Skip to content

fix(query): fix false positive in schema_required_property_undefined#8082

Open
haroldb1 wants to merge 1 commit into
Checkmarx:masterfrom
haroldb1:fix/8081-schema-required-property-undefined
Open

fix(query): fix false positive in schema_required_property_undefined#8082
haroldb1 wants to merge 1 commit into
Checkmarx:masterfrom
haroldb1:fix/8081-schema-required-property-undefined

Conversation

@haroldb1

Copy link
Copy Markdown

…when sole required property

The predicate all([property | property != requiredProperty; _ := schema.properties[property]]) was logically inverted, producing two failure modes:

  • False positive: when requiredProperty is the only entry in properties, the comprehension yields [] and all([]) is vacuously true — the rule fires even though the property is correctly defined.

  • False negative: when requiredProperty is genuinely absent but sibling properties exist, the comprehension yields a non-empty list of strings and all(["sibling"]) is false — the rule does not fire, missing a real violation.

Replace with a direct absence check: not schema.properties[requiredProperty] This evaluates to true if and only if the required property has no entry in properties, regardless of how many siblings exist.

Fixes #8081

Tests:

  • negative7.yaml: sole required property present — must not fire (was false positive)
  • positive7.yaml: required property absent with sibling present — must fire (was false negative)
  • All six existing positive fixtures continue to fire (regression-checked locally)

Closes #

Reason for Proposed Changes

Proposed Changes

I submit this contribution under the Apache-2.0 license.

…when sole required property

The predicate `all([property | property != requiredProperty; _ := schema.properties[property]])`
was logically inverted, producing two failure modes:

- False positive: when `requiredProperty` is the only entry in `properties`, the
  comprehension yields `[]` and `all([])` is vacuously true — the rule fires even
  though the property is correctly defined.

- False negative: when `requiredProperty` is genuinely absent but sibling properties
  exist, the comprehension yields a non-empty list of strings and `all(["sibling"])`
  is false — the rule does not fire, missing a real violation.

Replace with a direct absence check: `not schema.properties[requiredProperty]`
This evaluates to true if and only if the required property has no entry in
`properties`, regardless of how many siblings exist.

Fixes Checkmarx#8081

Tests:
- negative7.yaml: sole required property present — must not fire (was false positive)
- positive7.yaml: required property absent with sibling present — must fire (was false negative)
- All six existing positive fixtures continue to fire (regression-checked locally)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(openapi): Schema Has A Required Property Undefined (2bd608ae) fires as false positive when required property is the sole entry in properties

1 participant