Findings schema currently allows arbitrary top-level properties (additionalProperties: true) in parser-sdk/nodejs/findings-schema.json / documentation/docs/api/finding.md, and the Go hook-sdk (hook-sdk/golang/files.go) doesn't reject unknown JSON fields when decoding findings either.
This was kept permissive in #3786 because zap-automation-framework and ssh-audit parsers emit non-standard top-level fields (hint, port) instead of nesting them under attributes.
To do:
- Move
hint (zap-automation-framework) and port (ssh-audit) into attributes
- Set
additionalProperties: false in both schema files
- Re-enable
decoder.DisallowUnknownFields() in hook-sdk/golang/files.go
- Test and ensure that the nodejs & golang sdk's are properly validating it
This is a breaking change for any parser emitting non-standard top-level finding fields, so it should ship with a major/breaking release.
Findings schema currently allows arbitrary top-level properties (
additionalProperties: true) inparser-sdk/nodejs/findings-schema.json/documentation/docs/api/finding.md, and the Go hook-sdk (hook-sdk/golang/files.go) doesn't reject unknown JSON fields when decoding findings either.This was kept permissive in #3786 because
zap-automation-frameworkandssh-auditparsers emit non-standard top-level fields (hint,port) instead of nesting them underattributes.To do:
hint(zap-automation-framework) andport(ssh-audit) intoattributesadditionalProperties: falsein both schema filesdecoder.DisallowUnknownFields()inhook-sdk/golang/files.goThis is a breaking change for any parser emitting non-standard top-level finding fields, so it should ship with a major/breaking release.