Merge pull request #2426 from swagger-api/release-prepare

update swagger-js version

.jshintrc

@@ -32,6 +32,7 @@
     "SwaggerUi": false,
     "jsyaml": false,
     "define": false,
+    "sanitizeHtml": false,
 
     // Global object
     // TODO: remove these

README.md

@@ -24,7 +24,7 @@ The OpenAPI Specification has undergone 4 revisions since initial creation in 20
 
 Swagger UI Version | Release Date | OpenAPI Spec compatibility | Notes | Status
 ------------------ | ------------ | -------------------------- | ----- | ------
-2.2.2              | 2016-08-23   | 1.1, 1.2, 2.0              | [tag v.2.2.2](https://github.com/swagger-api/swagger-ui/tree/v2.2.2) |
+2.2.4              | 2016-09-20   | 1.1, 1.2, 2.0              | [tag v.2.2.4](https://github.com/swagger-api/swagger-ui/tree/v2.2.4) |
 2.1.5              | 2016-07-20   | 1.1, 1.2, 2.0              | [tag v.2.1.5](https://github.com/swagger-api/swagger-ui/tree/v2.1.5) |
 2.0.24             | 2014-09-12   | 1.1, 1.2 | [tag v2.0.24](https://github.com/swagger-api/swagger-ui/tree/v2.0.24) |
 1.0.13             | 2013-03-08   | 1.1, 1.2 | [tag v1.0.13](https://github.com/swagger-api/swagger-ui/tree/v1.0.13) |

composer.json

@@ -20,10 +20,5 @@
             "name": "Mohsen Azimi",
             "email": "me@azimi.me"
         }
-    ],
-    "extra": {
-        "branch-alias": {
-            "dev-master": "2.x-dev"
-        }
-    }
+    ]
 }

gulpfile.js

@@ -50,6 +50,7 @@ function _dist() {
   return es.merge(
     gulp.src([
         './node_modules/es5-shim/es5-shim.js',
+        './lib/sanitize-html.min.js',
         './src/main/javascript/**/*.js',
         './node_modules/swagger-client/browser/swagger-client.js'
       ]),

package.json

@@ -8,13 +8,13 @@
     }
   ],
   "description": "Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API",
-  "version": "2.2.2",
+  "version": "2.2.5",
   "homepage": "http://swagger.io",
   "license": "Apache-2.0",
   "main": "dist/swagger-ui.js",
   "scripts": {
     "build": "npm run handlebars && gulp",
-    "handlebars": "./node_modules/handlebars/bin/handlebars ./src/main/template -f ./src/main/template/templates.js && gulp handlebars",
+    "handlebars": "handlebars ./src/main/template -f ./src/main/template/templates.js && gulp handlebars",
     "serve": "gulp serve",
     "prejshint": "gulp",
     "jshint": "jshint .",
@@ -60,6 +60,6 @@
     "phantomjs": "1.9.19",
     "selenium-webdriver": "^2.45.0",
     "sinon-chai": "2.8.0",
-    "swagger-client": "2.1.18"
+    "swagger-client": "2.1.21"
   }
 }

src/main/javascript/helpers/handlebars.js

@@ -1,34 +1,22 @@
 'use strict';
 /*jslint eqeq: true*/
 
-var _sanitize = function(html) {
-    // Strip the script tags from the html and inline evenhandlers
-    html = html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
-    html = html.replace(/(on\w+="[^"]*")*(on\w+='[^']*')*(on\w+=\w*\(\w*\))*/gi, '');
+Handlebars.registerHelper('sanitize', function (text) {
+    var result;
 
-    return html;
-};
+    if (text === undefined) { return ''; }
 
-var sanitize =function (html) {
-    var _html;
+    result = sanitizeHtml(text, {
+        allowedTags: [ 'div', 'span', 'b', 'i', 'em', 'strong', 'a' ],
+        allowedAttributes: {
+            'div': [ 'class' ],
+            'span': [ 'class' ],
+            'a': [ 'href' ]
+        }
+    });
 
-    if ( _.isUndefined(html) || _.isNull(html)) {
-        return new Handlebars.SafeString('');
-    }
-
-    if (_.isNumber(html))  {
-        return new Handlebars.SafeString(html);
-    }
-
-    if (_.isObject(html)){
-        _html = JSON.stringify(html);
-        return new Handlebars.SafeString(JSON.parse(_sanitize(_html)));
-    }
-
-    return new Handlebars.SafeString(_sanitize(html));
-};
-
-Handlebars.registerHelper('sanitize', sanitize);
+    return new Handlebars.SafeString(result);
+});
 
 Handlebars.registerHelper('renderTextParam', function(param) {
     var result, type = 'text', idAtt = '';
@@ -55,7 +43,11 @@ Handlebars.registerHelper('renderTextParam', function(param) {
         idAtt = ' id=\'' + valueId + '\'';
     }
 
-    defaultValue = sanitize(defaultValue);
+    if (defaultValue) {
+      defaultValue = sanitizeHtml(defaultValue);
+    } else {
+      defaultValue = '';
+    }
 
     if(isArray) {
         result = '<textarea class=\'body-textarea' + (param.required ? ' required' : '') + '\' name=\'' + name + '\'' + idAtt + dataVendorExtensions;
@@ -101,4 +93,4 @@ Handlebars.registerHelper('escape', function (value) {
     var text = Handlebars.Utils.escapeExpression(value);
 
     return new Handlebars.SafeString(text);
-});
+});

src/main/javascript/view/MainView.js

@@ -96,7 +96,7 @@ SwaggerUi.Views.MainView = Backbone.View.extend({
         id = id + '_' + counter;
         counter += 1;
       }
-      resource.id = SwaggerUi.utils.sanitize(id);
+      resource.id = sanitizeHtml(id);
       resources[id] = resource;
       this.addResource(resource, this.model.auths);
     }

src/main/javascript/view/OperationView.js

@@ -651,6 +651,7 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
 
   // puts the response data in UI
   showStatus: function(response) {
+    console.log(response.headers);
     var url, content;
     if (response.content === undefined) {
       content = response.data;
@@ -660,7 +661,9 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
       url = response.request.url;
     }
     var headers = response.headers;
-    content = jQuery.trim(content);
+    if(typeof content === 'string') {
+      content = jQuery.trim(content);
+    }
 
     // if server is nice, and sends content-type back, we can use it
     var contentType = null;
@@ -685,6 +688,36 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
       pre = $('<pre class="json" />').append(code);
 
       // JSON
+    } else if (headers['Content-Disposition'] && (/attachment/).test(headers['Content-Disposition']) ||
+        headers['content-disposition'] && (/attachment/).test(headers['content-disposition']) ||
+        headers['Content-Description'] && (/File Transfer/).test(headers['Content-Description']) ||
+        headers['content-description'] && (/File Transfer/).test(headers['content-description'])) {
+
+      if ('Blob' in window) {
+        var type = contentType || 'text/html';
+
+        var a = document.createElement('a');
+        var href = window.URL.createObjectURL(content);
+        var fileName = response.url.substr(response.url.lastIndexOf('/') + 1);
+        var download = [type, fileName, href].join(':');
+
+        // Use filename from response header
+        var disposition = headers['content-disposition'] || headers['Content-Disposition'];
+        if(typeof disposition !== 'undefined') {
+          var responseFilename = /filename=([^;]*);?/.exec(disposition);
+          if(responseFilename !== null && responseFilename.length > 1) {
+            download = responseFilename[1];
+          }
+        }
+
+        a.setAttribute('href', href);
+        a.setAttribute('download', download);
+        a.innerText = 'Download ' + fileName;
+
+        pre = $('<div/>').append(a);
+      } else {
+        pre = $('<pre class="json" />').append('Download headers detected but your browser does not support downloading binary via XHR (Blob).');
+      }
     } else if (contentType === 'application/json' || /\+json$/.test(contentType)) {
       var json = null;
       try {
@@ -710,49 +743,17 @@ SwaggerUi.Views.OperationView = Backbone.View.extend({
       code = $('<code />').text(content);
       pre = $('<pre class="plain" />').append(code);
 
-
       // Image
     } else if (/^image\//.test(contentType)) {
-      pre = $('<img>').attr('src', url);
+      var urlCreator = window.URL || window.webkitURL;
+      var imageUrl = urlCreator.createObjectURL(content);
 
+      pre = $('<img>').attr( 'src', imageUrl);
       // Audio
     } else if (/^audio\//.test(contentType) && supportsAudioPlayback(contentType)) {
       pre = $('<audio controls>').append($('<source>').attr('src', url).attr('type', contentType));
-
-      // Download
-    } else if (headers['Content-Disposition'] && (/attachment/).test(headers['Content-Disposition']) ||
-        headers['content-disposition'] && (/attachment/).test(headers['content-disposition']) ||
-        headers['Content-Description'] && (/File Transfer/).test(headers['Content-Description']) ||
-        headers['content-description'] && (/File Transfer/).test(headers['content-description'])) {
-
-      if ('Blob' in window) {
-        var type = contentType || 'text/html';
-        var blob = new Blob([content], {type: type});
-        var a = document.createElement('a');
-        var href = window.URL.createObjectURL(blob);
-        var fileName = response.url.substr(response.url.lastIndexOf('/') + 1);
-        var download = [type, fileName, href].join(':');
-
-        // Use filename from response header
-        var disposition = headers['content-disposition'] || headers['Content-Disposition'];
-        if(typeof disposition !== 'undefined') {
-          var responseFilename = /filename=([^;]*);?/.exec(disposition);
-          if(responseFilename !== null && responseFilename.length > 1) {
-            download = responseFilename[1];
-          }
-        }
-
-        a.setAttribute('href', href);
-        a.setAttribute('download', download);
-        a.innerText = 'Download ' + fileName;
-
-        pre = $('<div/>').append(a);
-      } else {
-        pre = $('<pre class="json" />').append('Download headers detected but your browser does not support downloading binary via XHR (Blob).');
-      }
-
-      // Location header based redirect download
     } else if(headers.location || headers.Location) {
+      // Location header based redirect download
       window.location = response.url;
 
       // Anything else (CORS)

src/main/javascript/view/ParameterView.js

@@ -24,7 +24,6 @@ SwaggerUi.Views.ParameterView = Backbone.View.extend({
     var consumes = this.model.consumes || [];
     var sampleJSON, signatureView;
 
-
     if (typeof type === 'undefined') {
       if (schema.$ref) {
         var ref = schema.$ref;