Merge branch 'master' of github.com:swagger-api/swagger-ui into ft/performance

test/components/markdown.js

@@ -0,0 +1,54 @@
+/* eslint-env mocha */
+import React from "react"
+import expect from "expect"
+import { render } from "enzyme"
+import Markdown from "components/providers/markdown"
+import { Markdown as OAS3Markdown } from "corePlugins/oas3/wrap-components/markdown.js"
+
+describe("Markdown component", function() {
+    describe("Swagger 2.0", function() {
+        it("allows image elements", function() {
+            const str = `![Image alt text](http://image.source "Image title")`
+            const el = render(<Markdown source={str} />)
+            expect(el.html()).toEqual(`<div class="markdown"><p><img src="http://image.source" title="Image title"></p>\n</div>`)
+        })
+
+        it("allows heading elements", function() {
+            const str = `
+# h1
+## h2
+### h3
+#### h4
+##### h5
+###### h6`
+            const el = render(<Markdown source={str} />)
+            expect(el.html()).toEqual(`<div class="markdown"><h1>h1</h1>\n<h2>h2</h2>\n<h3>h3</h3>\n<h4>h4</h4>\n<h5>h5</h5>\n<h6>h6</h6>\n</div>`)
+        })
+
+        it("allows links", function() {
+            const str = `[Link](https://example.com/)`
+            const el = render(<Markdown source={str} />)
+            expect(el.html()).toEqual(`<div class="markdown"><p><a href="https://example.com/" target="_blank">Link</a></p>\n</div>`)
+        })
+    })
+
+    describe("OAS 3", function() {
+        it("allows image elements", function() {
+            const str = `![Image alt text](http://image.source "Image title")`
+            const el = render(<OAS3Markdown source={str} />)
+            expect(el.html()).toEqual(`<div class="renderedMarkdown"><div><p><img src="http://image.source" title="Image title"></p></div></div>`)
+        })
+
+        it("allows heading elements", function() {
+            const str = `
+# h1
+## h2
+### h3
+#### h4
+##### h5
+###### h6`
+            const el = render(<OAS3Markdown source={str} />)
+            expect(el.html()).toEqual(`<div class="renderedMarkdown"><div><h1>h1</h1>\n<h2>h2</h2>\n<h3>h3</h3>\n<h4>h4</h4>\n<h5>h5</h5>\n<h6>h6</h6></div></div>`)
+        })
+    })
+})

test/components/model-example.js

@@ -0,0 +1,116 @@
+/* eslint-env mocha */
+import React from "react"
+import expect, { createSpy } from "expect"
+import { shallow } from "enzyme"
+import ModelExample from "components/model-example"
+import ModelComponent from "components/model-wrapper"
+
+describe("<ModelExample/>", function(){
+  // Given
+  let components = {
+    ModelWrapper: ModelComponent
+  }
+  let props = {
+    getComponent: (c) => {
+        return components[c]
+    },
+    specSelectors: {},
+    schema: {},
+    example: "{\"example\": \"value\"}",
+    isExecute: false,
+    getConfigs: () => ({
+      defaultModelRendering: "model",
+      defaultModelExpandDepth: 1
+    })
+  }
+  let exampleSelectedTestInputs = [
+    { defaultModelRendering: "model", isExecute: true },
+    { defaultModelRendering: "example", isExecute: true },
+    { defaultModelRendering: "example", isExecute: false },
+    { defaultModelRendering: "othervalue", isExecute: true },
+    { defaultModelRendering: "othervalue", isExecute: false }
+  ]
+  let modelSelectedTestInputs = [
+    { defaultModelRendering: "model", isExecute: false }
+  ]
+
+
+  it("renders model and example tabs", function(){
+    // When
+    let wrapper = shallow(<ModelExample {...props}/>)
+
+    // Then should render tabs
+    expect(wrapper.find("div > ul.tab").length).toEqual(1)
+
+    let tabs = wrapper.find("div > ul.tab").children()
+    expect(tabs.length).toEqual(2)
+    tabs.forEach((node) => {
+      expect(node.length).toEqual(1)
+      expect(node.name()).toEqual("li")
+      expect(node.hasClass("tabitem")).toEqual(true)
+    })
+    expect(tabs.at(0).text()).toEqual("Example Value")
+    expect(tabs.at(1).text()).toEqual("Model")
+  })
+
+  exampleSelectedTestInputs.forEach(function(testInputs) {
+    it("example tab is selected if isExecute = " + testInputs.isExecute + " and defaultModelRendering = " + testInputs.defaultModelRendering, function(){
+      // When
+      props.isExecute = testInputs.isExecute
+      props.getConfigs = () => ({
+        defaultModelRendering: testInputs.defaultModelRendering,
+        defaultModelExpandDepth: 1
+      })
+      let wrapper = shallow(<ModelExample {...props}/>)
+
+      // Then
+      let tabs = wrapper.find("div > ul.tab").children()
+
+      let exampleTab = tabs.at(0)
+      expect(exampleTab.hasClass("active")).toEqual(true)
+      let modelTab = tabs.at(1)
+      expect(modelTab.hasClass("active")).toEqual(false)
+
+      expect(wrapper.find("div > div").length).toEqual(1)
+      expect(wrapper.find("div > div").text()).toEqual(props.example)
+    })
+  })
+
+  modelSelectedTestInputs.forEach(function(testInputs) {
+    it("model tab is selected if isExecute = " + testInputs.isExecute + " and defaultModelRendering = " + testInputs.defaultModelRendering, function(){
+      // When
+      props.isExecute = testInputs.isExecute
+      props.getConfigs = () => ({
+        defaultModelRendering: testInputs.defaultModelRendering,
+        defaultModelExpandDepth: 1
+      })
+      let wrapper = shallow(<ModelExample {...props}/>)
+
+      // Then
+      let tabs = wrapper.find("div > ul.tab").children()
+
+      let exampleTab = tabs.at(0)
+      expect(exampleTab.hasClass("active")).toEqual(false)
+      let modelTab = tabs.at(1)
+      expect(modelTab.hasClass("active")).toEqual(true)
+
+      expect(wrapper.find("div > div").length).toEqual(1)
+      expect(wrapper.find("div > div").find(ModelComponent).props().expandDepth).toBe(1)
+    })
+  })
+
+  it("passes defaultModelExpandDepth to ModelComponent", function(){
+      // When
+      let expandDepth = 0
+      props.isExecute = false
+      props.getConfigs = () => ({
+        defaultModelRendering: "model",
+        defaultModelExpandDepth: expandDepth
+      })
+      let wrapper = shallow(<ModelExample {...props}/>)
+
+      // Then
+      expect(wrapper.find("div > div").find(ModelComponent).props().expandDepth).toBe(expandDepth)
+  })
+
+})

test/components/models.js

@@ -0,0 +1,51 @@
+/* eslint-env mocha */
+import React from "react"
+import expect, { createSpy } from "expect"
+import { shallow } from "enzyme"
+import { fromJS } from "immutable"
+import Models from "components/models"
+import ModelCollpase from "components/model-collapse"
+import ModelComponent from "components/model-wrapper"
+
+describe("<Models/>", function(){
+  // Given
+  let components = {
+    Collapse: ModelCollpase,
+    ModelWrapper: ModelComponent
+  }
+  let props = {
+    getComponent: (c) => {
+        return components[c]
+    },
+    specSelectors: {
+      definitions: function() {
+        return fromJS({
+          def1: {},
+          def2: {}
+        })
+      }
+    },
+    layoutSelectors: {
+      isShown: createSpy()
+    },
+    layoutActions: {},
+    getConfigs: () => ({
+      docExpansion: "list",
+      defaultModelExpandDepth: 0
+    })
+  }
+
+
+  it("passes defaultModelExpandDepth to ModelWrapper", function(){
+    // When
+    let wrapper = shallow(<Models {...props}/>)
+
+    // Then should render tabs
+    expect(wrapper.find("ModelCollapse").length).toEqual(1)
+    expect(wrapper.find("ModelComponent").length).toBeGreaterThan(0)
+    wrapper.find("ModelComponent").forEach((modelWrapper) => {
+      expect(modelWrapper.props().expandDepth).toBe(0)
+    })
+  })
+
+})

test/components/primitive-model.js

@@ -0,0 +1,49 @@
+/* eslint-env mocha */
+import React from "react"
+import expect from "expect"
+import { shallow } from "enzyme"
+import { fromJS } from "immutable"
+import PrimitiveModel from "components/primitive-model"
+
+describe("<PrimitiveModel/>", function() {
+    describe("Model name", function() {
+        const dummyComponent = () => null
+        const components = {
+            Markdown: dummyComponent,
+            EnumModel: dummyComponent
+        }
+        const props = {
+            getComponent: c => components[c],
+            name: "Name from props",
+            depth: 1,
+            schema: fromJS({
+                type: "string",
+                title: "Custom model title"
+            })
+        }
+
+        it("renders the schema's title", function() {
+            // When
+            const wrapper = shallow(<PrimitiveModel {...props}/>)
+            const modelTitleEl = wrapper.find("span.model-title")
+            expect(modelTitleEl.length).toEqual(1)
+
+            // Then
+            expect( modelTitleEl.text() ).toEqual( "Custom model title" )
+        })
+
+        it("falls back to the passed-in `name` prop for the title", function() {
+            // When
+            props.schema = fromJS({
+                type: "string"
+            })
+            const wrapper = shallow(<PrimitiveModel {...props}/>)
+            const modelTitleEl = wrapper.find("span.model-title")
+            expect(modelTitleEl.length).toEqual(1)
+
+            // Then
+            expect( modelTitleEl.text() ).toEqual( "Name from props" )
+        })
+
+    })
+} )

test/core/oauth2-authorize.js

@@ -0,0 +1,39 @@
+/* eslint-env mocha */
+import expect, { createSpy } from "expect"
+import { fromJS } from "immutable"
+import win from "core/window"
+import oauth2Authorize from "core/oauth2-authorize"
+
+describe("oauth2", function () {
+
+  let mockSchema = {
+    flow: "accessCode",
+    authorizationUrl: "https://testAuthorizationUrl"
+  }
+
+  let authConfig = {
+    auth: { schema: { get: (key)=> mockSchema[key] } }, 
+    authActions: {}, 
+    errActions: {}, 
+    configs: { oauth2RedirectUrl: "" }, 
+    authConfigs: {}
+  }
+
+  describe("authorize redirect", function () {
+
+    it("should build authorize url", function() {
+      win.open = createSpy()
+      oauth2Authorize(authConfig)
+      expect(win.open.calls.length).toEqual(1)
+      expect(win.open.calls[0].arguments[0]).toMatch("https://testAuthorizationUrl?response_type=code&redirect_uri=&state=")
+    })
+
+    it("should append query paramters to authorizeUrl with query parameters", function() {
+      win.open = createSpy()
+      mockSchema.authorizationUrl = "https://testAuthorizationUrl?param=1"
+      oauth2Authorize(authConfig)
+      expect(win.open.calls.length).toEqual(1)
+      expect(win.open.calls[0].arguments[0]).toMatch("https://testAuthorizationUrl?param=1&response_type=code&redirect_uri=&state=")
+    })
+  })
+})

test/core/plugins/oas3/wrap-auth-selectors.js

@@ -0,0 +1,116 @@
+/* eslint-env mocha */
+import expect, { createSpy } from "expect"
+import { Map, fromJS } from "immutable"
+import {
+  definitionsToAuthorize
+} from "corePlugins/oas3/auth-extensions/wrap-selectors"
+
+describe("oas3 plugin - auth extensions - wrapSelectors", function(){
+
+  describe("execute", function(){
+
+    it("should add `securities` to the oriAction call", function(){
+      // Given
+      const system = {
+        getSystem: () => system,
+        specSelectors: {
+          specJson: () => fromJS({
+            openapi: "3.0.0"
+          }),
+          securityDefinitions: () => {
+            return fromJS({
+              "oauth2AuthorizationCode": {
+                "type": "oauth2",
+                "flows": {
+                  "authorizationCode": {
+                    "authorizationUrl": "http://google.com/",
+                    "tokenUrl": "http://google.com/",
+                    "scopes": {
+                      "myScope": "our only scope"
+                    }
+                  }
+                }
+              },
+              "oauth2Multiflow": {
+                "type": "oauth2",
+                "flows": {
+                  "clientCredentials": {
+                    "tokenUrl": "http://google.com/",
+                    "scopes": {
+                      "myScope": "our only scope"
+                    }
+                  },
+                  "password": {
+                    "tokenUrl": "http://google.com/",
+                    "scopes": {
+                      "myScope": "our only scope"
+                    }
+                  },
+                  "authorizationCode": {
+                    "authorizationUrl": "http://google.com/",
+                    "tokenUrl": "http://google.com/",
+                    "scopes": {
+                      "myScope": "our only scope"
+                    }
+                  }
+                }
+              }
+            })
+          }
+        }
+      }
+
+      // When
+      let res = definitionsToAuthorize(() => null, system)()
+
+      // Then
+      expect(res.toJS()).toEqual([
+        {
+          oauth2AuthorizationCode: {
+            flow: "authorizationCode",
+            authorizationUrl: "http://google.com/",
+            tokenUrl: "http://google.com/",
+            scopes: {
+              "myScope": "our only scope"
+            },
+            type: "oauth2"
+          }
+        },
+        {
+          oauth2Multiflow: {
+            flow: "clientCredentials",
+            tokenUrl: "http://google.com/",
+            scopes: {
+              "myScope": "our only scope"
+            },
+            type: "oauth2"
+          }
+        },
+        {
+          oauth2Multiflow: {
+            flow: "password",
+            tokenUrl: "http://google.com/",
+            scopes: {
+              "myScope": "our only scope"
+            },
+            type: "oauth2"
+          }
+        },
+        {
+          oauth2Multiflow: {
+            flow: "authorizationCode",
+            authorizationUrl: "http://google.com/",
+            tokenUrl: "http://google.com/",
+            scopes: {
+              "myScope": "our only scope"
+            },
+            type: "oauth2"
+          }
+        },
+      ])
+
+    })
+
+  })
+
+})

test/core/plugins/spec/selectors.js

@@ -29,8 +29,8 @@ describe("spec plugin - selectors", function(){
             "/one": {
               get: {
                 parameters: [
-                  { name: "one", value: 1},
-                  { name: "two", value: "duos"}
+                  { name: "one", in: "query", value: 1},
+                  { name: "two", in: "query", value: "duos"}
                 ]
               }
             }
@@ -43,8 +43,8 @@ describe("spec plugin - selectors", function(){
 
       // Then
       expect(paramValues.toJS()).toEqual({
-        one: 1,
-        two: "duos"
+        "query.one": 1,
+        "query.two": "duos"
       })
 
     })

test/core/utils.js

@@ -1,7 +1,23 @@
 /* eslint-env mocha */
 import expect from "expect"
 import { fromJS, OrderedMap } from "immutable"
-import { mapToList, validateNumber, validateInteger, validateParam, validateFile, fromJSOrdered, getAcceptControllingResponse, createDeepLinkPath, escapeDeepLinkPath } from "core/utils"
+import {
+  mapToList,
+  validateMinLength,
+  validateMaxLength,
+  validateDateTime,
+  validateGuid,
+  validateNumber,
+  validateInteger,
+  validateParam,
+  validateFile,
+  validateMaximum,
+  validateMinimum,
+  fromJSOrdered,
+  getAcceptControllingResponse,
+  createDeepLinkPath,
+  escapeDeepLinkPath
+} from "core/utils"
 import win from "core/window"
 
 describe("utils", function() {
@@ -72,6 +88,36 @@ describe("utils", function() {
 
   })
 
+  describe("validateMaximum", function() {
+    let errorMessage = "Value must be less than Maximum"
+
+    it("doesn't return for valid input", function() {
+      expect(validateMaximum(9, 10)).toBeFalsy()
+      expect(validateMaximum(19, 20)).toBeFalsy()
+    })
+
+    it("returns a message for invalid input", function() {
+      expect(validateMaximum(1, 0)).toEqual(errorMessage)
+      expect(validateMaximum(10, 9)).toEqual(errorMessage)
+      expect(validateMaximum(20, 19)).toEqual(errorMessage)
+    })
+  })
+
+  describe("validateMinimum", function() {
+    let errorMessage = "Value must be greater than Minimum"
+
+    it("doesn't return for valid input", function() {
+      expect(validateMinimum(2, 1)).toBeFalsy()
+      expect(validateMinimum(20, 10)).toBeFalsy()
+    })
+
+    it("returns a message for invalid input", function() {
+      expect(validateMinimum(-1, 0)).toEqual(errorMessage)
+      expect(validateMinimum(1, 2)).toEqual(errorMessage)
+      expect(validateMinimum(10, 20)).toEqual(errorMessage)
+    })
+  })
+
   describe("validateNumber", function() {
     let errorMessage = "Value must be a number"
 
@@ -158,7 +204,7 @@ describe("utils", function() {
     })
   })
 
-   describe("validateFile", function() {
+  describe("validateFile", function() {
     let errorMessage = "Value must be a file"
 
     it("validates against objects which are instances of 'File'", function() {
@@ -171,388 +217,498 @@ describe("utils", function() {
     })
    })
 
+   describe("validateDateTime", function() {
+    let errorMessage = "Value must be a DateTime"
+
+    it("doesn't return for valid dates", function() {
+      expect(validateDateTime("Mon, 25 Dec 1995 13:30:00 +0430")).toBeFalsy()
+    })
+
+    it("returns a message for invalid input'", function() {
+      expect(validateDateTime(null)).toEqual(errorMessage)
+      expect(validateDateTime("string")).toEqual(errorMessage)
+    })
+   })
+
+  describe("validateGuid", function() {
+    let errorMessage = "Value must be a Guid"
+
+    it("doesn't return for valid guid", function() {
+      expect(validateGuid("8ce4811e-cec5-4a29-891a-15d1917153c1")).toBeFalsy()
+      expect(validateGuid("{8ce4811e-cec5-4a29-891a-15d1917153c1}")).toBeFalsy()
+    })
+
+    it("returns a message for invalid input'", function() {
+      expect(validateGuid(1)).toEqual(errorMessage)
+      expect(validateGuid("string")).toEqual(errorMessage)
+    })
+   })
+
+   describe("validateMaxLength", function() {
+    let errorMessage = "Value must be less than MaxLength"
+
+    it("doesn't return for valid guid", function() {
+      expect(validateMaxLength("a", 1)).toBeFalsy()
+      expect(validateMaxLength("abc", 5)).toBeFalsy()
+    })
+
+    it("returns a message for invalid input'", function() {
+      expect(validateMaxLength("abc", 0)).toEqual(errorMessage)
+      expect(validateMaxLength("abc", 1)).toEqual(errorMessage)
+      expect(validateMaxLength("abc", 2)).toEqual(errorMessage)
+    })
+   })
+
+   describe("validateMinLength", function() {
+    let errorMessage = "Value must be greater than MinLength"
+
+    it("doesn't return for valid guid", function() {
+      expect(validateMinLength("a", 1)).toBeFalsy()
+      expect(validateMinLength("abc", 2)).toBeFalsy()
+    })
+
+    it("returns a message for invalid input'", function() {
+      expect(validateMinLength("abc", 5)).toEqual(errorMessage)
+      expect(validateMinLength("abc", 8)).toEqual(errorMessage)
+    })
+   })
+
   describe("validateParam", function() {
     let param = null
     let result = null
 
-    it("skips validation when `type` is not specified", function() {
-      // invalid type
+    const assertValidateParam = (param, expectedError) => {
+      // Swagger 2.0 version
+      result = validateParam( fromJS(param), false )
+      expect( result ).toEqual( expectedError )
+
+      // OAS3 version, using `schema` sub-object
+      let oas3Param = {
+        value: param.value,
+        required: param.required,
+        schema: {
+          ...param,
+          value: undefined,
+          required: undefined
+        }
+      }
+      result = validateParam( fromJS(oas3Param), false, true )
+      expect( result ).toEqual( expectedError )
+    }
+
+    it("should check the isOAS3 flag when validating parameters", function() {
+      // This should "skip" validation because there is no `schema.type` property
+      // and we are telling `validateParam` this is an OAS3 spec
       param = fromJS({
-        required: false,
-        type: undefined,
-        value: ""
+        value: "",
+        required: true,
+        schema: {
+          notTheTypeProperty: "string"
+        }
       })
-      result = validateParam( param, false )
+      result = validateParam( param, false, true )
       expect( result ).toEqual( [] )
     })
 
     it("validates required strings", function() {
       // invalid string
-      param = fromJS({
+      param = {
         required: true,
         type: "string",
         value: ""
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
-            // valid string
-      param = fromJS({
+      // valid string
+      param = {
         required: true,
         type: "string",
         value: "test string"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
+
+      // valid string with min and max length
+      param = {
+        required: true,
+        type: "string",
+        value: "test string",
+        maxLength: 50,
+        minLength: 1
+      }
+      assertValidateParam(param, [])
+    })
+
+    it("validates required strings with min and max length", function() {
+      // invalid string with max length
+      param = {
+        required: true,
+        type: "string",
+        value: "test string",
+        maxLength: 5
+      }
+      assertValidateParam(param, ["Value must be less than MaxLength"])
+
+      // invalid string with max length 0
+      param = {
+        required: true,
+        type: "string",
+        value: "test string",
+        maxLength: 0
+      }
+      assertValidateParam(param, ["Value must be less than MaxLength"])
+
+      // invalid string with min length
+      param = {
+        required: true,
+        type: "string",
+        value: "test string",
+        minLength: 50
+      }
+      assertValidateParam(param, ["Value must be greater than MinLength"])
     })
 
     it("validates optional strings", function() {
       // valid (empty) string
-      param = fromJS({
+      param = {
         required: false,
         type: "string",
         value: ""
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // valid string
-      param = fromJS({
+      param = {
         required: false,
         type: "string",
         value: "test"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates required files", function() {
       // invalid file
-      param = fromJS({
+      param = {
         required: true,
         type: "file",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // valid file
-      param = fromJS({
+      param = {
         required: true,
         type: "file",
         value: new win.File()
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates optional files", function() {
       // invalid file
-      param = fromJS({
+      param = {
         required: false,
         type: "file",
         value: "not a file"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Value must be a file"] )
+      }
+      assertValidateParam(param, ["Value must be a file"])
 
       // valid (empty) file
-      param = fromJS({
+      param = {
         required: false,
         type: "file",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // valid file
-      param = fromJS({
+      param = {
         required: false,
         type: "file",
         value: new win.File()
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates required arrays", function() {
       // invalid (empty) array
-      param = fromJS({
+      param = {
         required: true,
         type: "array",
         value: []
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // invalid (not an array)
-      param = fromJS({
+      param = {
         required: true,
         type: "array",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // invalid array, items do not match correct type
-      param = fromJS({
+      param = {
         required: true,
         type: "array",
         value: [1],
         items: {
           type: "string"
         }
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [{index: 0, error: "Value must be a string"}] )
+      }
+      assertValidateParam(param, [{index: 0, error: "Value must be a string"}])
 
       // valid array, with no 'type' for items
-      param = fromJS({
+      param = {
         required: true,
         type: "array",
         value: ["1"]
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // valid array, items match type
-      param = fromJS({
+      param = {
         required: true,
         type: "array",
         value: ["1"],
         items: {
           type: "string"
         }
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates optional arrays", function() {
       // valid, empty array
-      param = fromJS({
+      param = {
         required: false,
         type: "array",
         value: []
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // invalid, items do not match correct type
-      param = fromJS({
+      param = {
         required: false,
         type: "array",
         value: ["number"],
         items: {
           type: "number"
         }
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [{index: 0, error: "Value must be a number"}] )
+      }
+      assertValidateParam(param, [{index: 0, error: "Value must be a number"}])
 
       // valid
-      param = fromJS({
+      param = {
         required: false,
         type: "array",
         value: ["test"],
         items: {
           type: "string"
         }
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates required booleans", function() {
       // invalid boolean value
-      param = fromJS({
+      param = {
         required: true,
         type: "boolean",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // invalid boolean value (not a boolean)
-      param = fromJS({
+      param = {
         required: true,
         type: "boolean",
         value: "test string"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // valid boolean value
-      param = fromJS({
+      param = {
         required: true,
         type: "boolean",
         value: "true"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // valid boolean value
-      param = fromJS({
+      param = {
         required: true,
         type: "boolean",
         value: false
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates optional booleans", function() {
       // valid (empty) boolean value
-      param = fromJS({
+      param = {
         required: false,
         type: "boolean",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // invalid boolean value (not a boolean)
-      param = fromJS({
+      param = {
         required: false,
         type: "boolean",
         value: "test string"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Value must be a boolean"] )
+      }
+      assertValidateParam(param, ["Value must be a boolean"])
 
       // valid boolean value
-      param = fromJS({
+      param = {
         required: false,
         type: "boolean",
         value: "true"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // valid boolean value
-      param = fromJS({
+      param = {
         required: false,
         type: "boolean",
         value: false
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates required numbers", function() {
       // invalid number, string instead of a number
-      param = fromJS({
+      param = {
         required: true,
         type: "number",
         value: "test"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // invalid number, undefined value
-      param = fromJS({
+      param = {
         required: true,
         type: "number",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
-      // valid number
-      param = fromJS({
+      // valid number with min and max
+      param = {
         required: true,
         type: "number",
-        value: 10
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+        value: 10,
+        minimum: 5,
+        maximum: 99
+      }
+      assertValidateParam(param, [])
+
+      // valid negative number with min and max
+      param = {
+        required: true,
+        type: "number",
+        value: -10,
+        minimum: -50,
+        maximum: -5
+      }
+      assertValidateParam(param, [])
+
+      // invalid number with maximum:0
+      param = {
+        required: true,
+        type: "number",
+        value: 1,
+        maximum: 0
+      }
+      assertValidateParam(param, ["Value must be less than Maximum"])
+
+      // invalid number with minimum:0
+      param = {
+        required: true,
+        type: "number",
+        value: -10,
+        minimum: 0
+      }
+      assertValidateParam(param, ["Value must be greater than Minimum"])
     })
 
     it("validates optional numbers", function() {
       // invalid number, string instead of a number
-      param = fromJS({
+      param = {
         required: false,
         type: "number",
         value: "test"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Value must be a number"] )
+      }
+      assertValidateParam(param, ["Value must be a number"])
 
       // valid (empty) number
-      param = fromJS({
+      param = {
         required: false,
         type: "number",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // valid number
-      param = fromJS({
+      param = {
         required: false,
         type: "number",
         value: 10
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates required integers", function() {
       // invalid integer, string instead of an integer
-      param = fromJS({
+      param = {
         required: true,
         type: "integer",
         value: "test"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // invalid integer, undefined value
-      param = fromJS({
+      param = {
         required: true,
         type: "integer",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Required field is not provided"] )
+      }
+      assertValidateParam(param, ["Required field is not provided"])
 
       // valid integer
-      param = fromJS({
+      param = {
         required: true,
         type: "integer",
         value: 10
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
 
     it("validates optional integers", function() {
       // invalid integer, string instead of an integer
-      param = fromJS({
+      param = {
         required: false,
         type: "integer",
         value: "test"
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( ["Value must be an integer"] )
+      }
+      assertValidateParam(param, ["Value must be an integer"])
 
       // valid (empty) integer
-      param = fromJS({
+      param = {
         required: false,
         type: "integer",
         value: undefined
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
 
       // integers
-      param = fromJS({
+      param = {
         required: false,
         type: "integer",
         value: 10
-      })
-      result = validateParam( param, false )
-      expect( result ).toEqual( [] )
+      }
+      assertValidateParam(param, [])
     })
   })
 
@@ -583,7 +739,7 @@ describe("utils", function() {
     })
   })
 
-  describe.only("getAcceptControllingResponse", () => {
+  describe("getAcceptControllingResponse", () => {
     it("should return the first 2xx response with a media type", () => {
       const responses = fromJSOrdered({
         "200": {

test/xss/info-sanitization.js

@@ -0,0 +1,33 @@
+/* eslint-env mocha */
+import React from "react"
+import expect from "expect"
+import { render } from "enzyme"
+import { fromJS } from "immutable"
+import Info from "components/info"
+import Markdown from "components/providers/markdown"
+
+describe("<Info/> Sanitization", function(){
+	const dummyComponent = () => null
+	const components = {
+		Markdown
+	}
+	const props = {
+		getComponent: c => components[c] || dummyComponent,
+		info: fromJS({
+			title: "Test Title **strong** <script>alert(1)</script>",
+			description: "Description *with* <script>Markdown</script>"
+		}),
+		host: "example.test",
+		basePath: "/api"
+	}
+
+	it("renders sanitized .title content", function(){
+		let wrapper = render(<Info {...props}/>)
+		expect(wrapper.find(".title").html()).toEqual("Test Title **strong** &lt;script&gt;alert(1)&lt;/script&gt;")
+	})
+
+	it("renders sanitized .description content", function() {
+		let wrapper = render(<Info {...props}/>)
+		expect(wrapper.find(".description").html()).toEqual("<div class=\"markdown\"><p>Description <em>with</em> </p>\n</div>")
+	})
+})

test/xss/markdown-script-sanitization.js

@@ -0,0 +1,36 @@
+/* eslint-env mocha */
+import React from "react"
+import expect from "expect"
+import { render } from "enzyme"
+import Markdown from "components/providers/markdown"
+import { Markdown as OAS3Markdown } from "corePlugins/oas3/wrap-components/markdown.js"
+
+describe("Markdown Script Sanitization", function() {
+  describe("Swagger 2.0", function() {
+    it("sanitizes <script> elements", function() {
+      const str = `script <script>alert(1)</script>`
+      const el = render(<Markdown source={str} />)
+      expect(el.html()).toEqual(`<div class="markdown"><p>script </p>\n</div>`)
+    })
+
+    it("sanitizes <img> elements", function() {
+      const str = `<img src=x onerror="alert('img-in-description')">`
+      const el = render(<Markdown source={str} />)
+      expect(el.html()).toEqual(`<div class="markdown"><p><img src="x"></p>\n</div>`)
+    })
+  })
+
+  describe("OAS 3", function() {
+    it("sanitizes <script> elements", function() {
+      const str = `script <script>alert(1)</script>`
+      const el = render(<OAS3Markdown source={str} />)
+      expect(el.html()).toEqual(`<div class="renderedMarkdown"><div><p>script </p></div></div>`)
+    })
+
+    it("sanitizes <img> elements", function() {
+      const str = `<img src=x onerror="alert('img-in-description')">`
+      const el = render(<OAS3Markdown source={str} />)
+      expect(el.html()).toEqual(`<div class="renderedMarkdown"><div><img src="x"></div></div>`)
+    })
+  })
+})