Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove swagger vulnerability #406

Closed
wants to merge 3 commits into from
Closed

Remove swagger vulnerability #406

wants to merge 3 commits into from

Conversation

MarcusSorealheis
Copy link
Contributor

@MarcusSorealheis MarcusSorealheis commented Jul 24, 2021 •
edited
Loading

Proposed changes

A vulnerability bot flagged an issue with the Swagger UI. The issue is quite serious as it enables input value exfiltration. Swagger is used with authorization credentials, so this attack could have severe consequences for a service that is long-lived.

You can see the issue here

Types of changes

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Refactor (changes to code, which do not change application behavior)

Checklist

  • I have filled out this PR template
  • I have read the CONTRIBUTING doc
  • I have added automated tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (README.md, inline comments, etc.)
  • I have updated the CHANGELOG.md under a ## next release, with a short summary of my changes

Relevant Links

Further comments

@CLAassistant
Copy link

CLAassistant commented Jul 24, 2021 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

@jayanandagit
Copy link
Contributor

Thanks @MarcusSorealheis for this PR. There are a couple of changes that we made.

  • bumped the version to the latest v3.51.2.
  • the reference @ is at current folder, but for the library to work correctly, the reference needed to be kept to the local dist folder. Also, swagger Url reference is reset back to module folder from swagger petstore.

We are closing this PR and continuing the work here. Thank you for your contribution. Let us know if you have any other ideas.

@MarcusSorealheis
Copy link
Contributor Author

thank you for this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jayanandagit jayanandagit Awaiting requested review from jayanandagit

@bytebounder bytebounder Awaiting requested review from bytebounder

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@MarcusSorealheis @CLAassistant @jayanandagit