Merge branch 'bodnia-feature/add-sanitize-html'

Added catalan translation

.jshintrc

@@ -32,6 +32,7 @@
     "SwaggerUi": false,
     "jsyaml": false,
     "define": false,
+    "sanitizeHtml": false,
 
     // Global object
     // TODO: remove these

README.md

@@ -24,7 +24,7 @@ The OpenAPI Specification has undergone 4 revisions since initial creation in 20
 
 Swagger UI Version | Release Date | OpenAPI Spec compatibility | Notes | Status
 ------------------ | ------------ | -------------------------- | ----- | ------
-2.2.1              | 2016-08-23   | 1.1, 1.2, 2.0              | [tag v.2.2.1](https://github.com/swagger-api/swagger-ui/tree/v2.2.0) |
+2.2.2              | 2016-08-23   | 1.1, 1.2, 2.0              | [tag v.2.2.2](https://github.com/swagger-api/swagger-ui/tree/v2.2.2) |
 2.1.5              | 2016-07-20   | 1.1, 1.2, 2.0              | [tag v.2.1.5](https://github.com/swagger-api/swagger-ui/tree/v2.1.5) |
 2.0.24             | 2014-09-12   | 1.1, 1.2 | [tag v2.0.24](https://github.com/swagger-api/swagger-ui/tree/v2.0.24) |
 1.0.13             | 2013-03-08   | 1.1, 1.2 | [tag v1.0.13](https://github.com/swagger-api/swagger-ui/tree/v1.0.13) |

composer.json

@@ -0,0 +1,29 @@
+{
+    "name": "swagger-api/swagger-ui",
+    "description": "Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API",
+    "keywords": [
+        "Swagger",
+        "OpenAPI",
+        "specification",
+        "documentation",
+        "API",
+        "UI"
+    ],
+    "homepage": "http://swagger.io",
+    "license": "Apache-2.0",
+    "authors": [
+        {
+            "name": "Tony Tam",
+            "email": "fehguy@gmail.com"
+        },
+        {
+            "name": "Mohsen Azimi",
+            "email": "me@azimi.me"
+        }
+    ],
+    "extra": {
+        "branch-alias": {
+            "dev-master": "2.x-dev"
+        }
+    }
+}

dist/lang/ca.js

@@ -0,0 +1,53 @@
+'use strict';
+
+/* jshint quotmark: double */
+window.SwaggerTranslator.learn({
+    "Warning: Deprecated":"Advertència: Obsolet",
+    "Implementation Notes":"Notes d'implementació",
+    "Response Class":"Classe de la Resposta",
+    "Status":"Estatus",
+    "Parameters":"Paràmetres",
+    "Parameter":"Paràmetre",
+    "Value":"Valor",
+    "Description":"Descripció",
+    "Parameter Type":"Tipus del Paràmetre",
+    "Data Type":"Tipus de la Dada",
+    "Response Messages":"Missatges de la Resposta",
+    "HTTP Status Code":"Codi d'Estatus HTTP",
+    "Reason":"Raó",
+    "Response Model":"Model de la Resposta",
+    "Request URL":"URL de la Sol·licitud",
+    "Response Body":"Cos de la Resposta",
+    "Response Code":"Codi de la Resposta",
+    "Response Headers":"Capçaleres de la Resposta",
+    "Hide Response":"Amagar Resposta",
+    "Try it out!":"Prova-ho!",
+    "Show/Hide":"Mostrar/Amagar",
+    "List Operations":"Llista Operacions",
+    "Expand Operations":"Expandir Operacions",
+    "Raw":"Cru",
+    "can't parse JSON.  Raw result":"no puc analitzar el JSON.  Resultat cru",
+    "Example Value":"Valor d'Exemple",
+    "Model Schema":"Esquema del Model",
+    "Model":"Model",
+    "apply":"aplicar",
+    "Username":"Nom d'usuari",
+    "Password":"Contrasenya",
+    "Terms of service":"Termes del servei",
+    "Created by":"Creat per",
+    "See more at":"Veure més en",
+    "Contact the developer":"Contactar amb el desenvolupador",
+    "api version":"versió de la api",
+    "Response Content Type":"Tipus de Contingut de la Resposta",
+    "fetching resource":"recollint recurs",
+    "fetching resource list":"recollins llista de recursos",
+    "Explore":"Explorant",
+    "Show Swagger Petstore Example Apis":"Mostrar API d'Exemple Swagger Petstore",
+    "Can't read from server.  It may not have the appropriate access-control-origin settings.":"No es pot llegir del servidor. Potser no teniu la configuració de control d'accés apropiada.",
+    "Please specify the protocol for":"Si us plau, especifiqueu el protocol per a",
+    "Can't read swagger JSON from":"No es pot llegir el JSON de swagger des de",
+    "Finished Loading Resource Information. Rendering Swagger UI":"Finalitzada la càrrega del recurs informatiu. Renderitzant Swagger UI",
+    "Unable to read api":"No es pot llegir l'api",
+    "from path":"des de la ruta",
+    "server returned":"el servidor ha retornat"
+});

gulpfile.js

@@ -50,6 +50,7 @@ function _dist() {
   return es.merge(
     gulp.src([
         './node_modules/es5-shim/es5-shim.js',
+        './lib/sanitize-html.min.js',
         './src/main/javascript/**/*.js',
         './node_modules/swagger-client/browser/swagger-client.js'
       ]),

lang/ca.js

@@ -0,0 +1,53 @@
+'use strict';
+
+/* jshint quotmark: double */
+window.SwaggerTranslator.learn({
+    "Warning: Deprecated":"Advertència: Obsolet",
+    "Implementation Notes":"Notes d'implementació",
+    "Response Class":"Classe de la Resposta",
+    "Status":"Estatus",
+    "Parameters":"Paràmetres",
+    "Parameter":"Paràmetre",
+    "Value":"Valor",
+    "Description":"Descripció",
+    "Parameter Type":"Tipus del Paràmetre",
+    "Data Type":"Tipus de la Dada",
+    "Response Messages":"Missatges de la Resposta",
+    "HTTP Status Code":"Codi d'Estatus HTTP",
+    "Reason":"Raó",
+    "Response Model":"Model de la Resposta",
+    "Request URL":"URL de la Sol·licitud",
+    "Response Body":"Cos de la Resposta",
+    "Response Code":"Codi de la Resposta",
+    "Response Headers":"Capçaleres de la Resposta",
+    "Hide Response":"Amagar Resposta",
+    "Try it out!":"Prova-ho!",
+    "Show/Hide":"Mostrar/Amagar",
+    "List Operations":"Llista Operacions",
+    "Expand Operations":"Expandir Operacions",
+    "Raw":"Cru",
+    "can't parse JSON.  Raw result":"no puc analitzar el JSON.  Resultat cru",
+    "Example Value":"Valor d'Exemple",
+    "Model Schema":"Esquema del Model",
+    "Model":"Model",
+    "apply":"aplicar",
+    "Username":"Nom d'usuari",
+    "Password":"Contrasenya",
+    "Terms of service":"Termes del servei",
+    "Created by":"Creat per",
+    "See more at":"Veure més en",
+    "Contact the developer":"Contactar amb el desenvolupador",
+    "api version":"versió de la api",
+    "Response Content Type":"Tipus de Contingut de la Resposta",
+    "fetching resource":"recollint recurs",
+    "fetching resource list":"recollins llista de recursos",
+    "Explore":"Explorant",
+    "Show Swagger Petstore Example Apis":"Mostrar API d'Exemple Swagger Petstore",
+    "Can't read from server.  It may not have the appropriate access-control-origin settings.":"No es pot llegir del servidor. Potser no teniu la configuració de control d'accés apropiada.",
+    "Please specify the protocol for":"Si us plau, especifiqueu el protocol per a",
+    "Can't read swagger JSON from":"No es pot llegir el JSON de swagger des de",
+    "Finished Loading Resource Information. Rendering Swagger UI":"Finalitzada la càrrega del recurs informatiu. Renderitzant Swagger UI",
+    "Unable to read api":"No es pot llegir l'api",
+    "from path":"des de la ruta",
+    "server returned":"el servidor ha retornat"
+});

package.json

@@ -8,7 +8,7 @@
     }
   ],
   "description": "Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "homepage": "http://swagger.io",
   "license": "Apache-2.0",
   "main": "dist/swagger-ui.js",

src/main/javascript/helpers/handlebars.js

@@ -1,34 +1,22 @@
 'use strict';
 /*jslint eqeq: true*/
 
-var _sanitize = function(html) {
-    // Strip the script tags from the html and inline evenhandlers
-    html = html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
-    html = html.replace(/(on\w+="[^"]*")*(on\w+='[^']*')*(on\w+=\w*\(\w*\))*/gi, '');
+Handlebars.registerHelper('sanitize', function (text) {
+    var result;
 
-    return html;
-};
+    if (text === undefined) { return ''; }
 
-var sanitize =function (html) {
-    var _html;
+    result = sanitizeHtml(text, {
+        allowedTags: [ 'div', 'span', 'b', 'i', 'em', 'strong', 'a' ],
+        allowedAttributes: {
+            'div': [ 'class' ],
+            'span': [ 'class' ],
+            'a': [ 'href' ]
+        }
+    });
 
-    if ( _.isUndefined(html) || _.isNull(html)) {
-        return new Handlebars.SafeString('');
-    }
-
-    if (_.isNumber(html))  {
-        return new Handlebars.SafeString(html);
-    }
-
-    if (_.isObject(html)){
-        _html = JSON.stringify(html);
-        return new Handlebars.SafeString(JSON.parse(_sanitize(_html)));
-    }
-
-    return new Handlebars.SafeString(_sanitize(html));
-};
-
-Handlebars.registerHelper('sanitize', sanitize);
+    return new Handlebars.SafeString(result);
+});
 
 Handlebars.registerHelper('renderTextParam', function(param) {
     var result, type = 'text', idAtt = '';
@@ -55,7 +43,7 @@ Handlebars.registerHelper('renderTextParam', function(param) {
         idAtt = ' id=\'' + valueId + '\'';
     }
 
-    defaultValue = sanitize(defaultValue);
+    defaultValue = sanitizeHtml(defaultValue);
 
     if(isArray) {
         result = '<textarea class=\'body-textarea' + (param.required ? ' required' : '') + '\' name=\'' + name + '\'' + idAtt + dataVendorExtensions;

src/main/javascript/view/MainView.js

@@ -96,7 +96,7 @@ SwaggerUi.Views.MainView = Backbone.View.extend({
         id = id + '_' + counter;
         counter += 1;
       }
-      resource.id = SwaggerUi.utils.sanitize(id);
+      resource.id = sanitizeHtml(id);
       resources[id] = resource;
       this.addResource(resource, this.model.auths);
     }

src/main/template/signature.handlebars

@@ -9,7 +9,7 @@
 
 <div class="signature-container">
   <div class="description">
-    {{{escape signature}}}
+      {{sanitize signature}}
   </div>
 
   <div class="snippet">

src/main/template/templates.js

@@ -708,8 +708,8 @@ templates['response_content_type'] = template({"1":function(container,depth0,hel
 templates['signature'] = template({"1":function(container,depth0,helpers,partials,data) {
     var stack1, alias1=depth0 != null ? depth0 : {};
 
-  return "\n<div>\n<ul class=\"signature-nav\">\n  <li><a class=\"description-link\" href=\"#\" data-sw-translate>Model</a></li>\n  <li><a class=\"snippet-link\" href=\"#\" data-sw-translate>Example Value</a></li>\n</ul>\n<div>\n\n<div class=\"signature-container\">\n  <div class=\"description\">\n    "
-    + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || helpers.helperMissing).call(alias1,(depth0 != null ? depth0.signature : depth0),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
+  return "\n<div>\n<ul class=\"signature-nav\">\n  <li><a class=\"description-link\" href=\"#\" data-sw-translate>Model</a></li>\n  <li><a class=\"snippet-link\" href=\"#\" data-sw-translate>Example Value</a></li>\n</ul>\n<div>\n\n<div class=\"signature-container\">\n  <div class=\"description\">\n      "
+    + container.escapeExpression((helpers.sanitize || (depth0 && depth0.sanitize) || helpers.helperMissing).call(alias1,(depth0 != null ? depth0.signature : depth0),{"name":"sanitize","hash":{},"data":data}))
     + "\n  </div>\n\n  <div class=\"snippet\">\n"
     + ((stack1 = helpers["if"].call(alias1,(depth0 != null ? depth0.sampleJSON : depth0),{"name":"if","hash":{},"fn":container.program(2, data, 0),"inverse":container.noop,"data":data})) != null ? stack1 : "")
     + ((stack1 = helpers["if"].call(alias1,(depth0 != null ? depth0.sampleXML : depth0),{"name":"if","hash":{},"fn":container.program(5, data, 0),"inverse":container.noop,"data":data})) != null ? stack1 : "")

test/specs/v2/formats.yaml

@@ -27,6 +27,13 @@ paths:
         - <script language="javascript">alert('8')</script>
       tags:
       - Admin tasks<script language="javascript">alert('9')</script>
+      parameters:
+      - in: query
+        name: foo
+        type: string
+      - in: query
+        name: reg
+        type: string
       responses:
         200:
           description: nothing<script language="javascript">alert('10')</script>