@stoplight/spectral-owasp-ruleset
Version:
Probably don't want to beg hackers to come and take your stuff.
682 lines (679 loc) • 28.2 kB
TypeScript
import * as _stoplight_spectral_functions from '@stoplight/spectral-functions';
import * as _stoplight_spectral_core from '@stoplight/spectral-core';
import { DiagnosticSeverity } from '@stoplight/types';
declare const _default: {
formats: _stoplight_spectral_core.Format<void>[];
aliases: {
ArrayProperties: {
targets: {
formats: _stoplight_spectral_core.Format<void>[];
given: string[];
}[];
};
IntegerProperties: {
targets: {
formats: _stoplight_spectral_core.Format<void>[];
given: string[];
}[];
};
StringProperties: {
targets: {
formats: _stoplight_spectral_core.Format<void>[];
given: string[];
}[];
};
};
rules: {
/**
* API1:2023 - Broken Object Level Authorization
* https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
*
* Use case
* - ❌ API call parameters use the ID of the resource accessed through the API /api/shop1/financial_info.
* - ❌ Attackers replace the IDs of their resources with a different one which they guessed through /api/shop2/financial_info.
* - ❌ The API does not check permissions and lets the call through.
* - ✅ Problem is aggravated if IDs can be enumerated /api/123/financial_info.
*
* How to prevent
* - ❌ Implement authorization checks with user policies and hierarchy.
* - ❌ Do not rely on IDs that the client sends. Use IDs stored in the session object instead.
* - ❌ Check authorization for each client request to access database.
* - ✅ Use random IDs that cannot be guessed (UUIDs).
*/
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api1:2023-no-numeric-ids": {
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
functionOptions: {
schema: {
type: string;
not: {
properties: {
type: {
const: string;
};
};
};
};
};
};
};
/**
* API2:2023 — Broken Authentication
* https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/
*
* Use case
* - ✅ Unprotected APIs that are considered “internal”
* - ✅ Weak authentication that does not follow industry best practices
* - ✅ Weak API keys that are not rotated
* - ❌ Passwords that are weak, plain text, encrypted, poorly hashed, shared, or default passwords
* - 🤷 Authentication susceptible to brute force attacks and credential stuffing
* - ✅ Credentials and keys included in URLs
* - ✅ Lack of access token validation (including JWT validation)
* - ✅ Unsigned or weakly signed non-expiring JWTs
*
* How to prevent
* - ❌ APIs for password reset and one-time links also allow users to authenticate, and should be protected just as rigorously.
* - ✅ Use standard authentication, token generation, password storage, and multi-factor authentication (MFA).
* - ✅ Use short-lived access tokens.
* - ✅ Authenticate your apps (so you know who is talking to you).
* - ❌ Use stricter rate-limiting for authentication, and implement lockout policies and weak password checks.
*/
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api2:2023-no-http-basic": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
notMatch: string;
};
};
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/rules/secrets-parameters.yml
*/
"owasp:api2:2023-no-api-keys-in-url": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string[];
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
notMatch: string;
};
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/rules/secrets-parameters.yml
*/
"owasp:api2:2023-no-credentials-in-url": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string[];
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
notMatch: string;
};
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/securitySchemes_insecure.yml#L38
*/
"owasp:api2:2023-auth-insecure-schemes": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string[];
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
notMatch: string;
};
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/securitySchemes.yml
*/
"owasp:api2:2023-jwt-best-practices": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string[];
then: ({
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
functionOptions?: undefined;
} | {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
match: string;
};
})[];
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api2:2023-short-lived-access-tokens": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string[];
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/security.yml
*/
"owasp:api2:2023-write-restricted": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>;
functionOptions: {
schemesPath: string[];
methods: string[];
};
}[];
};
"owasp:api2:2023-read-restricted": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>;
functionOptions: {
schemesPath: string[];
nullable: boolean;
methods: string[];
};
}[];
};
/**
* API3:2023 Broken Object Property Level Authorization
* https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/
*
* Use case
* - ❌ APIs expose endpoints that return all object’s properties.
* - ❌ Unauthorized access to private/sensitive object properties may result in data disclosure, data loss, or data corruption. Under certain circumstances, unauthorized access to object properties can lead to privilege escalation or partial/full account takeover.
* - 🟠 The API endpoint exposes properties of an object that are considered sensitive and should not be read by the user.
* - ✅ The API endpoint allows a user to change, add/or delete the value of a sensitive object's property which the user should not be able to access
*
* How to prevent
* - ✅ Carefully define schemas for all the API responses (restricting unknown properties)
* - 🟠 Identify all the sensitive data or Personally Identifiable Information (PII), and justify its use.
* https://github.com/stoplightio/spectral-owasp-ruleset/issues/11
* - ❌ Enforce response checks to prevent accidental leaks of data or exceptions.
*/
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
*/
"owasp:api3:2023-no-additionalProperties": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
*/
"owasp:api3:2023-constrained-additionalProperties": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
*/
"owasp:api3:2023-no-unevaluatedProperties": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
*/
"owasp:api3:2023-constrained-unevaluatedProperties": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* API4:2023 - Unrestricted Resource Consumption
* https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/
*
* Use case
* - ✅ Attackers overload the API by sending more requests than it can handle.
* - ✅ Attackers send requests at a rate exceeding the API's processing speed, clogging it up.
* - ✅ The size of the requests or some fields in them exceed what the API can process.
* - 🟠 “Zip bombs”, archive files that have been designed so that unpacking them takes excessive amount of resources and overloads the API.
*
* How to prevent
* - ✅ Define proper rate limiting.
* - ✅ Limit maximums on request parameter sizes
* - ❌ Tailor the rate limiting to be match what API methods, clients, or addresses need or should be allowed to get.
* - ❌ Add checks on compression ratios.
* - ❌ Define limits for container resources.
* - 🟠 Look for Zip uploads and warn about setting max file size? how do we know if they did? Demand something in the description?
*/
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-rate-limit": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
functionOptions: {
schema: {
type: string;
oneOf: {
required: string[];
}[];
};
};
};
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-rate-limit-retry-after": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
};
};
/**
* @author: Jason Harmon <https://github.com/jharmn>
*/
"owasp:api4:2023-rate-limit-responses-429": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Roberto Polli <https://github.com/ioggstream>
* @see: https://github.com/italia/api-oas-checker/blob/master/security/array.yml
*/
"owasp:api4:2023-array-limit": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
};
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-string-limit": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
functionOptions: {
schema: {
type: string;
anyOf: {
required: string[];
}[];
};
};
};
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-string-restricted": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
functionOptions: {
schema: {
type: string;
anyOf: {
required: string[];
}[];
};
};
};
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-integer-limit": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<Record<string, unknown>, _stoplight_spectral_functions.XorOptions>;
functionOptions: {
properties: string[];
};
}[];
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-integer-limit-legacy": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api4:2023-integer-format": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* API5:2023 — Broken function level authorization
* https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/
*
* - ✅ Don’t assume that an API endpoint is regular or administrative only based on the URL path.
* - ❌ Do not rely on the client to enforce admin access.
* - ✅ Deny all access by default api2:2023-protection-
*/
"owasp:api5:2023-admin-security-unique": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>;
functionOptions: {
adminUrl: string;
};
}[];
};
/**
* API6:2023 - Unrestricted Access to Sensitive Business Flows
* https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/
*
* Use case
*
* - ❌ Purchasing a product flow - an attacker can buy all the stock of a
* high-demand item at once and resell for a higher price (scalping)
* - ❌ Creating a comment/post flow - an attacker can spam the system
* - ❌ Making a reservation - an attacker can reserve all the available time
* slots and prevent other users from using the system
*
* How to prevent
*
* - Device fingerprinting: denying service to unexpected client devices
* (e.g headless browsers) tends to make threat actors use more
* sophisticated solutions, thus more costly for them
* - Human detection: using either captcha or more advanced biometric
* solutions (e.g. typing patterns)
* - Non-human patterns: analyze the user flow to detect non-human patterns
* (e.g. the user accessed the "add to cart" and "complete purchase"
* functions in less than one second)
* - Consider blocking IP addresses of Tor exit nodes and well-known proxies
*/
/**
* API7:2023 — Server Side Request Forgery
* https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/
*
* Modern concepts encourage developers to access an external resource based
* on user input: Webhooks, file fetching from URLs, custom SSO, and URL
* previews.
*
*/
"owasp:api7:2023-concerning-url-parameter": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string[];
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
notMatch: RegExp;
};
};
};
/**
* API8:2023 — Security Misconfiguration
* https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/
*
* Poor configuration of the API servers allows attackers to exploit them.
*
* Use case
* - ❌ Unpatched systems
* - ❌ Unprotected files and directories
* - ❌ Unhardened images
* - ✅ Missing, outdated, or misconfigured TLS
* - ❌ Exposed storage or server management panels
* - ✅ Missing CORS policy or security headers
* - 🟠 Error messages with stack traces
* https://github.com/stoplightio/spectral-owasp-ruleset/issues/12
* - ❌ Unnecessary features enabled
*
*/
/**
* @author: Phil Sturgeon (https://github.com/philsturgeon)
*/
"owasp:api8:2023-define-cors-origin": {
message: string;
description: string;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
};
severity: DiagnosticSeverity;
};
/**
* @author: Andrzej <https://github.com/jerzyn>
*/
"owasp:api8:2023-no-scheme-http": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
functionOptions: {
schema: {
type: string;
enum: string[];
};
};
};
};
/**
* @author: Andrzej <https://github.com/jerzyn>
*/
"owasp:api8:2023-no-server-http": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
notMatch: string;
};
};
};
/**
* @author: Jason Harmon <https://github.com/jharmn>
*/
"owasp:api8:2023-define-error-validation": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
functionOptions: {
schema: {
type: string;
anyOf: {
required: string[];
}[];
};
};
}[];
};
/**
* @author: Jason Harmon <https://github.com/jharmn>
*/
"owasp:api8:2023-define-error-responses-401": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* @author: Jason Harmon <https://github.com/jharmn>
*/
"owasp:api8:2023-define-error-responses-500": {
message: string;
description: string;
severity: DiagnosticSeverity;
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
}[];
};
/**
* API9:2023 Improper Inventory Management
* https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/
*
* How to prevent
* - 🟠 Servers, define which environment is the API running in (e.g. production, staging, test, development)
* - ✅ Require servers use x-internal true/false to explicitly explain what is public or internal for documentation tools
* - 🤷♂️ There is no retirement plan for each API version.
*/
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api9:2023-inventory-access": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
};
};
/**
* @author: Phil Sturgeon <https://github.com/philsturgeon>
*/
"owasp:api9:2023-inventory-environment": {
message: string;
description: string;
severity: DiagnosticSeverity;
formats: _stoplight_spectral_core.Format<void>[];
given: string;
then: {
field: string;
function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
functionOptions: {
match: string;
};
};
};
};
};
export { _default as default };