OAS Security Considerations

[darrelmiller]

Aimed at the tooling creators to protect the users of their tools from maliciously created OAS descriptions.

• loading external references
• JSON Schemas use of regex
• markdown content in descriptions. e.g. HTML scripts
• Parsers must detect infinite loops
• YAML - JSON Schema Subset
• Server Urls
• Information considered sensitive can be filtered out for a target audience

[kevinswiber]

OAS inherits security considerations from YAML and JSON.

JSON Security Considerations from RFC 8259

YAML billion laughs attack

lol1: &lol1 ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
lol2: &lol2 [*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1]
lol3: &lol3 [*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2]
lol4: &lol4 [*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3]
lol5: &lol5 [*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4]
lol6: &lol6 [*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5]
lol7: &lol7 [*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6]
lol8: &lol8 [*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7]
lol9: &lol9 [*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8]
lolz: &lolz [*lol9]

[MikeRalphson]

Incorrect input sanitization in code-generator tools can result in generated code being poisoned. See https://github.com/Mermade/openapi3-examples/tree/master/3.0/malicious