blst-security / cherrybomb

Is your feature request related to a problem? Please describe.
{type: number, format: int32} is not ideal OAS 3.0.3, as it defines a format which should be an integer, but uses type: number when the type: integer should be used.

As it is ambiguous, the validator should emit an error of some sort, as openapi tools are very likely to either ignore either type or format, or fail when trying to combined the two.

An example of a tool which silently ignores the format is oxidecomputer/progenitor#266

Describe the solution you'd like
Detect type: number and a integer format, and type: integer and a float format.

https://github.com/zalando/zally (Kotlin) does detect this as rule MUST define a format for number and integer types

Describe alternatives you've considered

Additional context

Hey @jayvdb

Thanks for the feature suggestion!

We're thinking about adding a new passive check that will check for integrity of types, is that what you had in mind?

Yes

Great then!

We're adding this to our future development plans, thanks for the suggestion :)

Hey @jayvdb

Just wanted to let you know we're adding the new passive check to Cherrybomb, this is the link to the PR: #97

Thanks again for the suggestion :)

Hii @jayvdb
Just wanted to let you know that there is a new passive check that responds to your feature suggestion:

cherrybomb/cherrybomb-engine/src/scan/passive/additions_checks.rs

Line 39 in b2eb8b4

pub fn check_int_type(&self) -> Vec<Alert> {

I close this issue

{type: number, format: int32} should be a validation error