Skip to content

Commit 11f1263

Browse files
bodniabodnia
committed
fix for xss issue
1 parent 6c4ccf7 commit 11f1263

21 files changed

+529
-531
lines changed

‎dist/swagger-ui.js‎

Lines changed: 220 additions & 213 deletions
Large diffs are not rendered by default.

‎dist/swagger-ui.min.js‎

Lines changed: 10 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/main/javascript/helpers/handlebars.js‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,24 @@
11
'use strict';
22
/*jslint eqeq: true*/
33

4-
Handlebars.registerHelper('sanitize', function(html) {
4+
var sanitize = function(html) {
5+
html = html || '';
56
// Strip the script tags from the html, and return it as a Handlebars.SafeString
67
html = html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
8+
html = html.replace(/(on\w+="[^"]*")*(on\w+='[^']*')*(on\w+=\w*\(\w*\))*/gi, '');
79
return new Handlebars.SafeString(html);
8-
});
10+
};
11+
12+
Handlebars.registerHelper('sanitize', sanitize);
913

1014
Handlebars.registerHelper('renderTextParam', function(param) {
1115
var result, type = 'text', idAtt = '';
1216
var paramType = param.type || param.schema && param.schema.type || '';
1317
var isArray = paramType.toLowerCase() === 'array' || param.allowMultiple;
1418
var defaultValue = isArray && Array.isArray(param.default) ? param.default.join('\n') : param.default;
19+
var name = Handlebars.Utils.escapeExpression(param.name);
20+
var valueId = Handlebars.Utils.escapeExpression(param.valueId);
21+
paramType = Handlebars.Utils.escapeExpression(paramType);
1522

1623
var dataVendorExtensions = Object.keys(param).filter(function(property) {
1724
// filter X-data- properties
@@ -21,24 +28,18 @@ Handlebars.registerHelper('renderTextParam', function(param) {
2128
return result += ' ' + property.substring(2, property.length) + '=\'' + param[property] + '\'';
2229
}, '');
2330

24-
if (typeof defaultValue === 'undefined') {
25-
defaultValue = '';
26-
}
27-
2831
if(param.format && param.format === 'password') {
2932
type = 'password';
3033
}
3134

32-
if(param.valueId) {
33-
idAtt = ' id=\'' + param.valueId + '\'';
35+
if(valueId) {
36+
idAtt = ' id=\'' + valueId + '\'';
3437
}
3538

36-
if (typeof defaultValue === 'string' || defaultValue instanceof String) {
37-
defaultValue = defaultValue.replace(/'/g,'&apos;');
38-
}
39+
defaultValue = sanitize(defaultValue);
3940

4041
if(isArray) {
41-
result = '<textarea class=\'body-textarea' + (param.required ? ' required' : '') + '\' name=\'' + param.name + '\'' + idAtt + dataVendorExtensions;
42+
result = '<textarea class=\'body-textarea' + (param.required ? ' required' : '') + '\' name=\'' + name + '\'' + idAtt + dataVendorExtensions;
4243
result += ' placeholder=\'Provide multiple values in new lines' + (param.required ? ' (at least one required).' : '.') + '\'>';
4344
result += defaultValue + '</textarea>';
4445
} else {
@@ -47,7 +48,7 @@ Handlebars.registerHelper('renderTextParam', function(param) {
4748
parameterClass += ' required';
4849
}
4950
result = '<input class=\'' + parameterClass + '\' minlength=\'' + (param.required ? 1 : 0) + '\'';
50-
result += ' name=\'' + param.name +'\' placeholder=\'' + (param.required ? '(required)' : '') + '\'' + idAtt + dataVendorExtensions;
51+
result += ' name=\'' + name +'\' placeholder=\'' + (param.required ? '(required)' : '') + '\'' + idAtt + dataVendorExtensions;
5152
result += ' type=\'' + type + '\' value=\'' + defaultValue + '\'/>';
5253
}
5354
return new Handlebars.SafeString(result);
@@ -76,3 +77,9 @@ Handlebars.registerHelper('ifCond', function (v1, operator, v2, options) {
7677
return options.inverse(this);
7778
}
7879
});
80+
81+
Handlebars.registerHelper('escape', function (value) {
82+
var text = Handlebars.Utils.escapeExpression(value);
83+
84+
return new Handlebars.SafeString(text);
85+
});

‎src/main/template/apikey_auth.handlebars‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
<div class="key_input_container">
22
<h3 class="auth__title">Api key authorization</h3>
3-
<div class="auth__description">{{description}}</div>
3+
<div class="auth__description">{{{sanitize description}}}</div>
44
<div>
55
<div class="key_auth__field">
66
<span class="key_auth__label">name:</span>
7-
<span class="key_auth__value">{{name}}</span>
7+
<span class="key_auth__value">{{{escape name}}}</span>
88
</div>
99
<div class="key_auth__field">
1010
<span class="key_auth__label">in:</span>
11-
<span class="key_auth__value">{{in}}</span>
11+
<span class="key_auth__value">{{{escape in}}}</span>
1212
</div>
1313
<div class="key_auth__field">
1414
<span class="key_auth__label">value:</span>
1515
{{#if isLogout}}
16-
<span class="key_auth__value">{{value}}</span>
16+
<span class="key_auth__value">{{{sanitize value}}}</span>
1717
{{else}}
1818
<input placeholder="api_key" class="auth_input input_apiKey_entry" name="apiKey" type="text"/>
1919
{{/if}}

‎src/main/template/auth_button_operation.handlebars‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
{{#if scopes}}
99
<ul class="authorize-scopes">
1010
{{#each scopes}}
11-
<li class="authorize__scope" title="{{description}}">{{scope}}</li>
11+
<li class="authorize__scope" title="{{{escape description}}}">{{{escape scope}}}</li>
1212
{{/each}}
1313
</ul>
1414
{{/if}}

‎src/main/template/basic_auth.handlebars‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
<div class='basic_auth_container'>
22
<h3 class="auth__title">Basic authentication{{#if isLogout}} - authorized{{/if}}</h3>
33
<form class="basic_input_container">
4-
<div class="auth__description">{{description}}</div>
4+
<div class="auth__description">{{{sanitize description}}}</div>
55
<div class="auth_label">
66
<span class="basic_auth__label" data-sw-translate>username:</span>
77
{{#if isLogout}}
8-
<span class="basic_auth__value">{{username}}</span>
8+
<span class="basic_auth__value">{{{escape username}}}</span>
99
{{else}}
1010
<input required placeholder="username" class="basic_auth__username auth_input" name="username" type="text"/>
1111
{{/if}}

‎src/main/template/content_type.handlebars‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
<label data-sw-translate for="{{contentTypeId}}">Response Content Type</label>
2-
<select name="contentType" id="{{contentTypeId}}">
1+
<label data-sw-translate for="{{{escape contentTypeId}}}">Response Content Type</label>
2+
<select name="contentType" id="{{{escape contentTypeId}}}">
33
{{#if produces}}
44
{{#each produces}}
5-
<option value="{{this}}">{{this}}</option>
5+
<option value="{{{sanitize this}}}">{{{sanitize this}}}</option>
66
{{/each}}
77
{{else}}
88
<option value="application/json">application/json</option>

‎src/main/template/main.handlebars‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
<div class='info' id='api_info'>
22
{{#if info}}
3-
<div class="info_title">{{info.title}}</div>
4-
<div class="info_description markdown">{{{info.description}}}</div>
3+
<div class="info_title">{{{sanitize info.title}}}</div>
4+
<div class="info_description markdown">{{{sanitize info.description}}}</div>
55
{{#if externalDocs}}
6-
<p>{{externalDocs.description}}</p>
7-
<a href="{{externalDocs.url}}" target="_blank">{{externalDocs.url}}</a>
6+
<p>{{{sanitize externalDocs.description}}}</p>
7+
<a href="{{{escape externalDocs.url}}}" target="_blank">{{{escape externalDocs.url}}}</a>
88
{{/if}}
9-
{{#if info.termsOfServiceUrl}}<div class="info_tos"><a target="_blank" href="{{info.termsOfServiceUrl}}" data-sw-translate>Terms of service</a></div>{{/if}}
10-
{{#if info.contact.name}}<div><div class='info_name' style="display: inline" data-sw-translate>Created by </div> {{info.contact.name}}</div>{{/if}}
11-
{{#if info.contact.url}}<div class='info_url' data-sw-translate>See more at <a href="{{info.contact.url}}">{{info.contact.url}}</a></div>{{/if}}
12-
{{#if info.contact.email}}<div class='info_email'><a target="_parent" href="mailto:{{info.contact.email}}?subject={{info.title}}" data-sw-translate>Contact the developer</a></div>{{/if}}
13-
{{#if info.license}}<div class='info_license'><a target="_blank" href='{{info.license.url}}'>{{info.license.name}}</a></div>{{/if}}
9+
{{#if info.termsOfServiceUrl}}<div class="info_tos"><a target="_blank" href="{{{escape info.termsOfServiceUrl}}}" data-sw-translate>Terms of service</a></div>{{/if}}
10+
{{#if info.contact.name}}<div><div class='info_name' style="display: inline" data-sw-translate>Created by </div> {{{escape info.contact.name}}}</div>{{/if}}
11+
{{#if info.contact.url}}<div class='info_url' data-sw-translate>See more at <a href="{{{escape info.contact.url}}}">{{{escape info.contact.url}}}</a></div>{{/if}}
12+
{{#if info.contact.email}}<div class='info_email'><a target="_parent" href="mailto:{{{escape info.contact.email}}}?subject={{{escape info.title}}}" data-sw-translate>Contact the developer</a></div>{{/if}}
13+
{{#if info.license}}<div class='info_license'><a target="_blank" href='{{{escape info.license.url}}}'>{{{escape info.license.name}}}</a></div>{{/if}}
1414
{{/if}}
1515
</div>
1616
<div class='container' id='resources_container'>
@@ -19,12 +19,12 @@
1919
<ul id='resources'></ul>
2020

2121
<div class="footer">
22-
<h4 style="color: #999">[ <span style="font-variant: small-caps">base url</span>: {{basePath}}
22+
<h4 style="color: #999">[ <span style="font-variant: small-caps">base url</span>: {{{escape basePath}}}
2323
{{#if info.version}}
24-
, <span style="font-variant: small-caps" data-sw-translate>api version</span>: {{info.version}}
24+
, <span style="font-variant: small-caps" data-sw-translate>api version</span>: {{{escape info.version}}}
2525
{{/if}}]
2626
{{#if validatorUrl}}
27-
<span style="float:right"><a target="_blank" href="{{validatorUrl}}/debug?url={{url}}"><img id="validator" src="{{validatorUrl}}?url={{url}}"></a>
27+
<span style="float:right"><a target="_blank" href="{{{escape validatorUrl}}}/debug?url={{{escape url}}}"><img id="validator" src="{{{escape validatorUrl}}}?url={{{escape url}}}"></a>
2828
</span>
2929
{{/if}}
3030
</h4>

‎src/main/template/oauth2.handlebars‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
<div>
22
<h3 class="auth__title">Select OAuth2.0 Scopes</h3>
3-
<p>{{description}}</p>
3+
<p>{{{sanitize description}}}</p>
44
<p>Scopes are used to grant an application different levels of access to data on behalf of the end user. Each API may declare one or more scopes.
55
<a href="#">Learn how to use</a>
66
</p>
7-
<p><strong> {{appName}} </strong> API requires the following scopes. Select which ones you want to grant to Swagger UI.</p>
8-
<p>Authorization URL: {{authorizationUrl}}</p>
9-
<p>flow: {{flow}}</p>
7+
<p><strong> {{{escape appName}}} </strong> API requires the following scopes. Select which ones you want to grant to Swagger UI.</p>
8+
<p>Authorization URL: {{{sanitize authorizationUrl}}}</p>
9+
<p>flow: {{{escape flow}}}</p>
1010
<ul class="api-popup-scopes">
1111
{{#each scopes}}
1212
<li>
13-
<input class="oauth-scope" type="checkbox" data-scope="{{scope}}" oauthtype="{{OAuthSchemeKey}}"/>
14-
<label>{{scope}}</label><br/>
15-
<span class="api-scope-desc">{{description}}
13+
<input class="oauth-scope" type="checkbox" data-scope="{{{escape scope}}}" oauthtype="{{{escape OAuthSchemeKey}}}"/>
14+
<label>{{{escape scope}}}</label><br/>
15+
<span class="api-scope-desc">{{{escape description}}}
1616
{{#if OAuthSchemeKey}}
17-
({{OAuthSchemeKey}})
17+
({{{escape OAuthSchemeKey}}})
1818
{{/if}}
1919
</span>
2020
</li>

‎src/main/template/operation.handlebars‎

Lines changed: 11 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,35 @@
11
<ul class='operations' >
2-
<li class='{{method}} operation' id='{{parentId}}_{{nickname}}'>
2+
<li class='{{{escape method}}} operation' id='{{{escape parentId}}}_{{{escape nickname}}}'>
33
<div class='heading'>
44
<h3>
55
<span class='http_method'>
6-
<a href='#!/{{encodedParentId}}/{{nickname}}' class="toggleOperation">{{method}}</a>
6+
<a href='#!/{{{escape encodedParentId}}}/{{{escape nickname}}}' class="toggleOperation">{{{escape method}}}</a>
77
</span>
88
<span class='path'>
9-
<a href='#!/{{encodedParentId}}/{{nickname}}' class="toggleOperation {{#if deprecated}}deprecated{{/if}}">{{path}}</a>
9+
<a href='#!/{{{escape encodedParentId}}}/{{{escape nickname}}}' class="toggleOperation {{#if deprecated}}deprecated{{/if}}">{{{escape path}}}</a>
1010
</span>
1111
</h3>
1212
<ul class='options'>
1313
<li>
14-
<a href='#!/{{encodedParentId}}/{{nickname}}' class="toggleOperation">{{{summary}}}</a>
14+
<a href='#!/{{{escape encodedParentId}}}/{{{escape nickname}}}' class="toggleOperation">{{{escape summary}}}</a>
1515
</li>
1616
</ul>
1717
</div>
18-
<div class='content' id='{{parentId}}_{{nickname}}_content' style='display:none'>
18+
<div class='content' id='{{{escape encodedParentId}}}/{{{escape nickname}}}_content' style='display:none'>
1919
{{#if deprecated}}
2020
<h4><span data-sw-translate>Warning: Deprecated</span></h4>
2121
{{/if}}
2222
{{#if description}}
2323
<h4><span data-sw-translate>Implementation Notes</span></h4>
24-
<div class="markdown">{{{description}}}</div>
24+
<div class="markdown">{{{sanitize description}}}</div>
2525
{{/if}}
2626
{{#if security}}
2727
<div class='authorize-wrapper authorize-wrapper_operation'></div>
2828
{{/if}}
29-
{{!--{{#oauth}}--}}
30-
{{!--<div class="auth">--}}
31-
{{!--<span class="api-ic ic-error">{{/oauth}}--}}
32-
{{!--{{#each oauth}}--}}
33-
{{!--<div class="api_information_panel">--}}
34-
{{!--{{#each this}}--}}
35-
{{!--<div title='{{{this.description}}}'>{{this.scope}}</div>--}}
36-
{{!--{{/each}}--}}
37-
{{!--</div>--}}
38-
{{!--{{/each}}--}}
39-
{{!--{{#oauth}}</span></div>{{/oauth}}--}}
40-
{{!--{{#oauth}}--}}
41-
{{!--<div class='access'>--}}
42-
{{!--<span class="api-ic ic-off" title="click to authenticate"></span>--}}
43-
{{!--</div>--}}
44-
{{!--{{/oauth}}--}}
4529
{{#if type}}
4630
<div class="response-class">
47-
<h4><span data-sw-translate>Response Class</span> (<span data-sw-translate>Status</span> {{successCode}})</h4>
48-
{{#if successDescription}}<div class="markdown">{{{successDescription}}}</div>{{/if}}
31+
<h4><span data-sw-translate>Response Class</span> (<span data-sw-translate>Status</span> {{{escape successCode}}})</h4>
32+
{{#if successDescription}}<div class="markdown">{{{sanitize successDescription}}}</div>{{/if}}
4933
<p><span class="model-signature" /></p>
5034
<br/>
5135
<div class="response-content-type" />
@@ -67,9 +51,9 @@
6751
{{#each headers}}
6852
<tr>
6953
<td>{{@key}}</td>
70-
<td>{{this.description}}</td>
71-
<td>{{this.type}}</td>
72-
<td>{{this.other}}</td>
54+
<td>{{{sanitize this.description}}}</td>
55+
<td>{{{escape this.type}}}</td>
56+
<td>{{{escape this.other}}}</td>
7357
</tr>
7458
{{/each}}
7559
</tbody>

0 commit comments

Comments
 (0)