Problem description
S-313 (owasp:api4:2023-string-restricted) fires on components.headers.link.schema in CAMARA_common.yaml — the RFC 8288 pagination Link header (type: string, maxLength: 8192). A Link value is a list of <uri>; rel="…", so no format, pattern or enum applies; it belongs to the same known-unactionable class as the common-library fields already listed under suppress_schema_paths for S-313. It was missed because every existing entry is a components.schemas.* path and this is a header object. Seven API definitions in six repositories reference the header today (ConnectedNetworkType, DedicatedNetworks ×2, DeviceDataVolume, DeviceRoamingStatus, DeviceReachabilityStatus, SimSwap) and inherit a hint on an artifact they do not own.
Expected behavior
Add components.headers.link.schema to suppress_schema_paths of S-313 in validation/rules/spectral-rules.yaml. Then recapture .regression/regression-expected.yaml on all eleven regression/* branches of camaraproject/ReleaseTest with validation/scripts/regression_runner.py --capture — each loses one S-313 / code/common/CAMARA_common.yaml entry and one hint. The branches validate at tooling@main, so merge before capturing. S-313 keeps its pin on regression/r4.3-main-baseline, so tested_rules and summary.total_tested are unchanged.
Alternative solution
Constrain the header in Commonalities — rejected: no sensible pattern exists for an RFC 8288 value, and a wrong one would reject valid headers.
Additional context
The four remaining S-313 hints on the baseline (CreateResource.properties.name, Resource.properties.name in the sample specs) are deliberately out of scope: those are the sample APIs' own schemas, and a real API's equivalent field sits at a different schema path, so an allowlist entry there would generalise to nothing.
Found while classifying the lint warnings of the common artifacts (camaraproject/Commonalities#676).
Problem description
S-313 (
owasp:api4:2023-string-restricted) fires oncomponents.headers.link.schemainCAMARA_common.yaml— the RFC 8288 paginationLinkheader (type: string,maxLength: 8192). ALinkvalue is a list of<uri>; rel="…", so noformat,patternorenumapplies; it belongs to the same known-unactionable class as the common-library fields already listed undersuppress_schema_pathsfor S-313. It was missed because every existing entry is acomponents.schemas.*path and this is a header object. Seven API definitions in six repositories reference the header today (ConnectedNetworkType, DedicatedNetworks ×2, DeviceDataVolume, DeviceRoamingStatus, DeviceReachabilityStatus, SimSwap) and inherit a hint on an artifact they do not own.Expected behavior
Add
components.headers.link.schematosuppress_schema_pathsof S-313 invalidation/rules/spectral-rules.yaml. Then recapture.regression/regression-expected.yamlon all elevenregression/*branches ofcamaraproject/ReleaseTestwithvalidation/scripts/regression_runner.py --capture— each loses oneS-313/code/common/CAMARA_common.yamlentry and one hint. The branches validate attooling@main, so merge before capturing. S-313 keeps its pin onregression/r4.3-main-baseline, sotested_rulesandsummary.total_testedare unchanged.Alternative solution
Constrain the header in Commonalities — rejected: no sensible pattern exists for an RFC 8288 value, and a wrong one would reject valid headers.
Additional context
The four remaining S-313 hints on the baseline (
CreateResource.properties.name,Resource.properties.namein the sample specs) are deliberately out of scope: those are the sample APIs' own schemas, and a real API's equivalent field sits at a different schema path, so an allowlist entry there would generalise to nothing.Found while classifying the lint warnings of the common artifacts (camaraproject/Commonalities#676).