Description
OpenAPI 2.0 permits enum together with constraints such as minimum and maxLength, and all constraints apply. Redundant constraints complicate maintenance, while conflicting constraints can exclude values listed in enum.
Potential impact
- Updating an enum without updating another constraint can reject intended inputs.
- Expressing the same allowed range in several places makes the contract and implementation harder to maintain consistently.
Remediation
Review enum and its other constraints together. Remove only redundant constraints whose removal does not change the allowed values, and retain necessary constraints. Check intended values against the revised schema and align server-side input validation.
Examples
Every id value below satisfies minimum, and every name value fits maxLength. These are excerpts of definitions.
Before
json
{
"definitions": {
"Category": {
"type": "object",
"properties": {
"id": {
"type": "integer",
"minimum": 1,
"enum": [2, 3, 4, 5, 6]
},
"name": {
"type": "string",
"maxLength": 10,
"enum": ["Foo", "Bar"]
}
}
}
}
}
After
json
{
"definitions": {
"Category": {
"type": "object",
"properties": {
"id": {
"type": "integer",
"enum": [2, 3, 4, 5, 6]
},
"name": {
"type": "string",
"enum": ["Foo", "Bar"]
}
}
}
}
}
The second schema removes minimum and maxLength because they are redundant for these enum values. Both schemas permit the same values.