Skip to content

K
k3s
Commit 532398af authored by nikhiljindal's avatar nikhiljindal
Browse files
Options

Remove url query param that is leading to XSS issue

parent b5fa1460
Hide whitespace changes
Inline Side-by-side
Showing with 5 additions and 13 deletions
pkg/ui/data/swagger/datafile.go
View file @ 532398af
...@@ -2679,12 +2679,7 @@ var _third_party_swagger_ui_index_html = []byte(`<!DOCTYPE html> ...@@ -2679,12 +2679,7 @@ var _third_party_swagger_ui_index_html = []byte(`<!DOCTYPE html>
<script src='lib/swagger-oauth.js' type='text/javascript'></script> <script src='lib/swagger-oauth.js' type='text/javascript'></script>
<script type="text/javascript"> <script type="text/javascript">
$(function () { $(function () {
var url = window.location.search.match(/url=([^&]+)/); var url = "../../swaggerapi";
if (url && url.length > 1) {
url = decodeURIComponent(url[1]);
} else {
url = "../../swaggerapi";
}
window.swaggerUi = new SwaggerUi({ window.swaggerUi = new SwaggerUi({
url: url, url: url,
dom_id: "swagger-ui-container", dom_id: "swagger-ui-container",
...@@ -2763,7 +2758,7 @@ func third_party_swagger_ui_index_html() (*asset, error) { ...@@ -2763,7 +2758,7 @@ func third_party_swagger_ui_index_html() (*asset, error) {
return nil, err return nil, err
} }
info := bindata_file_info{name: "third_party/swagger-ui/index.html", size: 3720, mode: os.FileMode(416), modTime: time.Unix(1458251987, 0)} info := bindata_file_info{name: "third_party/swagger-ui/index.html", size: 3561, mode: os.FileMode(416), modTime: time.Unix(1458347707, 0)}
a := &asset{bytes: bytes, info: info} a := &asset{bytes: bytes, info: info}
return a, nil return a, nil
} }
third_party/swagger-ui/README.md
View file @ 532398af
...@@ -17,6 +17,8 @@ https://github.com/swagger-api/swagger-ui#how-to-use-it ...@@ -17,6 +17,8 @@ https://github.com/swagger-api/swagger-ui#how-to-use-it
https://github.com/swagger-api/swagger-ui#how-to-use-it https://github.com/swagger-api/swagger-ui#how-to-use-it
- Modified swagger-ui.js to list resources and operations in sorted order: https://github.com/kubernetes/kubernetes/pull/3421 - Modified swagger-ui.js to list resources and operations in sorted order: https://github.com/kubernetes/kubernetes/pull/3421
- Set supportedSubmitMethods: [] in index.html to remove "Try it out" buttons. - Set supportedSubmitMethods: [] in index.html to remove "Try it out" buttons.
- Remove the url query param to fix XSS issue:
https://github.com/kubernetes/kubernetes/pull/23234
LICENSE file has been created for compliance purposes. LICENSE file has been created for compliance purposes.
Not included in original distribution. Not included in original distribution.
third_party/swagger-ui/index.html
View file @ 532398af
...@@ -24,12 +24,7 @@ ...@@ -24,12 +24,7 @@
<script src='lib/swagger-oauth.js' type='text/javascript'></script> <script src='lib/swagger-oauth.js' type='text/javascript'></script>
<script type="text/javascript"> <script type="text/javascript">
$(function () { $(function () {
var url = window.location.search.match(/url=([^&]+)/); var url = "../../swaggerapi";
if (url && url.length > 1) {
url = decodeURIComponent(url[1]);
} else {
url = "../../swaggerapi";
}
window.swaggerUi = new SwaggerUi({ window.swaggerUi = new SwaggerUi({
url: url, url: url,
dom_id: "swagger-ui-container", dom_id: "swagger-ui-container",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment