Array has no type of the items defined
Issue ID: parameter-array-items-notype
Average severity: High
Description
One or more arrays in your API do not have the type of items they can contain specified.
Open API Specification (OAS) v2 requires the type
property for items
objects. However, most OAS v2 validators do not raise an error on items
that do not have type
set.
Example
The following is an example of how this type of risk could look in your API definition:
{
"parameters": [
{
"name": "ids",
"in": "query",
"description": "IDs to filter by",
"required": true,
"type": "array",
"items": {
"description": "ID of a specific user"
}
}
// ...
]
}
Possible exploit scenario
If an array does not specify type
property for the items
in it, users cannot tell the data type of items your API expects. The users may try to send data of unexpected type to your API, which could cause the backend server crash.
In addition, protection services based on OpenAPI definitions are not able to filter out items of unexpected data types. Attackers can try various types for the items, which again could crash the backend server.
When your backend server crashes, the error messages or exception trace could leak information on the implementation of your services. Attackers could then use to this information to make further attacks.
Remediation
Make sure your array definitions include the type
property in the items
field describing accepted items for the array:
{
"parameters": [
{
"name": "ids",
"in": "query",
"description": "IDs to filter by",
"required": true,
"type": "array",
"items": {
"type": "integer",
"description": "ID of a specific user"
}
}
// ...
]
}