Skip to content

Commit c09d561

Browse files
fredriknordlandermmjohansson
fredriknordlander
and
mmjohansson
authored
Feature/356 sak15 (#360)
* feat: add rule DOK.06 Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * refactor: replace loops and use regex for word matching Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * test: add test suite for DOK.06 Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * refactor: convert targetVal to lower case before checks Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * style: add back missing commas Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * style: remove unused imports Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * chore: add license header to file Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * refactor: remove rule id from message Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> * feat: add new rule sak15 Signed-off-by: Fredrik Nordlander <fredrik.nordlander@digg.se> * fix: correct expression and remove invalid files Signed-off-by: Fredrik Nordlander <fredrik.nordlander@digg.se> * fix: correct given expression and remove invalid files Signed-off-by: Fredrik Nordlander <fredrik.nordlander@digg.se> --------- Signed-off-by: Mats Johansson <extern.mats.johansson@digg.se> Signed-off-by: Fredrik Nordlander <fredrik.nordlander@digg.se> Co-authored-by: Mats Johansson <extern.mats.johansson@digg.se>
1 parent ca76231 commit c09d561

File tree

8 files changed

+120
-12
lines changed

8 files changed

+120
-12
lines changed

‎GUIDELINES.md‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ Detta dokument specificerar reglerna som verktyget tillämpar.
7575
9. [Område: Säkerhet](#område-säkerhet)
7676
- [ID: SAK.09](#id-sak09)
7777
- [ID: SAK.10](#id-sak10)
78+
- [ID: SAK.15](#id-sak15)
7879
- [ID: SAK.18](#id-sak18)
7980
10. [Område: Förutsättningar](#område-förutsättningar)
8081
- [ID: FOR.02](#id-for02)
@@ -943,7 +944,7 @@ I exemplet ovan, så exemplifieras regeln med en kontroll av de query parametrar
943944

944945
## Område: Säkerhet
945946

946-
**Täckningsgrad: 9%**
947+
**Täckningsgrad: 11%**
947948

948949
### ID: SAK.09
949950

@@ -991,6 +992,29 @@ I exemplet ovan så kommer regeln att ge ett positivt utfall eftersom det finns
991992

992993
---
993994

995+
### ID: SAK.15
996+
997+
**Krav:** API-nycklar SKALL INTE inkluderas i URL eller querysträngen.
998+
999+
**Typ:** SKALL
1000+
1001+
**JSON Path Plus-uttryck:**
1002+
1003+
```
1004+
$.components.securitySchemes[?(@ && @.type=='apiKey')]
1005+
```
1006+
1007+
**Förklaring:**
1008+
Regeln kontrollerar, under förutsättning att ett security scheme är definierat, att om typen är 'apiKey', så får värdet för parametern 'in' inte vara 'query.
1009+
1010+
**Exempel:**
1011+
1012+
![alt text](images/sak15.png)
1013+
1014+
I exemplet ovan ger regeln ett negativt utfall, eftersom det definierade säkerhetsschemat 'ApiKeyQuery' har typen 'apiKey' och parametern 'in' är satt till 'query', vilket strider mot regeln.
1015+
1016+
---
1017+
9941018
### ID: SAK.18
9951019

9961020
**Krav:** OAuth version 2.0 eller senare BÖR användas för auktorisation.

‎REUSE.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ path = [
5050
"images/rest-api-profil.png",
5151
"images/sak09.png",
5252
"images/sak10.png",
53+
"images/sak15.png",
5354
"images/sak18.png",
5455
"images/ufn1-2.png",
5556
"images/ufn1.png",

‎apis/sak-api.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,13 @@ components:
115115
scopes:
116116
write:pets: modify pets in your account
117117
read:pets: read your pets
118+
#Test for invalid types in security schemes
119+
ApiKeyQuery:
120+
type: apiKey
121+
in: query
122+
name: api_key
123+
124+
118125
schemas:
119126
Error:
120127
type: object

‎images/sak15.png‎

13.9 KB
Loading

‎rulesets/DokRules.ts‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,9 @@
44

55
import { CustomProperties } from '../ruleinterface/CustomProperties.ts';
66
import { BaseRuleset } from './BaseRuleset.ts';
7-
import {
8-
enumeration,
9-
truthy,
10-
falsy,
11-
undefined as undefinedFunc,
12-
pattern,
13-
schema,
14-
defined,
15-
} from '@stoplight/spectral-functions';
7+
import { truthy, falsy, pattern } from '@stoplight/spectral-functions';
168
import { DiagnosticSeverity } from '@stoplight/types';
179
import { Dok03Base } from './rulesetUtil.ts';
18-
import path from 'path';
1910
import { Dok15Base } from './rulesetUtil.ts';
2011
const moduleName: string = 'DokRules.ts';
2112

‎rulesets/SakRules.ts‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,50 @@ export class Sak10 extends BaseRuleset {
9494
}
9595
severity = DiagnosticSeverity.Error;
9696
}
97+
export class Sak15 extends BaseRuleset {
98+
static customProperties: CustomProperties = {
99+
område: 'Säkerhet',
100+
id: 'SAK.15',
101+
};
102+
description = '-';
103+
message = 'API-nycklar SKALL INTE inkluderas i URL eller querysträngen';
104+
given =
105+
"$.components.securitySchemes[?(@ && @.type=='apiKey')]";
106+
then = [
107+
{
108+
function: (targetVal: any, _opts: any, paths: string[]) => {
109+
const result: any[] = [];
110+
111+
if (targetVal.in && targetVal.in.toLowerCase() === 'query') {
112+
result.push({
113+
message: 'API-nycklar SKALL INTE inkluderas i URL eller querysträngen.',
114+
severity: DiagnosticSeverity.Error,
115+
});
116+
}
117+
return result;
118+
},
119+
},
120+
{
121+
function: (targetVal: any, _opts: any, paths: string[]) => {
122+
this.trackRuleExecutionHandler(
123+
JSON.stringify(targetVal, null, 2),
124+
_opts,
125+
paths,
126+
this.severity,
127+
this.constructor.name,
128+
moduleName,
129+
Sak15.customProperties,
130+
);
131+
},
132+
},
133+
];
134+
constructor() {
135+
super();
136+
super.initializeFormats(['OAS3']);
137+
}
138+
severity = DiagnosticSeverity.Error;
139+
140+
}
97141
export class Sak18 extends BaseRuleset {
98142
static customProperties: CustomProperties = {
99143
område: 'Säkerhet',
@@ -130,4 +174,4 @@ export class Sak18 extends BaseRuleset {
130174
}
131175
severity = DiagnosticSeverity.Warning;
132176
}
133-
export default { Sak09, Sak10, Sak18 };
177+
export default { Sak09, Sak10, Sak15, Sak18 };

‎tests/sak.test.ts‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,46 @@ testRule('Sak10', [
107107
],
108108
},
109109
]);
110+
testRule('Sak15', [
111+
{
112+
name: 'giltigt testfall',
113+
document: {
114+
openapi: '3.1.0',
115+
info: { version: '1.0' },
116+
components: {
117+
securitySchemes: {
118+
ApiKeyQuery: {
119+
type: 'apiKey',
120+
in: 'header',
121+
},
122+
},
123+
},
124+
},
125+
errors: [],
126+
},
127+
{
128+
name: 'ogiltigt testfall',
129+
document: {
130+
openapi: '3.1.0',
131+
info: { version: '1.0' },
132+
components: {
133+
securitySchemes: {
134+
ApiKeyQuery: {
135+
type: 'apiKey',
136+
in: 'query',
137+
},
138+
},
139+
},
140+
},
141+
errors: [
142+
{
143+
message: 'API-nycklar SKALL INTE inkluderas i URL eller querysträngen',
144+
path: ['components', 'securitySchemes', 'ApiKeyQuery'],
145+
severity: DiagnosticSeverity.Error,
146+
},
147+
],
148+
},
149+
]);
110150
testRule('Sak18', [
111151
{
112152
name: 'giltigt testfall',

‎tests/util/rulesetTest.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ const ruleTypes = [
4545
UfnRules.Ufn09InPathParameters,
4646
SakRules.Sak09,
4747
SakRules.Sak10,
48+
SakRules.Sak15,
4849
SakRules.Sak18,
4950
VerRules.Ver05,
5051
VerRules.Ver06,

0 commit comments

Comments
 (0)