False positive on owasp:api8:2023-define-cors-origin when defining components.headers

[erwinkramer]

Context

This file openapi_v1.json throws:

Header headers.Access-Control-Allow-Origin should be defined on all responses.

This is because in components.headers i set "Access-Control-Allow-Origin-BREAKING" as ref. It somehow, falsely, validates the ref id's in this section and the owasp rule assumes that it's an actual header name. If i change the ref id to Access-Control-Allow-Origin it works again (= the workaround), but this is not what i expect it to behave like.

Environment

• Ruleset version: 2.0.1 - https://www.npmjs.com/package/@stoplight/spectral-owasp-ruleset/v/2.0.1
• Environment name and version (e.g. Chrome 39, node.js 5.4): VSCode with the spectral extension (version 1.1.4)
• Operating System and version (desktop or mobile): WIndows
• Link to your environment/workspace/project: https://github.com/erwinkramer/bank-api/blob/main/Specs.Generated/openapi_v1.json (uses the workaround mentioned earlier)