Merge pull request #2426 from swagger-api/release-prepare

update swagger-js version

.jshintrc

@@ -32,6 +32,7 @@
     "SwaggerUi": false,
     "jsyaml": false,
     "define": false,
+    "sanitizeHtml": false,
 
     // Global object
     // TODO: remove these

README.md

@@ -24,7 +24,7 @@ The OpenAPI Specification has undergone 4 revisions since initial creation in 20
 
 Swagger UI Version | Release Date | OpenAPI Spec compatibility | Notes | Status
 ------------------ | ------------ | -------------------------- | ----- | ------
-2.2.1              | 2016-08-23   | 1.1, 1.2, 2.0              | [tag v.2.2.1](https://github.com/swagger-api/swagger-ui/tree/v2.2.0) |
+2.2.4              | 2016-09-20   | 1.1, 1.2, 2.0              | [tag v.2.2.4](https://github.com/swagger-api/swagger-ui/tree/v2.2.4) |
 2.1.5              | 2016-07-20   | 1.1, 1.2, 2.0              | [tag v.2.1.5](https://github.com/swagger-api/swagger-ui/tree/v2.1.5) |
 2.0.24             | 2014-09-12   | 1.1, 1.2 | [tag v2.0.24](https://github.com/swagger-api/swagger-ui/tree/v2.0.24) |
 1.0.13             | 2013-03-08   | 1.1, 1.2 | [tag v1.0.13](https://github.com/swagger-api/swagger-ui/tree/v1.0.13) |

composer.json

@@ -0,0 +1,24 @@
+{
+    "name": "swagger-api/swagger-ui",
+    "description": "Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API",
+    "keywords": [
+        "Swagger",
+        "OpenAPI",
+        "specification",
+        "documentation",
+        "API",
+        "UI"
+    ],
+    "homepage": "http://swagger.io",
+    "license": "Apache-2.0",
+    "authors": [
+        {
+            "name": "Tony Tam",
+            "email": "fehguy@gmail.com"
+        },
+        {
+            "name": "Mohsen Azimi",
+            "email": "me@azimi.me"
+        }
+    ]
+}

dist/lang/ca.js

@@ -0,0 +1,53 @@
+'use strict';
+
+/* jshint quotmark: double */
+window.SwaggerTranslator.learn({
+    "Warning: Deprecated":"Advertència: Obsolet",
+    "Implementation Notes":"Notes d'implementació",
+    "Response Class":"Classe de la Resposta",
+    "Status":"Estatus",
+    "Parameters":"Paràmetres",
+    "Parameter":"Paràmetre",
+    "Value":"Valor",
+    "Description":"Descripció",
+    "Parameter Type":"Tipus del Paràmetre",
+    "Data Type":"Tipus de la Dada",
+    "Response Messages":"Missatges de la Resposta",
+    "HTTP Status Code":"Codi d'Estatus HTTP",
+    "Reason":"Raó",
+    "Response Model":"Model de la Resposta",
+    "Request URL":"URL de la Sol·licitud",
+    "Response Body":"Cos de la Resposta",
+    "Response Code":"Codi de la Resposta",
+    "Response Headers":"Capçaleres de la Resposta",
+    "Hide Response":"Amagar Resposta",
+    "Try it out!":"Prova-ho!",
+    "Show/Hide":"Mostrar/Amagar",
+    "List Operations":"Llista Operacions",
+    "Expand Operations":"Expandir Operacions",
+    "Raw":"Cru",
+    "can't parse JSON.  Raw result":"no puc analitzar el JSON.  Resultat cru",
+    "Example Value":"Valor d'Exemple",
+    "Model Schema":"Esquema del Model",
+    "Model":"Model",
+    "apply":"aplicar",
+    "Username":"Nom d'usuari",
+    "Password":"Contrasenya",
+    "Terms of service":"Termes del servei",
+    "Created by":"Creat per",
+    "See more at":"Veure més en",
+    "Contact the developer":"Contactar amb el desenvolupador",
+    "api version":"versió de la api",
+    "Response Content Type":"Tipus de Contingut de la Resposta",
+    "fetching resource":"recollint recurs",
+    "fetching resource list":"recollins llista de recursos",
+    "Explore":"Explorant",
+    "Show Swagger Petstore Example Apis":"Mostrar API d'Exemple Swagger Petstore",
+    "Can't read from server.  It may not have the appropriate access-control-origin settings.":"No es pot llegir del servidor. Potser no teniu la configuració de control d'accés apropiada.",
+    "Please specify the protocol for":"Si us plau, especifiqueu el protocol per a",
+    "Can't read swagger JSON from":"No es pot llegir el JSON de swagger des de",
+    "Finished Loading Resource Information. Rendering Swagger UI":"Finalitzada la càrrega del recurs informatiu. Renderitzant Swagger UI",
+    "Unable to read api":"No es pot llegir l'api",
+    "from path":"des de la ruta",
+    "server returned":"el servidor ha retornat"
+});

gulpfile.js

@@ -50,6 +50,7 @@ function _dist() {
   return es.merge(
     gulp.src([
         './node_modules/es5-shim/es5-shim.js',
+        './lib/sanitize-html.min.js',
         './src/main/javascript/**/*.js',
         './node_modules/swagger-client/browser/swagger-client.js'
       ]),

lang/ca.js

@@ -0,0 +1,53 @@
+'use strict';
+
+/* jshint quotmark: double */
+window.SwaggerTranslator.learn({
+    "Warning: Deprecated":"Advertència: Obsolet",
+    "Implementation Notes":"Notes d'implementació",
+    "Response Class":"Classe de la Resposta",
+    "Status":"Estatus",
+    "Parameters":"Paràmetres",
+    "Parameter":"Paràmetre",
+    "Value":"Valor",
+    "Description":"Descripció",
+    "Parameter Type":"Tipus del Paràmetre",
+    "Data Type":"Tipus de la Dada",
+    "Response Messages":"Missatges de la Resposta",
+    "HTTP Status Code":"Codi d'Estatus HTTP",
+    "Reason":"Raó",
+    "Response Model":"Model de la Resposta",
+    "Request URL":"URL de la Sol·licitud",
+    "Response Body":"Cos de la Resposta",
+    "Response Code":"Codi de la Resposta",
+    "Response Headers":"Capçaleres de la Resposta",
+    "Hide Response":"Amagar Resposta",
+    "Try it out!":"Prova-ho!",
+    "Show/Hide":"Mostrar/Amagar",
+    "List Operations":"Llista Operacions",
+    "Expand Operations":"Expandir Operacions",
+    "Raw":"Cru",
+    "can't parse JSON.  Raw result":"no puc analitzar el JSON.  Resultat cru",
+    "Example Value":"Valor d'Exemple",
+    "Model Schema":"Esquema del Model",
+    "Model":"Model",
+    "apply":"aplicar",
+    "Username":"Nom d'usuari",
+    "Password":"Contrasenya",
+    "Terms of service":"Termes del servei",
+    "Created by":"Creat per",
+    "See more at":"Veure més en",
+    "Contact the developer":"Contactar amb el desenvolupador",
+    "api version":"versió de la api",
+    "Response Content Type":"Tipus de Contingut de la Resposta",
+    "fetching resource":"recollint recurs",
+    "fetching resource list":"recollins llista de recursos",
+    "Explore":"Explorant",
+    "Show Swagger Petstore Example Apis":"Mostrar API d'Exemple Swagger Petstore",
+    "Can't read from server.  It may not have the appropriate access-control-origin settings.":"No es pot llegir del servidor. Potser no teniu la configuració de control d'accés apropiada.",
+    "Please specify the protocol for":"Si us plau, especifiqueu el protocol per a",
+    "Can't read swagger JSON from":"No es pot llegir el JSON de swagger des de",
+    "Finished Loading Resource Information. Rendering Swagger UI":"Finalitzada la càrrega del recurs informatiu. Renderitzant Swagger UI",
+    "Unable to read api":"No es pot llegir l'api",
+    "from path":"des de la ruta",
+    "server returned":"el servidor ha retornat"
+});

package.json

@@ -8,13 +8,13 @@
     }
   ],
   "description": "Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API",
-  "version": "2.2.1",
+  "version": "2.2.5",
   "homepage": "http://swagger.io",
   "license": "Apache-2.0",
   "main": "dist/swagger-ui.js",
   "scripts": {
     "build": "npm run handlebars && gulp",
-    "handlebars": "./node_modules/handlebars/bin/handlebars ./src/main/template -f ./src/main/template/templates.js && gulp handlebars",
+    "handlebars": "handlebars ./src/main/template -f ./src/main/template/templates.js && gulp handlebars",
     "serve": "gulp serve",
     "prejshint": "gulp",
     "jshint": "jshint .",
@@ -60,6 +60,6 @@
     "phantomjs": "1.9.19",
     "selenium-webdriver": "^2.45.0",
     "sinon-chai": "2.8.0",
-    "swagger-client": "2.1.18"
+    "swagger-client": "2.1.21"
   }
 }

src/main/javascript/helpers/handlebars.js

@@ -1,34 +1,22 @@
 'use strict';
 /*jslint eqeq: true*/
 
-var _sanitize = function(html) {
-    // Strip the script tags from the html and inline evenhandlers
-    html = html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
-    html = html.replace(/(on\w+="[^"]*")*(on\w+='[^']*')*(on\w+=\w*\(\w*\))*/gi, '');
+Handlebars.registerHelper('sanitize', function (text) {
+    var result;
 
-    return html;
-};
+    if (text === undefined) { return ''; }
 
-var sanitize =function (html) {
-    var _html;
+    result = sanitizeHtml(text, {
+        allowedTags: [ 'div', 'span', 'b', 'i', 'em', 'strong', 'a' ],
+        allowedAttributes: {
+            'div': [ 'class' ],
+            'span': [ 'class' ],
+            'a': [ 'href' ]
+        }
+    });
 
-    if ( _.isUndefined(html) || _.isNull(html)) {
-        return new Handlebars.SafeString('');
-    }
-
-    if (_.isNumber(html))  {
-        return new Handlebars.SafeString(html);
-    }
-
-    if (_.isObject(html)){
-        _html = JSON.stringify(html);
-        return new Handlebars.SafeString(JSON.parse(_sanitize(_html)));
-    }
-
-    return new Handlebars.SafeString(_sanitize(html));
-};
-
-Handlebars.registerHelper('sanitize', sanitize);
+    return new Handlebars.SafeString(result);
+});
 
 Handlebars.registerHelper('renderTextParam', function(param) {
     var result, type = 'text', idAtt = '';
@@ -55,7 +43,11 @@ Handlebars.registerHelper('renderTextParam', function(param) {
         idAtt = ' id=\'' + valueId + '\'';
     }
 
-    defaultValue = sanitize(defaultValue);
+    if (defaultValue) {
+      defaultValue = sanitizeHtml(defaultValue);
+    } else {
+      defaultValue = '';
+    }
 
     if(isArray) {
         result = '<textarea class=\'body-textarea' + (param.required ? ' required' : '') + '\' name=\'' + name + '\'' + idAtt + dataVendorExtensions;
@@ -101,4 +93,4 @@ Handlebars.registerHelper('escape', function (value) {
     var text = Handlebars.Utils.escapeExpression(value);
 
     return new Handlebars.SafeString(text);
-});
+});

src/main/javascript/view/MainView.js

@@ -96,7 +96,7 @@ SwaggerUi.Views.MainView = Backbone.View.extend({
         id = id + '_' + counter;
         counter += 1;
       }
-      resource.id = SwaggerUi.utils.sanitize(id);
+      resource.id = sanitizeHtml(id);
       resources[id] = resource;
       this.addResource(resource, this.model.auths);
     }

src/main/javascript/view/OperationView.js

@@ -651,6 +651,7 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
 
   // puts the response data in UI
   showStatus: function(response) {
+    console.log(response.headers);
     var url, content;
     if (response.content === undefined) {
       content = response.data;
@@ -660,7 +661,9 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
       url = response.request.url;
     }
     var headers = response.headers;
-    content = jQuery.trim(content);
+    if(typeof content === 'string') {
+      content = jQuery.trim(content);
+    }
 
     // if server is nice, and sends content-type back, we can use it
     var contentType = null;
@@ -685,6 +688,36 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
       pre = $('<pre class="json" />').append(code);
 
       // JSON
+    } else if (headers['Content-Disposition'] && (/attachment/).test(headers['Content-Disposition']) ||
+        headers['content-disposition'] && (/attachment/).test(headers['content-disposition']) ||
+        headers['Content-Description'] && (/File Transfer/).test(headers['Content-Description']) ||
+        headers['content-description'] && (/File Transfer/).test(headers['content-description'])) {
+
+      if ('Blob' in window) {
+        var type = contentType || 'text/html';
+
+        var a = document.createElement('a');
+        var href = window.URL.createObjectURL(content);
+        var fileName = response.url.substr(response.url.lastIndexOf('/') + 1);
+        var download = [type, fileName, href].join(':');
+
+        // Use filename from response header
+        var disposition = headers['content-disposition'] || headers['Content-Disposition'];
+        if(typeof disposition !== 'undefined') {
+          var responseFilename = /filename=([^;]*);?/.exec(disposition);
+          if(responseFilename !== null && responseFilename.length > 1) {
+            download = responseFilename[1];
+          }
+        }
+
+        a.setAttribute('href', href);
+        a.setAttribute('download', download);
+        a.innerText = 'Download ' + fileName;
+
+        pre = $('<div/>').append(a);
+      } else {
+        pre = $('<pre class="json" />').append('Download headers detected but your browser does not support downloading binary via XHR (Blob).');
+      }
     } else if (contentType === 'application/json' || /\+json$/.test(contentType)) {
       var json = null;
       try {
@@ -710,49 +743,17 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
       code = $('<code />').text(content);
       pre = $('<pre class="plain" />').append(code);
 
-
       // Image
     } else if (/^image\//.test(contentType)) {
-      pre = $('<img>').attr('src', url);
+      var urlCreator = window.URL || window.webkitURL;
+      var imageUrl = urlCreator.createObjectURL(content);
 
+      pre = $('<img>').attr( 'src', imageUrl);
       // Audio
     } else if (/^audio\//.test(contentType) && supportsAudioPlayback(contentType)) {
       pre = $('<audio controls>').append($('<source>').attr('src', url).attr('type', contentType));
-
-      // Download
-    } else if (headers['Content-Disposition'] && (/attachment/).test(headers['Content-Disposition']) ||
-        headers['content-disposition'] && (/attachment/).test(headers['content-disposition']) ||
-        headers['Content-Description'] && (/File Transfer/).test(headers['Content-Description']) ||
-        headers['content-description'] && (/File Transfer/).test(headers['content-description'])) {
-
-      if ('Blob' in window) {
-        var type = contentType || 'text/html';
-        var blob = new Blob([content], {type: type});
-        var a = document.createElement('a');
-        var href = window.URL.createObjectURL(blob);
-        var fileName = response.url.substr(response.url.lastIndexOf('/') + 1);
-        var download = [type, fileName, href].join(':');
-
-        // Use filename from response header
-        var disposition = headers['content-disposition'] || headers['Content-Disposition'];
-        if(typeof disposition !== 'undefined') {
-          var responseFilename = /filename=([^;]*);?/.exec(disposition);
-          if(responseFilename !== null && responseFilename.length > 1) {
-            download = responseFilename[1];
-          }
-        }
-
-        a.setAttribute('href', href);
-        a.setAttribute('download', download);
-        a.innerText = 'Download ' + fileName;
-
-        pre = $('<div/>').append(a);
-      } else {
-        pre = $('<pre class="json" />').append('Download headers detected but your browser does not support downloading binary via XHR (Blob).');
-      }
-
-      // Location header based redirect download
     } else if(headers.location || headers.Location) {
+      // Location header based redirect download
       window.location = response.url;
 
       // Anything else (CORS)

src/main/javascript/view/ParameterView.js

@@ -24,7 +24,6 @@ SwaggerUi.Views.ParameterView = Backbone.View.extend({
     var consumes = this.model.consumes || [];
     var sampleJSON, signatureView;
 
-
     if (typeof type === 'undefined') {
       if (schema.$ref) {
         var ref = schema.$ref;

src/main/template/signature.handlebars

@@ -9,7 +9,7 @@
 
 <div class="signature-container">
   <div class="description">
-    {{{escape signature}}}
+      {{sanitize signature}}
   </div>
 
   <div class="snippet">

src/main/template/templates.js

@@ -708,8 +708,8 @@ templates['response_content_type'] = template({"1":function(container,depth0,hel
 templates['signature'] = template({"1":function(container,depth0,helpers,partials,data) {
     var stack1, alias1=depth0 != null ? depth0 : {};
 
-  return "\n<div>\n<ul class=\"signature-nav\">\n  <li><a class=\"description-link\" href=\"#\" data-sw-translate>Model</a></li>\n  <li><a class=\"snippet-link\" href=\"#\" data-sw-translate>Example Value</a></li>\n</ul>\n<div>\n\n<div class=\"signature-container\">\n  <div class=\"description\">\n    "
-    + ((stack1 = (helpers.escape || (depth0 && depth0.escape) || helpers.helperMissing).call(alias1,(depth0 != null ? depth0.signature : depth0),{"name":"escape","hash":{},"data":data})) != null ? stack1 : "")
+  return "\n<div>\n<ul class=\"signature-nav\">\n  <li><a class=\"description-link\" href=\"#\" data-sw-translate>Model</a></li>\n  <li><a class=\"snippet-link\" href=\"#\" data-sw-translate>Example Value</a></li>\n</ul>\n<div>\n\n<div class=\"signature-container\">\n  <div class=\"description\">\n      "
+    + container.escapeExpression((helpers.sanitize || (depth0 && depth0.sanitize) || helpers.helperMissing).call(alias1,(depth0 != null ? depth0.signature : depth0),{"name":"sanitize","hash":{},"data":data}))
     + "\n  </div>\n\n  <div class=\"snippet\">\n"
     + ((stack1 = helpers["if"].call(alias1,(depth0 != null ? depth0.sampleJSON : depth0),{"name":"if","hash":{},"fn":container.program(2, data, 0),"inverse":container.noop,"data":data})) != null ? stack1 : "")
     + ((stack1 = helpers["if"].call(alias1,(depth0 != null ? depth0.sampleXML : depth0),{"name":"if","hash":{},"fn":container.program(5, data, 0),"inverse":container.noop,"data":data})) != null ? stack1 : "")

test/specs/v2/formats.yaml

@@ -27,6 +27,13 @@ paths:
         - <script language="javascript">alert('8')</script>
       tags:
       - Admin tasks<script language="javascript">alert('9')</script>
+      parameters:
+      - in: query
+        name: foo
+        type: string
+      - in: query
+        name: reg
+        type: string
       responses:
         200:
           description: nothing<script language="javascript">alert('10')</script>