Comments (5)
Closing this issue as no vulnerabilities are reported when creating a new LoopBack 3 app or when doing npm install
on this repo where [email protected]
is a dependency.
from loopback-component-explorer.
Cross-posting #250 (comment)
Upgrading to swagger-ui@3
is a lot of effort. See #209 for the previous attempt made by @STRML .
The following issue is the biggest blocker:
loopback-swagger need to produce auth metadata - see strongloop/loopback-swagger#65
The pull request also says:
The npm package no longer exports a bundle. I'm not sure if this is intentional. For this reason, I've added a dev-only script to copy from github releases.
I think this is no longer relevant, we are successfully using https://www.npmjs.com/package/swagger-ui-dist in LB4.
from loopback-component-explorer.
Proposed by @bajtos:
To fix the vulnerability from swagger-api/swagger-ui#3847:
- Submit a PR to
swagger-ui
to backport the patch from swagger-api/swagger-ui#3848 intoswagger-ui@2
instead of upgrading toswagger-ui@3
.
from loopback-component-explorer.
It seems like the files where the vulnerability exists in swagger-ui@3
don't exist on swagger-ui@2
, so there's no way to backport the patch (also the issue's title, XSS Vulnerability with Swagger UI v3
, mentions it's for v3). Since the effort to upgrade the dependency was agreed to be too much, should we close the issue? @strongloop/loopback-maintainers
Edit: if there are no objections, I'll close the issue but we can reopen it if needed.
from loopback-component-explorer.
I was able to reproduce the issue on a LoopBack 3 application using swagger-ui@2
, so I'm reopening this issue.
from loopback-component-explorer.
Related Issues (20)
- With destroyAll exposed, API Explorer does not send where filter (LB 2.x) HOT 2
- Parameters with x-www-form-urlencoded are not included in the curl commandline and are not sent HOT 5
- [email protected] JSONEditor is not defined
- Use a custom swagger spec instead of the default HOT 1
- Upgrade loopback-swagger to latest version please HOT 1
- can't get "through" to show HOT 2
- Properties added in bootscripts or later don't show up in explorer HOT 2
- unresponsive script
- Migrate to Swagger-UI 3.x HOT 4
- `Cannot read property '$ref' of undefined` when using `Base` HOT 4
- API version not being picked up from package.json HOT 2
- File Downloading Bug HOT 2
- Cannot override index.html title using apiInfo HOT 3
- example for loopback 4 usage HOT 3
- loopback.basicAuth is not a function? HOT 2
- lodash security risk for version 2.7.0 HOT 2
- Display error when a model is called 'Array' HOT 2
- swagger-ui vulnerabilities HOT 19
- Loopback4 version problem!
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from loopback-component-explorer.