Invalid Media Type Value (v3)

• Query id: cf4a5f45-a27b-49df-843a-9911dbfe71d4
• Query name: Invalid Media Type Value (v3)
• Platform: OpenAPI
• Severity: Info
• Category: Best Practices
• CWE: 710
• URL: Github

Description

The Media Type value should match the following format: /[+suffix][;parameters]
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0"
  },
  "paths": {
    "/": {
      "get": {
        "operationId": "listVersionsv2",
        "summary": "List API versions",
        "responses": {
          "200": {
            "description": "200 response",
            "content": {
              "application/json": {
                "encoding": {
                  "code": {
                    "contentType": "image/png, image/jpeg"
                  }
                }
              }
            }
          }
        },
        "requestBody": {
          "content": {
            "multipart/form- data": {
              "encoding": {
                "code": {
                  "contentType": "image/png, image/jpeg"
                }
              }
            }
          }
        }
      }
    }
  }
}

Positive test num. 2 - yaml file

openapi: 3.0.0
info:
  title: Simple API Overview
  version: 1.0.0
paths:
  "/":
    get:
      operationId: listVersionsv2
      summary: List API versions
      responses:
        "200":
          description: 200 response
          content:
            application/json:
              encoding:
                code:
                  contentType: image/png, image/jpeg
      requestBody:
        content:
          multipart/form- data:
            encoding:
              code:
                contentType: image/png, image/jpeg

Code samples without security vulnerabilities

Negative test num. 1 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0"
  },
  "paths": {
    "/": {
      "get": {
        "operationId": "listVersionsv2",
        "summary": "List API versions",
        "responses": {
          "200": {
            "description": "200 response",
            "content": {
              "application/json": {
                "encoding": {
                  "code": {
                    "contentType": "image/png, image/jpeg"
                  }
                },
                "schema": {
                  "properties": {
                    "code": {
                      "type": "string",
                      "format": "binary"
                    },
                    "message": {
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "discriminator": {
                    "propertyName": "petType"
                  }
                }
              }
            }
          }
        },
        "requestBody": {
          "content": {
            "multipart/form-data": {
              "schema": {
                "type": "string",
                "format": "binary",
                "properties": {
                  "code": {
                    "type": "string",
                    "format": "binary"
                  }
                }
              },
              "encoding": {
                "code": {
                  "contentType": "image/png, image/jpeg"
                }
              }
            }
          }
        }
      }
    }
  }
}

Negative test num. 2 - yaml file

openapi: 3.0.0
info:
  title: Simple API Overview
  version: 1.0.0
paths:
  "/":
    get:
      operationId: listVersionsv2
      summary: List API versions
      responses:
        "200":
          description: 200 response
          content:
            application/json:
              schema:
                type: object
                discriminator:
                  propertyName: petType
                properties:
                  code:
                    type: string
                    format: binary
                  message:
                    type: string
              encoding:
                code:
                  contentType: image/png, image/jpeg
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: string
              format: binary
              properties:
                code:
                  type: string
                  format: binary
            encoding:
              code:
                contentType: image/png, image/jpeg