import * as _stoplight_spectral_functions from '@stoplight/spectral-functions';
import * as _stoplight_spectral_core from '@stoplight/spectral-core';
import { DiagnosticSeverity } from '@stoplight/types';

declare const _default: {
    formats: _stoplight_spectral_core.Format<void>[];
    aliases: {
        ArrayProperties: {
            targets: {
                formats: _stoplight_spectral_core.Format<void>[];
                given: string[];
            }[];
        };
        IntegerProperties: {
            targets: {
                formats: _stoplight_spectral_core.Format<void>[];
                given: string[];
            }[];
        };
        StringProperties: {
            targets: {
                formats: _stoplight_spectral_core.Format<void>[];
                given: string[];
            }[];
        };
    };
    rules: {
        /**
         * API1:2023 - Broken Object Level Authorization
         * https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
         *
         * Use case
         * - ❌ API call parameters use the ID of the resource accessed through the API /api/shop1/financial_info.
         * - ❌ Attackers replace the IDs of their resources with a different one which they guessed through /api/shop2/financial_info.
         * - ❌ The API does not check permissions and lets the call through.
         * - ✅ Problem is aggravated if IDs can be enumerated /api/123/financial_info.
         *
         * How to prevent
         * - ❌ Implement authorization checks with user policies and hierarchy.
         * - ❌ Do not rely on IDs that the client sends. Use IDs stored in the session object instead.
         * - ❌ Check authorization for each client request to access database.
         * - ✅ Use random IDs that cannot be guessed (UUIDs).
         */
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api1:2023-no-numeric-ids": {
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
                functionOptions: {
                    schema: {
                        type: string;
                        not: {
                            properties: {
                                type: {
                                    const: string;
                                };
                            };
                        };
                    };
                };
            };
        };
        /**
         * API2:2023 — Broken Authentication
         * https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/
         *
         * Use case
         * - ✅ Unprotected APIs that are considered “internal”
         * - ✅ Weak authentication that does not follow industry best practices
         * - ✅ Weak API keys that are not rotated
         * - ❌ Passwords that are weak, plain text, encrypted, poorly hashed, shared, or default passwords
         * - 🤷 Authentication susceptible to brute force attacks and credential stuffing
         * - ✅ Credentials and keys included in URLs
         * - ✅ Lack of access token validation (including JWT validation)
         * - ✅ Unsigned or weakly signed non-expiring JWTs
         *
         * How to prevent
         * - ❌ APIs for password reset and one-time links also allow users to authenticate, and should be protected just as rigorously.
         * - ✅ Use standard authentication, token generation, password storage, and multi-factor authentication (MFA).
         * - ✅ Use short-lived access tokens.
         * - ✅ Authenticate your apps (so you know who is talking to you).
         * - ❌ Use stricter rate-limiting for authentication, and implement lockout policies and weak password checks.
         */
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api2:2023-no-http-basic": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    notMatch: string;
                };
            };
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/rules/secrets-parameters.yml
         */
        "owasp:api2:2023-no-api-keys-in-url": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string[];
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    notMatch: string;
                };
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/rules/secrets-parameters.yml
         */
        "owasp:api2:2023-no-credentials-in-url": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string[];
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    notMatch: string;
                };
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/securitySchemes_insecure.yml#L38
         */
        "owasp:api2:2023-auth-insecure-schemes": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string[];
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    notMatch: string;
                };
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/securitySchemes.yml
         */
        "owasp:api2:2023-jwt-best-practices": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string[];
            then: ({
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
                functionOptions?: undefined;
            } | {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    match: string;
                };
            })[];
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api2:2023-short-lived-access-tokens": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string[];
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/security.yml
         */
        "owasp:api2:2023-write-restricted": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>;
                functionOptions: {
                    schemesPath: string[];
                    methods: string[];
                };
            }[];
        };
        "owasp:api2:2023-read-restricted": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>;
                functionOptions: {
                    schemesPath: string[];
                    nullable: boolean;
                    methods: string[];
                };
            }[];
        };
        /**
         * API3:2023 Broken Object Property Level Authorization
         * https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/
         *
         * Use case
         * - ❌ APIs expose endpoints that return all object’s properties.
         * - ❌ Unauthorized access to private/sensitive object properties may result in data disclosure, data loss, or data corruption. Under certain circumstances, unauthorized access to object properties can lead to privilege escalation or partial/full account takeover.
         * - 🟠 The API endpoint exposes properties of an object that are considered sensitive and should not be read by the user.
         * - ✅ The API endpoint allows a user to change, add/or delete the value of a sensitive object's property which the user should not be able to access
         *
         * How to prevent
         * - ✅ Carefully define schemas for all the API responses (restricting unknown properties)
         * - 🟠 Identify all the sensitive data or Personally Identifiable Information (PII), and justify its use.
         * https://github.com/stoplightio/spectral-owasp-ruleset/issues/11
         * - ❌ Enforce response checks to prevent accidental leaks of data or exceptions.
         */
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
         */
        "owasp:api3:2023-no-additionalProperties": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
         */
        "owasp:api3:2023-constrained-additionalProperties": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
         */
        "owasp:api3:2023-no-unevaluatedProperties": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/objects.yml
         */
        "owasp:api3:2023-constrained-unevaluatedProperties": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * API4:2023 - Unrestricted Resource Consumption
         * https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/
         *
         * Use case
         * - ✅ Attackers overload the API by sending more requests than it can handle.
         * - ✅ Attackers send requests at a rate exceeding the API's processing speed, clogging it up.
         * - ✅ The size of the requests or some fields in them exceed what the API can process.
         * - 🟠 “Zip bombs”, archive files that have been designed so that unpacking them takes excessive amount of resources and overloads the API.
         *
         * How to prevent
         * - ✅ Define proper rate limiting.
         * - ✅ Limit maximums on request parameter sizes
         * - ❌ Tailor the rate limiting to be match what API methods, clients, or addresses need or should be allowed to get.
         * - ❌ Add checks on compression ratios.
         * - ❌ Define limits for container resources.
         * - 🟠 Look for Zip uploads and warn about setting max file size? how do we know if they did? Demand something in the description?
         */
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-rate-limit": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
                functionOptions: {
                    schema: {
                        type: string;
                        oneOf: {
                            required: string[];
                        }[];
                    };
                };
            };
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-rate-limit-retry-after": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            };
        };
        /**
         * @author: Jason Harmon <https://github.com/jharmn>
         */
        "owasp:api4:2023-rate-limit-responses-429": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Roberto Polli <https://github.com/ioggstream>
         * @see: https://github.com/italia/api-oas-checker/blob/master/security/array.yml
         */
        "owasp:api4:2023-array-limit": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            };
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-string-limit": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
                functionOptions: {
                    schema: {
                        type: string;
                        anyOf: {
                            required: string[];
                        }[];
                    };
                };
            };
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-string-restricted": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
                functionOptions: {
                    schema: {
                        type: string;
                        anyOf: {
                            required: string[];
                        }[];
                    };
                };
            };
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-integer-limit": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<Record<string, unknown>, _stoplight_spectral_functions.XorOptions>;
                functionOptions: {
                    properties: string[];
                };
            }[];
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-integer-limit-legacy": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api4:2023-integer-format": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * API5:2023 — Broken function level authorization
         * https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/
         *
         * - ✅ Don’t assume that an API endpoint is regular or administrative only based on the URL path.
         * - ❌ Do not rely on the client to enforce admin access.
         * - ✅ Deny all access by default api2:2023-protection-
         */
        "owasp:api5:2023-admin-security-unique": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<any, any>;
                functionOptions: {
                    adminUrl: string;
                };
            }[];
        };
        /**
         * API6:2023 - Unrestricted Access to Sensitive Business Flows
         * https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/
         *
         * Use case
         *
         * - ❌ Purchasing a product flow - an attacker can buy all the stock of a
         *   high-demand item at once and resell for a higher price (scalping)
         * - ❌ Creating a comment/post flow - an attacker can spam the system
         * - ❌ Making a reservation - an attacker can reserve all the available time
         *   slots and prevent other users from using the system
         *
         * How to prevent
         *
         * - Device fingerprinting: denying service to unexpected client devices
         *   (e.g headless browsers) tends to make threat actors use more
         *   sophisticated solutions, thus more costly for them
         * - Human detection: using either captcha or more advanced biometric
         *   solutions (e.g. typing patterns)
         * - Non-human patterns: analyze the user flow to detect non-human patterns
         *   (e.g. the user accessed the "add to cart" and "complete purchase"
         *   functions in less than one second)
         * - Consider blocking IP addresses of Tor exit nodes and well-known proxies
         */
        /**
         * API7:2023 — Server Side Request Forgery
         * https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/
         *
         * Modern concepts encourage developers to access an external resource based
         * on user input: Webhooks, file fetching from URLs, custom SSO, and URL
         * previews.
         *
         */
        "owasp:api7:2023-concerning-url-parameter": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string[];
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    notMatch: RegExp;
                };
            };
        };
        /**
         * API8:2023 — Security Misconfiguration
         * https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/
         *
         * Poor configuration of the API servers allows attackers to exploit them.
         *
         * Use case
         * - ❌ Unpatched systems
         * - ❌ Unprotected files and directories
         * - ❌ Unhardened images
         * - ✅ Missing, outdated, or misconfigured TLS
         * - ❌ Exposed storage or server management panels
         * - ✅ Missing CORS policy or security headers
         * - 🟠 Error messages with stack traces
         * https://github.com/stoplightio/spectral-owasp-ruleset/issues/12
         * - ❌ Unnecessary features enabled
         *
         */
        /**
         * @author: Phil Sturgeon (https://github.com/philsturgeon)
         */
        "owasp:api8:2023-define-cors-origin": {
            message: string;
            description: string;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            };
            severity: DiagnosticSeverity;
        };
        /**
         * @author: Andrzej <https://github.com/jerzyn>
         */
        "owasp:api8:2023-no-scheme-http": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
                functionOptions: {
                    schema: {
                        type: string;
                        enum: string[];
                    };
                };
            };
        };
        /**
         * @author: Andrzej <https://github.com/jerzyn>
         */
        "owasp:api8:2023-no-server-http": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    notMatch: string;
                };
            };
        };
        /**
         * @author: Jason Harmon <https://github.com/jharmn>
         */
        "owasp:api8:2023-define-error-validation": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, _stoplight_spectral_functions.SchemaOptions>;
                functionOptions: {
                    schema: {
                        type: string;
                        anyOf: {
                            required: string[];
                        }[];
                    };
                };
            }[];
        };
        /**
         * @author: Jason Harmon <https://github.com/jharmn>
         */
        "owasp:api8:2023-define-error-responses-401": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * @author: Jason Harmon <https://github.com/jharmn>
         */
        "owasp:api8:2023-define-error-responses-500": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            }[];
        };
        /**
         * API9:2023 Improper Inventory Management
         * https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/
         *
         * How to prevent
         * - 🟠 Servers, define which environment is the API running in (e.g. production, staging, test, development)
         * - ✅ Require servers use x-internal true/false to explicitly explain what is public or internal for documentation tools
         * - 🤷‍♂️ There is no retirement plan for each API version.
         */
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api9:2023-inventory-access": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<unknown, null>;
            };
        };
        /**
         * @author: Phil Sturgeon <https://github.com/philsturgeon>
         */
        "owasp:api9:2023-inventory-environment": {
            message: string;
            description: string;
            severity: DiagnosticSeverity;
            formats: _stoplight_spectral_core.Format<void>[];
            given: string;
            then: {
                field: string;
                function: _stoplight_spectral_core.RulesetFunctionWithValidator<string, _stoplight_spectral_functions.PatternOptions>;
                functionOptions: {
                    match: string;
                };
            };
        };
    };
};

export { _default as default };