PRC104 — Server accepted a request the spec forbids

What it catches

The same malformed bodies as PRC103 (a wrong type, a missing required field, a value outside an enum, a string too long), sent as test account A. A mutation that would equal the example is never sent (a required field is only removed when the example has it). If one gets a 2xx, the server accepted what its own spec says it must refuse.

It is low: it does not fail the build with the default --fail-on high.

Why it matters

What the server stores is not what the spec promises. A title of ten thousand characters breaks the page that shows it; a missing field becomes a null some other code does not expect; an unchecked type is where injection and mass assignment start.

How to fix it

Validate the request body against the schema (types, required fields, enums, lengths) and answer 400 otherwise. If the spec is what is wrong (the field is optional, the limit is higher), fix the spec.

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the operation, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

/notes:
  post:
    x-procyon-ignore:
      - rule: PRC104
        reason: "Long titles are truncated by the database column"

Examples

Reported: the schema says title is required, and

POST /notes {"body": "x"}     (as A)
201 {"id":"4","title":"",...}

Not reported: the same request answered 400 or 422.