disable url and configUrl parameters in swagger ui (#486)

Ed-Fi-Alliance-OSS · Aug 8, 2022 · 81e320f · 81e320f
1 parent 6d291b0
commit 81e320f
Showing 1 changed file with 24 additions and 0 deletions.
diff --git a/Application/EdFi.Ods.SwaggerUI/Resources/Swashbuckle_index.html b/Application/EdFi.Ods.SwaggerUI/Resources/Swashbuckle_index.html
@@ -73,6 +73,30 @@
             configObject.presets = [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset];
             configObject.layout = "StandaloneLayout";
 
+            configObject.plugins = [function UrlParamDisablePlugin() {
+                return {
+                    statePlugins: {
+                        spec: {
+                            wrapActions: {
+                                // Workaround listed in https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx
+                                // Remove ?url and ?configUrl parameters from loading an external URLs.
+                                updateUrl: (oriAction) => (payload) => {
+                                    const url = new URL(window.location.href)
+                                    if (url.searchParams.has('configUrl')) {
+                                        url.searchParams.delete('configUrl')
+                                        window.location.replace(url.toString())
+                                    }
+                                    if (url.searchParams.has('url')) {
+                                        url.searchParams.delete('url')
+                                        window.location.replace(url.toString())
+                                    }
+                                    return oriAction(payload)
+                                }
+                            }
+                        }
+                    }
+                }
+            }];
             // Begin Swagger UI call region
 
             const ui = SwaggerUIBundle(configObject);