Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: use url template dependency #1008

Merged
merged 1 commit into from
Sep 30, 2019

Conversation

MrFix93
Copy link
Contributor

@MrFix93 MrFix93 commented Aug 7, 2019

We propose to use url-template instead of uri-template-lite . uri-template-lite seems to be vulnerable for a XSS attack as stated in #1007. I agree this dependency is less maintained then uri-template-lite. However, as the approach of this dependency is to generate code on runtime, probably to speed it up (therefore the '-lite'), we do not consider it 'safe'.

Also corrected a test that was not conform the spec, and detected by the new url-template dependency:

X{.list*}          X.red.green.blue

Therefore, the following test does not seems to be correct:

{ style: 'label', explode: true, expected: '.role=admin,firstName=Alex' },

should be:

{ style: 'label', explode: true, expected: '.role=admin.firstName=Alex' },

If you have any questions, let me know. We do like Redoc, but we have to comply to serious security policies.

Use a different url template dependency that does not have the XSS
vulnerability as stated in Redocly#1007.

Also corrected a test that was not conform the spec.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants