Skip to content

Commit

Permalink
disable url and configUrl parameters in swagger ui (#484)
Browse files Browse the repository at this point in the history
Co-authored-by: vinaya <[email protected]>
  • Loading branch information
AxelMarquez and vimayya authored Aug 8, 2022
1 parent f5151a5 commit 9439663
Showing 1 changed file with 25 additions and 1 deletion.
26 changes: 25 additions & 1 deletion Application/EdFi.Ods.SwaggerUI/Resources/Swashbuckle_index.html
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
<!-- HTML for static distribution bundle build -->
<!-- HTML for static distribution bundle build -->
<!DOCTYPE html>
<html lang="en">
<head>
Expand Down Expand Up @@ -80,6 +80,30 @@
configObject.presets = [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset];
configObject.layout = "StandaloneLayout";

configObject.plugins = [function UrlParamDisablePlugin() {
return {
statePlugins: {
spec: {
wrapActions: {
// Workaround listed in https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx
// Remove ?url and ?configUrl parameters from loading an external URLs.
updateUrl: (oriAction) => (payload) => {
const url = new URL(window.location.href)
if (url.searchParams.has('configUrl')) {
url.searchParams.delete('configUrl')
window.location.replace(url.toString())
}
if (url.searchParams.has('url')) {
url.searchParams.delete('url')
window.location.replace(url.toString())
}
return oriAction(payload)
}
}
}
}
}
}];
// Begin Swagger UI call region

const ui = SwaggerUIBundle(configObject);
Expand Down

0 comments on commit 9439663

Please sign in to comment.