schema-no-additional-properties (AsyncAPI linter rule)

schema-no-additional-properties

Since 0.9.0 · fixed by --fix

This rule ensures that object schemas explicitly disallow additional properties.

Rule Details

By default, JSON Schema allows objects to contain properties that are not listed in properties. Messages containing unexpected properties are then considered valid, which hides typos and makes it easy to leak data that was never meant to be published.

The schema-no-additional-properties rule reports Object schema does not disable additional properties for every schema of type object that does not have additionalProperties: false.

Configuration

None.

Examples

Good.

asyncapi: 3.0.0
info:
  title: User Events
  version: 1.0.0
components:
  schemas:
    UserSignedUp:
      type: object
      properties:
        user_id:
          type: string
      additionalProperties: false

Bad.

asyncapi: 3.0.0
info:
  title: User Events
  version: 1.0.0
components:
  schemas:
    UserSignedUp:
      type: object
      properties:
        user_id:
          type: string

Automatic fixes

When invoked with --fix, this rule sets additionalProperties: false on every reported schema, replacing any other value of additionalProperties.

When Not to Use It

You may disable this rule if your messages are designed to be extensible, or if consumers are expected to ignore unknown properties.

Compatibility

This rule is compatible with AsyncAPI 3.x documents. AsyncAPI 2.x documents are rejected by the reader and are not linted.