } | { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { match: string; }; })[]; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api2:2023-short-lived-access-tokens": { message: string; description: string; severity: DiagnosticSeverity; given: string[]; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/security.yml */ "owasp:api2:2023-write-restricted": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>; functionOptions: { schemesPath: string[]; methods: string[]; }; }[]; }; "owasp:api2:2023-read-restricted": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>; functionOptions: { schemesPath: string[]; nullable: boolean; methods: string[]; }; }[]; }; /** * API3:2023 Broken Object Property Level Authorization * https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/ * * Use case * - APIs expose endpoints that return all object’s properties. * - Unauthorized access to private/sensitive object properties may result in data disclosure, data loss, or data corruption. Under certain circumstances, unauthorized access to object properties can lead to privilege escalation or partial/full account takeover. * - 🟠 The API endpoint exposes properties of an object that are considered sensitive and should not be read by the user. * - The API endpoint allows a user to change, add/or delete the value of a sensitive object's property which the user should not be able to access * * How to prevent * - Carefully define schemas for all the API responses (restricting unknown properties) * - 🟠 Identify all the sensitive data or Personally Identifiable Information (PII), and justify its use. * https://github.com/stoplightio/spectral-owasp-ruleset/issues/11 * - Enforce response checks to prevent accidental leaks of data or exceptions. */ /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml */ "owasp:api3:2023-no-additionalProperties": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml */ "owasp:api3:2023-constrained-additionalProperties": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml */ "owasp:api3:2023-no-unevaluatedProperties": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml */ "owasp:api3:2023-constrained-unevaluatedProperties": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * API4:2023 - Unrestricted Resource Consumption * https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/ * * Use case * - Attackers overload the API by sending more requests than it can handle. * - Attackers send requests at a rate exceeding the API's processing speed, clogging it up. * - The size of the requests or some fields in them exceed what the API can process. * - 🟠 “Zip bombs”, archive files that have been designed so that unpacking them takes excessive amount of resources and overloads the API. * * How to prevent * - Define proper rate limiting. * - Limit maximums on request parameter sizes * - Tailor the rate limiting to be match what API methods, clients, or addresses need or should be allowed to get. * - Add checks on compression ratios. * - Define limits for container resources. * - 🟠 Look for Zip uploads and warn about setting max file size? how do we know if they did? Demand something in the description? */ /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-rate-limit": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>; functionOptions: { schema: { type: string; oneOf: { required: string[]; }[]; }; }; }; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-rate-limit-retry-after": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }; }; /** * @author: Jason Harmon <https://github.com/jharmn> */ "owasp:api4:2023-rate-limit-responses-429": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Roberto Polli <https://github.com/ioggstream> * @see: https://github.com/italia/api-oas-checker/blob/master/security/array.yml */ "owasp:api4:2023-array-limit": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-string-limit": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>; functionOptions: { schema: { type: string; anyOf: { required: string[]; }[]; }; }; }; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-string-restricted": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>; functionOptions: { schema: { type: string; anyOf: { required: string[]; }[]; }; }; }; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-integer-limit": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<Record<string, unknown>, _stoplight_spectral_functions.XorOptions>; functionOptions: { properties: string[]; }; }[]; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-integer-limit-legacy": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api4:2023-integer-format": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * API5:2023 Broken function level authorization * https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/ * * - Don’t assume that an API endpoint is regular or administrative only based on the URL path. * - Do not rely on the client to enforce admin access. * - Deny all access by default api2:2023-protection- */ "owasp:api5:2023-admin-security-unique": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>; functionOptions: { adminUrl: string; }; }[]; }; /** * API6:2023 - Unrestricted Access to Sensitive Business Flows * https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/ * * Use case * * - Purchasing a product flow - an attacker can buy all the stock of a * high-demand item at once and resell for a higher price (scalping) * - Creating a comment/post flow - an attacker can spam the system * - Making a reservation - an attacker can reserve all the available time * slots and prevent other users from using the system * * How to prevent * * - Device fingerprinting: denying service to unexpected client devices * (e.g headless browsers) tends to make threat actors use more * sophisticated solutions, thus more costly for them * - Human detection: using either captcha or more advanced biometric * solutions (e.g. typing patterns) * - Non-human patterns: analyze the user flow to detect non-human patterns * (e.g. the user accessed the "add to cart" and "complete purchase" * functions in less than one second) * - Consider blocking IP addresses of Tor exit nodes and well-known proxies */ /** * API7:2023 Server Side Request Forgery * https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/ * * Modern concepts encourage developers to access an external resource based * on user input: Webhooks, file fetching from URLs, custom SSO, and URL * previews. * */ "owasp:api7:2023-concerning-url-parameter": { message: string; description: string; severity: DiagnosticSeverity; given: string[]; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { notMatch: RegExp; }; }; }; /** * API8:2023 Security Misconfiguration * https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/ * * Poor configuration of the API servers allows attackers to exploit them. * * Use case * - Unpatched systems * - Unprotected files and directories * - Unhardened images * - Missing, outdated, or misconfigured TLS * - Exposed storage or server management panels * - Missing CORS policy or security headers * - 🟠 Error messages with stack traces * https://github.com/stoplightio/spectral-owasp-ruleset/issues/12 * - Unnecessary features enabled * */ /** * @author: Phil Sturgeon (https://github.com/philsturgeon) */ "owasp:api8:2023-define-cors-origin": { message: string; description: string; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }; severity: DiagnosticSeverity; }; /** * @author: Andrzej <https://github.com/jerzyn> */ "owasp:api8:2023-no-scheme-http": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>; functionOptions: { schema: { type: string; enum: string[]; }; }; }; }; /** * @author: Andrzej <https://github.com/jerzyn> */ "owasp:api8:2023-no-server-http": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { notMatch: string; }; }; }; /** * @author: Jason Harmon <https://github.com/jharmn> */ "owasp:api8:2023-define-error-validation": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>; functionOptions: { schema: { type: string; anyOf: { required: string[]; }[]; }; }; }[]; }; /** * @author: Jason Harmon <https://github.com/jharmn> */ "owasp:api8:2023-define-error-responses-401": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * @author: Jason Harmon <https://github.com/jharmn> */ "owasp:api8:2023-define-error-responses-500": { message: string; description: string; severity: DiagnosticSeverity; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }[]; }; /** * API9:2023 Improper Inventory Management * https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/ * * How to prevent * - 🟠 Servers, define which environment is the API running in (e.g. production, staging, test, development) * - Require servers use x-internal true/false to explicitly explain what is public or internal for documentation tools * - 🤷‍♂️ There is no retirement plan for each API version. */ /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api9:2023-inventory-access": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>; }; }; /** * @author: Phil Sturgeon <https://github.com/philsturgeon> */ "owasp:api9:2023-inventory-environment": { message: string; description: string; severity: DiagnosticSeverity; formats: _stoplight_spectral_core.Format<void>[]; given: string; then: { field: string; function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>; functionOptions: { match: string; }; }; }; }; }; export { _default as default };