Added NoRequestBody to recommended ruleset

rulesets/rule_fixes.go

@@ -162,6 +162,8 @@ const (
 	schemaTypeFix string = "Make sure each schema has a value type defined. Without a type, the schema is useless"
 
 	postSuccessResponseFix string = "Make sure your POST operations return a 'success' response via 2xx or 3xx response code. "
+
+	noRequestBodyResponseFix string = "Remove 'requestBody' from HTTP GET and DELETE methods"
 )
 
 const (

rulesets/ruleset_functions.go

@@ -1307,6 +1307,26 @@ func GetPostSuccessResponseRule() *model.Rule {
 			Function:        "postResponseSuccess",
 			FunctionOptions: opts,
 		},
-		HowToFix: oas3HostNotExampleFix,
+		HowToFix: postSuccessResponseFix,
+	}
+}
+
+// GetNoRequestBodyRule will check that HTTP GET and DELETE do not accept request bodies
+func GetNoRequestBodyRule() *model.Rule {
+	return &model.Rule{
+		Name:         "Check GET and DELETE methods do not accept request bodies",
+		Id:           NoRequestBody,
+		Formats:      model.OAS3AllFormat,
+		Description:  "HTTP GET and DELETE should not accept request bodies",
+		Given:        "$",
+		Resolved:     false,
+		RuleCategory: model.RuleCategories[model.CategoryOperations],
+		Recommended:  true,
+		Type:         Style,
+		Severity:     model.SeverityWarn,
+		Then: model.RuleAction{
+			Function: "noRequestBody",
+		},
+		HowToFix: noRequestBodyResponseFix,
 	}
 }

rulesets/rulesets.go

@@ -115,6 +115,7 @@ const (
 	OwaspConstrainedAdditionalProperties = "owasp-constrained-additionalProperties"
 	OwaspSecurityHostsHttpsOAS3          = "owasp-security-hosts-https-oas3"
 	PostResponseSuccess                  = "post-response-success"
+	NoRequestBody                        = "no-request-body"
 	SpectralOpenAPI                      = "spectral:oas"
 	SpectralOwasp                        = "spectral:owasp"
 	VacuumOwasp                          = "vacuum:owasp"
@@ -439,6 +440,7 @@ func GetAllBuiltInRules() map[string]*model.Rule {
 	rules[Oas3ExampleExternalCheck] = GetOAS3ExamplesExternalCheck()
 	rules[OasSchemaCheck] = GetSchemaTypeCheckRule()
 	rules[PostResponseSuccess] = GetPostSuccessResponseRule()
+	rules[NoRequestBody] = GetNoRequestBodyRule()
 
 	// dead.
 	//rules[Oas2ValidSchemaExample] = GetOAS2ExamplesRule()