-
Notifications
You must be signed in to change notification settings - Fork 9.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Co-authored-by: Asbjørn Ulsberg <[email protected]>
- Loading branch information
1 parent
9996d4f
commit cb85ba0
Showing
1 changed file
with
1 addition
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,6 @@ | ||
# Security Considerations | ||
|
||
OpenAPI documents use JSON, YAML and JSON Schema and therefore share their same security considerations. [JSON Schema Core](https://json-schema.org/draft/2020-12/json-schema-core#section-13) [JSON Schema Validation](https://json-schema.org/draft/2020-12/json-schema-validation#name-security-considerations) [YAML](https://www.ietf.org/archive/id/draft-ietf-httpapi-yaml-mediatypes-10.html) [JSON](https://www.rfc-editor.org/rfc/rfc8259) | ||
In additional, OpenAPI documents are processed by a wide variety of tooling for numerous different purposes, such as client code generation, documentation generation, service side routing, and API testing. OpenAPI document authors must consider the risks of the scenarios where the OpenAPI document may be used. | ||
In additional, OpenAPI documents are processed by a wide variety of tooling for numerous different purposes, such as client code generation, documentation generation, server side routing, and API testing. OpenAPI document authors must consider the risks of the scenarios where the OpenAPI document may be used. | ||
OpenAPIs document may contain references to external resources that may be dereferenced automatically by consuming tools. References in an OpenAPI document, or across OpenAPI documents may cause a cycle. Tooling must detect and handle cycles to prevent resource exhaustion. | ||
Certain properties allow the use of Markdown which can contain HTML including script. It is the responsibility of tooling to appropriately sanitize the Markdown. |