Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Replace regular expressions for path templating #3503

Closed
glowcloud opened this issue May 8, 2024 · 1 comment · May be fixed by Jircs1/swagger-ui#3
Closed

Replace regular expressions for path templating #3503

glowcloud opened this issue May 8, 2024 · 1 comment · May be fixed by Jircs1/swagger-ui#3
Assignees
@glowcloud
Labels
cat: security version: 3.x

Comments

@glowcloud
Copy link
Contributor

glowcloud commented May 8, 2024 •
edited
Loading

Instead of using regular expressions to replace URL path variables, we should use:

https://github.com/char0n/openapi-path-templating?tab=readme-ov-file#resolution

It looks like this affects at least two places:

swagger-js/src/execute/swagger2/parameter-builders.js

Line 54 in 10cbc2e

req.url = req.url.replace(new RegExp(`{${parameter.name}}`, 'g'), encodeURIComponent(value));

swagger-js/src/execute/oas3/parameter-builders.js

Line 24 in 10cbc2e

req.url = req.url.replace(new RegExp(`{${name}}`, 'g'), styledValue);

@glowcloud glowcloud self-assigned this May 8, 2024
glowcloud added a commit that referenced this issue May 8, 2024
@glowcloud
fix(execute): replace regular expressions in path builders
ab45480 
Refs #3503
@glowcloud glowcloud mentioned this issue May 8, 2024
Merged
char0n added a commit that referenced this issue May 8, 2024
@glowcloud @char0n
fix(security): replace regular expressions in path builders (#3504)
642a87c 
Refs #3503

---------

Co-authored-by: Vladimir Gorej <vladimir.gorej@gmail.com>
@glowcloud
Copy link
Contributor Author

Addressed in #3504

swagger-bot pushed a commit that referenced this issue May 8, 2024
@semantic-release-bot
chore(release): cut the 3.27.4 release [skip ci]
43e55ec 
## [3.27.4](v3.27.3...v3.27.4) (2024-05-08)

### Bug Fixes

* **security:** replace regular expressions in path builders ([#3504](#3504)) ([642a87c](642a87c)), closes [#3503](#3503)
@Jircs1 Jircs1 mentioned this issue Jul 16, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@glowcloud glowcloud

Labels
cat: security version: 3.x
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Snyk] Upgrade swagger-client from 3.26.7 to 3.28.2 Jircs1/swagger-ui
1 participant
@glowcloud