Schema does not define the type of JSON values

Average severity: Medium

Description

The API defines a schema for a JSON payload. However, the schema does not define the types of the values in it.

Example

The following is an example of how this type of risk could look in your API definition:

"post": {
  "description": "Creates a new pet in the store",
  "operationId": "addPet",
  "parameters": [
    {
      "name": "pet",
      "in": "body",
      "description": "pet to add to the system",
      "required": true,
      "schema": {
        "$ref": "#/definitions/NewPet"
      }
    }
  ]
}
...
"definitions": {
  "NewPet": {
    "type": "object",
    "required": [
      "name"
    ],
    "properties": {
      "name": {
        "description": "Pet name"
      },
      "tag": {
        "description": "Pet tag"
      }
    }
  }
}

Here, the specific object NewPet is defined in the definitions section and referenced as the schema for the API method. However, the types of the properties in the object (name and tag) are not defined.

Possible exploit scenario

If you do not specify the types of the properties in the JSON payload, you effectively allow attackers to pass in any data. This opens your backend to various attacks, such as SQL injection.

This also lets attackers to try various unexpected inputs. Unexpected inputs may cause the backend server to crash or behave in an unexpected way. This in turn may cause the server to potentially leak stack trace that can be used for further attacks, or even data.

Remediation

Make sure you define all properties of JSON payloads. Here, the types of the properties name and tag in the object NewPet are defined as string:

"post": {
  "description": "Creates a new pet in the store",
  "operationId": "addPet",
  "parameters": [
    {
      "name": "pet",
      "in": "body",
      "description": "pet to add to the system",
      "required": true,
      "schema": {
        "$ref": "#/definitions/NewPet"
      }
    }
  ]
}
...
"definitions": {
  "NewPet": {
    "type": "object",
    "required": [
      "name"
    ],
    "properties": {
      "name": {
        "type": "string"
      },
      "tag": {
        "type": "string"
      }
    }
  }
}

 

 


Get API Security news directly in your Inbox.

By clicking Subscribe you agree to our Data Policy