Skip to content

Commit 3fddacc

Browse files
author
rzeijde
committed
separated index.html and index.js to prevent unsafe-inline
2 parents fa09296 + 3a7ae30 commit 3fddacc

File tree

2 files changed

+50
-97
lines changed

2 files changed

+50
-97
lines changed

‎swagger.go

+12-1
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ type Config struct {
2929
PersistAuthorization bool
3030
Layout SwaggerLayout
3131
DefaultModelsExpandDepth ModelsExpandDepthType
32+
ShowExtensions bool
3233
}
3334

3435
// URL presents the url pointing to API definition (normally swagger.json or swagger.yaml).
@@ -141,6 +142,14 @@ func DefaultModelsExpandDepth(defaultModelsExpandDepth ModelsExpandDepthType) fu
141142
}
142143
}
143144

145+
// ShowExtensions controls the display of vendor extension (x-) fields and values for Operations,
146+
// Parameters, Responses, and Schema.
147+
func ShowExtensions(showExtensions bool) func(config *Config) {
148+
return func(c *Config) {
149+
c.ShowExtensions = showExtensions
150+
}
151+
}
152+
144153
func newConfig(configFns ...func(*Config)) *Config {
145154
config := Config{
146155
URL: "doc.json",
@@ -151,6 +160,7 @@ func newConfig(configFns ...func(*Config)) *Config {
151160
PersistAuthorization: false,
152161
Layout: StandaloneLayout,
153162
DefaultModelsExpandDepth: ShowModel,
163+
ShowExtensions: false,
154164
}
155165

156166
for _, fn := range configFns {
@@ -256,7 +266,8 @@ window.onload = function() {
256266
{{$k}}: {{$v}},
257267
{{- end}}
258268
layout: "{{$.Layout}}",
259-
defaultModelsExpandDepth: {{.DefaultModelsExpandDepth}}
269+
defaultModelsExpandDepth: {{.DefaultModelsExpandDepth}},
270+
showExtensions: {{.ShowExtensions}}
260271
})
261272
262273
window.ui = ui

‎swagger_test.go

+38-96
Original file line numberDiff line numberDiff line change
@@ -300,83 +300,6 @@ func TestUIConfigOptions(t *testing.T) {
300300
exp string
301301
}
302302

303-
hdr := `
304-
<!DOCTYPE html>
305-
<html lang="en">
306-
<head>
307-
<meta charset="UTF-8">
308-
<title>Swagger UI</title>
309-
<link rel="stylesheet" type="text/css" href="./swagger-ui.css" >
310-
<link rel="icon" type="image/png" href="./favicon-32x32.png" sizes="32x32" />
311-
<link rel="icon" type="image/png" href="./favicon-16x16.png" sizes="16x16" />
312-
<style>
313-
html
314-
{
315-
box-sizing: border-box;
316-
overflow: -moz-scrollbars-vertical;
317-
overflow-y: scroll;
318-
}
319-
*,
320-
*:before,
321-
*:after
322-
{
323-
box-sizing: inherit;
324-
}
325-
326-
body {
327-
margin:0;
328-
background: #fafafa;
329-
}
330-
</style>
331-
</head>
332-
333-
<body>
334-
335-
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="position:absolute;width:0;height:0">
336-
<defs>
337-
<symbol viewBox="0 0 20 20" id="unlocked">
338-
<path d="M15.8 8H14V5.6C14 2.703 12.665 1 10 1 7.334 1 6 2.703 6 5.6V6h2v-.801C8 3.754 8.797 3 10 3c1.203 0 2 .754 2 2.199V8H4c-.553 0-1 .646-1 1.199V17c0 .549.428 1.139.951 1.307l1.197.387C5.672 18.861 6.55 19 7.1 19h5.8c.549 0 1.428-.139 1.951-.307l1.196-.387c.524-.167.953-.757.953-1.306V9.199C17 8.646 16.352 8 15.8 8z"></path>
339-
</symbol>
340-
341-
<symbol viewBox="0 0 20 20" id="locked">
342-
<path d="M15.8 8H14V5.6C14 2.703 12.665 1 10 1 7.334 1 6 2.703 6 5.6V8H4c-.553 0-1 .646-1 1.199V17c0 .549.428 1.139.951 1.307l1.197.387C5.672 18.861 6.55 19 7.1 19h5.8c.549 0 1.428-.139 1.951-.307l1.196-.387c.524-.167.953-.757.953-1.306V9.199C17 8.646 16.352 8 15.8 8zM12 8H8V5.199C8 3.754 8.797 3 10 3c1.203 0 2 .754 2 2.199V8z"/>
343-
</symbol>
344-
345-
<symbol viewBox="0 0 20 20" id="close">
346-
<path d="M14.348 14.849c-.469.469-1.229.469-1.697 0L10 11.819l-2.651 3.029c-.469.469-1.229.469-1.697 0-.469-.469-.469-1.229 0-1.697l2.758-3.15-2.759-3.152c-.469-.469-.469-1.228 0-1.697.469-.469 1.228-.469 1.697 0L10 8.183l2.651-3.031c.469-.469 1.228-.469 1.697 0 .469.469.469 1.229 0 1.697l-2.758 3.152 2.758 3.15c.469.469.469 1.229 0 1.698z"/>
347-
</symbol>
348-
349-
<symbol viewBox="0 0 20 20" id="large-arrow">
350-
<path d="M13.25 10L6.109 2.58c-.268-.27-.268-.707 0-.979.268-.27.701-.27.969 0l7.83 7.908c.268.271.268.709 0 .979l-7.83 7.908c-.268.271-.701.27-.969 0-.268-.269-.268-.707 0-.979L13.25 10z"/>
351-
</symbol>
352-
353-
<symbol viewBox="0 0 20 20" id="large-arrow-down">
354-
<path d="M17.418 6.109c.272-.268.709-.268.979 0s.271.701 0 .969l-7.908 7.83c-.27.268-.707.268-.979 0l-7.908-7.83c-.27-.268-.27-.701 0-.969.271-.268.709-.268.979 0L10 13.25l7.418-7.141z"/>
355-
</symbol>
356-
357-
<symbol viewBox="0 0 24 24" id="jump-to">
358-
<path d="M19 7v4H5.83l3.58-3.59L8 6l-6 6 6 6 1.41-1.41L5.83 13H21V7z"/>
359-
</symbol>
360-
361-
<symbol viewBox="0 0 24 24" id="expand">
362-
<path d="M10 18h4v-2h-4v2zM3 6v2h18V6H3zm3 7h12v-2H6v2z"/>
363-
</symbol>
364-
</defs>
365-
</svg>
366-
367-
<div id="swagger-ui"></div>
368-
369-
<script src="./swagger-ui-bundle.js"> </script>
370-
<script src="./swagger-ui-standalone-preset.js"> </script>
371-
<script>
372-
`
373-
ftr := `
374-
</script>
375-
</body>
376-
377-
</html>
378-
`
379-
380303
fixtures := []fixture{
381304
{
382305
desc: "default configuration",
@@ -389,14 +312,15 @@ func TestUIConfigOptions(t *testing.T) {
389312
Layout: StandaloneLayout,
390313
DefaultModelsExpandDepth: ShowModel,
391314
},
392-
exp: `window.onload = function() {
393-
315+
exp: `
316+
window.onload = function() {
317+
// Build a system
394318
const ui = SwaggerUIBundle({
395319
url: "doc.json",
396-
deepLinking: true ,
320+
deepLinking: true,
397321
docExpansion: "list",
398322
dom_id: "#swagger-ui",
399-
persistAuthorization: false ,
323+
persistAuthorization: false,
400324
validatorUrl: null,
401325
presets: [
402326
SwaggerUIBundle.presets.apis,
@@ -406,11 +330,13 @@ func TestUIConfigOptions(t *testing.T) {
406330
SwaggerUIBundle.plugins.DownloadUrl
407331
],
408332
layout: "StandaloneLayout",
409-
defaultModelsExpandDepth: 1
333+
defaultModelsExpandDepth: 1,
334+
showExtensions: false
410335
})
411336
412337
window.ui = ui
413-
}`,
338+
}
339+
`,
414340
},
415341
{
416342
desc: "script configuration",
@@ -440,18 +366,19 @@ func TestUIConfigOptions(t *testing.T) {
440366
},
441367
DefaultModelsExpandDepth: HideModel,
442368
},
443-
exp: `window.onload = function() {
444-
const SomePlugin = (system) => ({
369+
exp: `
370+
window.onload = function() {
371+
const SomePlugin = (system) =&gt; ({
445372
// Some plugin
446373
});
447374
448-
375+
// Build a system
449376
const ui = SwaggerUIBundle({
450377
url: "swagger.json",
451-
deepLinking: false ,
378+
deepLinking: false,
452379
docExpansion: "none",
453380
dom_id: "#swagger-ui-id",
454-
persistAuthorization: true ,
381+
persistAuthorization: true,
455382
validatorUrl: null,
456383
presets: [
457384
SwaggerUIBundle.presets.apis,
@@ -462,36 +389,38 @@ func TestUIConfigOptions(t *testing.T) {
462389
SomePlugin,
463390
AnotherPlugin
464391
],
465-
defaultModelRendering: "model",
466-
onComplete: () => { window.ui.setBasePath('v3'); },
392+
defaultModelRendering: &#34;model&#34;,
393+
onComplete: () =&gt; { window.ui.setBasePath(&#39;v3&#39;); },
467394
showExtensions: true,
468395
layout: "StandaloneLayout",
469-
defaultModelsExpandDepth: -1
396+
defaultModelsExpandDepth: -1,
397+
showExtensions: false
470398
})
471399
472400
window.ui = ui
473401
const someOtherCode = function(){
474402
// Do something
475403
};
476404
someOtherCode();
477-
}`,
405+
}
406+
`,
478407
},
479408
}
480409

481410
for _, fix := range fixtures {
482411
t.Run(fix.desc, func(t *testing.T) {
483-
tmpl := template.New("swagger_index.html")
484-
index, err := tmpl.Parse(indexTempl)
412+
tmpl := template.New("swagger_index.js")
413+
indexJs, err := tmpl.Parse(indexJsTempl)
485414
if err != nil {
486415
t.Fatal(err)
487416
}
488417

489418
buf := bytes.NewBuffer(nil)
490-
if err := index.Execute(buf, fix.cfg); err != nil {
419+
if err := indexJs.Execute(buf, fix.cfg); err != nil {
491420
t.Fatal(err)
492421
}
493422

494-
exp := hdr + fix.exp + ftr
423+
exp := fix.exp
495424

496425
// Compare line by line
497426
explns := strings.Split(exp, "\n")
@@ -559,3 +488,16 @@ func TestDefaultModelsExpandDepth(t *testing.T) {
559488
DefaultModelsExpandDepth(ShowModel)(cfg)
560489
assert.Equal(t, ShowModel, cfg.DefaultModelsExpandDepth)
561490
}
491+
492+
func TestShowExtensions(t *testing.T) {
493+
var cfg *Config
494+
495+
cfg = newConfig()
496+
assert.False(t, cfg.ShowExtensions)
497+
498+
cfg = newConfig(ShowExtensions(true))
499+
assert.True(t, cfg.ShowExtensions)
500+
501+
cfg = newConfig(ShowExtensions(false))
502+
assert.False(t, cfg.ShowExtensions)
503+
}

0 commit comments

Comments
 (0)