schema-no-additional-properties (Swagger 2.0 linter rule)

schema-no-additional-properties

Since 0.9.0 · fixed by --fix

This rule ensures that object schemas do not accept arbitrary additional properties.

Rule Details

An object schema accepts properties that are not listed in properties unless additionalProperties is false. Open objects hide typos in property names, and let undocumented data pass through the API.

The schema-no-additional-properties rule checks every schema of a Swagger 2.0 document with type: object (schemas with a $ref are checked where they are defined). It reports Object schema does not disable additional properties when additionalProperties is absent or true.

A schema value of additionalProperties describes a map whose values have that schema. This is a deliberate choice, and such schemas are not reported.

Configuration

None.

Examples

Good. Pet is closed, and Labels is a map of strings.

swagger: '2.0'
info:
  title: Pets
  version: 1.0.0
paths: {}
definitions:
  Pet:
    type: object
    additionalProperties: false
    properties:
      name:
        type: string
      labels:
        $ref: '#/definitions/Labels'
  Labels:
    type: object
    additionalProperties:
      type: string

Bad. Both Pet and its owner property accept any additional property.

swagger: '2.0'
info:
  title: Pets
  version: 1.0.0
paths: {}
definitions:
  Pet:
    type: object
    properties:
      name:
        type: string
      owner:
        type: object
        additionalProperties: true
        properties:
          name:
            type: string

Automatic fixes

When invoked with --fix, this rule sets additionalProperties: false on every reported schema.

When Not to Use It

You may disable this rule if your API deliberately accepts or returns properties that are not described, for example to stay compatible with future versions.

Compatibility

This rule is compatible with Swagger 2.0 documents. OpenAPI 3.x documents are linted by the OpenAPI linter, which has a rule of the same name.