Skip to content

Commit 41dbb8d

Browse files
jayanandagitMarcusSorealheis
jayanandagit
and
MarcusSorealheis
authored
Release/v0.33.8 (#407)
* replacing the vulnerable swagger-ui with a safe one. * updating index.html page. * updated changelog. * Fix the vulnerability by upgrading Swagger UI to v3.51.2 * Suppress SA4005 Co-authored-by: MarcusSorealheis <[email protected]>
1 parent 5efedfc commit 41dbb8d

16 files changed

+75
-165
lines changed

‎CHANGELOG.md

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
## v0.33.8
2+
- Upgrade the Swagger UI dependency to remove a very dangerous vulnerability (upgrade Swagger UI to v3.51.2).
3+
14
## v0.33.7
25
- Update requirements packages for docs.
36
- Update gotool version for pipeline.

‎dist/oauth2-redirect.html

+19-11
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
<!doctype html>
22
<html lang="en-US">
3-
<body onload="run()">
4-
</body>
5-
</html>
3+
<head>
4+
<title>Swagger UI: OAuth2 Redirect</title>
5+
</head>
6+
<body>
67
<script>
78
'use strict';
89
function run () {
@@ -17,19 +18,20 @@
1718
qp = location.search.substring(1);
1819
}
1920

20-
arr = qp.split("&")
21-
arr.forEach(function (v,i,_arr) { _arr[i] = '"' + v.replace('=', '":"') + '"';})
21+
arr = qp.split("&");
22+
arr.forEach(function (v,i,_arr) { _arr[i] = '"' + v.replace('=', '":"') + '"';});
2223
qp = qp ? JSON.parse('{' + arr.join() + '}',
2324
function (key, value) {
24-
return key === "" ? value : decodeURIComponent(value)
25+
return key === "" ? value : decodeURIComponent(value);
2526
}
26-
) : {}
27+
) : {};
2728

28-
isValid = qp.state === sentState
29+
isValid = qp.state === sentState;
2930

3031
if ((
31-
oauth2.auth.schema.get("flow") === "accessCode"||
32-
oauth2.auth.schema.get("flow") === "authorizationCode"
32+
oauth2.auth.schema.get("flow") === "accessCode" ||
33+
oauth2.auth.schema.get("flow") === "authorizationCode" ||
34+
oauth2.auth.schema.get("flow") === "authorization_code"
3335
) && !oauth2.auth.code) {
3436
if (!isValid) {
3537
oauth2.errCb({
@@ -45,7 +47,7 @@
4547
oauth2.auth.code = qp.code;
4648
oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl});
4749
} else {
48-
let oauthErrorMsg
50+
let oauthErrorMsg;
4951
if (qp.error) {
5052
oauthErrorMsg = "["+qp.error+"]: " +
5153
(qp.error_description ? qp.error_description+ ". " : "no accessCode received from the server. ") +
@@ -64,4 +66,10 @@
6466
}
6567
window.close();
6668
}
69+
70+
window.addEventListener('DOMContentLoaded', function () {
71+
run();
72+
});
6773
</script>
74+
</body>
75+
</html>

‎dist/swagger-ui-bundle.js

+2-92
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-bundle.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-es-bundle-core.js

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-es-bundle-core.js.map

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-es-bundle.js

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-es-bundle.js.map

+1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-standalone-preset.js

+2-13
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui-standalone-preset.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui.css

+3-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui.css.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui.js

+2-8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/swagger-ui.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎index.html

+31-34
Original file line numberDiff line numberDiff line change
@@ -2,36 +2,29 @@
22
<!DOCTYPE html>
33
<html lang="en">
44
<head>
5-
<meta charset="UTF-8" />
5+
<meta charset="UTF-8">
66
<title>Swagger UI</title>
77
<link rel="stylesheet" type="text/css" href="dist/swagger-ui.css" />
8-
<link
9-
rel="icon"
10-
type="image/png"
11-
href="dist/favicon-32x32.png"
12-
sizes="32x32"
13-
/>
14-
<link
15-
rel="icon"
16-
type="image/png"
17-
href="dist/favicon-16x16.png"
18-
sizes="16x16"
19-
/>
8+
<link rel="icon" type="image/png" href="dist/favicon-32x32.png" sizes="32x32" />
9+
<link rel="icon" type="image/png" href="dist/favicon-16x16.png" sizes="16x16" />
2010
<style>
21-
html {
11+
html
12+
{
2213
box-sizing: border-box;
2314
overflow: -moz-scrollbars-vertical;
2415
overflow-y: scroll;
2516
}
2617

2718
*,
2819
*:before,
29-
*:after {
20+
*:after
21+
{
3022
box-sizing: inherit;
3123
}
3224

33-
body {
34-
margin: 0;
25+
body
26+
{
27+
margin:0;
3528
background: #fafafa;
3629
}
3730
</style>
@@ -40,24 +33,28 @@
4033
<body>
4134
<div id="swagger-ui"></div>
4235

43-
<script src="dist/swagger-ui-bundle.js"></script>
44-
<script src="dist/swagger-ui-standalone-preset.js"></script>
36+
<script src="dist/swagger-ui-bundle.js" charset="UTF-8"> </script>
37+
<script src="dist/swagger-ui-standalone-preset.js" charset="UTF-8"> </script>
4538
<script>
46-
window.onload = function() {
47-
// Begin Swagger UI call region
48-
const ui = SwaggerUIBundle({
49-
url: "./modules/swagger.yaml",
50-
dom_id: "#swagger-ui",
51-
validatorUrl: null,
52-
deepLinking: true,
53-
presets: [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset],
54-
plugins: [SwaggerUIBundle.plugins.DownloadUrl],
55-
layout: "StandaloneLayout"
56-
});
57-
// End Swagger UI call region
39+
window.onload = function() {
40+
// Begin Swagger UI call region
41+
const ui = SwaggerUIBundle({
42+
url: "./modules/swagger.yaml",
43+
dom_id: '#swagger-ui',
44+
deepLinking: true,
45+
presets: [
46+
SwaggerUIBundle.presets.apis,
47+
SwaggerUIStandalonePreset
48+
],
49+
plugins: [
50+
SwaggerUIBundle.plugins.DownloadUrl
51+
],
52+
layout: "StandaloneLayout"
53+
});
54+
// End Swagger UI call region
5855

59-
window.ui = ui;
60-
};
61-
</script>
56+
window.ui = ui;
57+
};
58+
</script>
6259
</body>
6360
</html>

‎pkg/common/queue.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ func (queue SQSQueue) NewFromEnv() error {
5757
if err != nil {
5858
return err
5959
}
60-
queue.Client = sqs.New(awsSession)
60+
queue.Client = sqs.New(awsSession) //nolint
6161

6262
return nil
6363
}

0 commit comments

Comments
 (0)