Makes the last `initOAuth` variable configurable via environment
variables in the swagger-ui docker image.
Co-authored-by: Christopher Giroir <chrisgiroir@improbable.io>
Co-authored-by: Tim Lai <timothy.lai@gmail.com>
Reading configuration parameters from URL search params
is by default no longer enabled. To re-enable it, set queryConfigEnabled
configuration parameter to true.
Functionally, this is a breaking change, but given we're just providing
a security vulnerability patch we're considering this a PATCH version bump
only.
Refs #4872
Refs https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx
This commit provides a backward compatible mechanism to chain wrap
an individual component multiple times
`Chain` mode: allow chaining of plugins on a given component
`Legacy` mode: last plugin to wrap a given component will supercede others
* chore: Add unit test for wrapComponent wrapping
* doc: Add documentation about the new pluginsOptions configuration
* doc: Add a sidenote on plugin-api page
Co-authored-by: Tim Lai <timothy.lai@gmail.com>
* feat: add tryItOutEnabled configuration
allow users to set tryItOutEnabled: true to display
the "Try it out" section by default
tryItOutEnabled to take === "true" for the
query string value or === true if someone
implements query string type parsing in the query
* Add default configuration `preserveAuthorization`
* Add localStorage to auth plugin
* Add persistAuthorization unit tests
* Refactor persistAuthorization to use wrapped actions
* Upgrade unit tests to be compatible with jest
* Add persistAuthorization documentation
Co-authored-by: Tim Lai <timothy.lai@gmail.com>
* config(jest): updated setup
* config(jest): update testMatch to include jsx files
* config(jest): add transformIgnorePatterns
* config(jest): update ignore files that do not work in jest yet
* config: add test:unit-jest to test script
* fix(jest): lint with eslint-plugin-jest
* refactor(jest): move unit test directory
* refactor(mocha): restore mocha tests that fail in jest
* docs(jest): update helpful scripts with test:unit-jest
This commit changes markdown sanitization behaviour in following way:
class, style and data-* attributes are removed by default. These attributes
open possible vulnerability vectors to attackers.
The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option.
Use this configuration option with caution and only in cases when you know
what you're doing.
* add `security-audit` script
* npm audit fix
* remove nyc
* nightwatch@1
this breaks the test suite, but it appears to have already regressed. leaving it for another day, TODO: open a backlog ticket
* add `security-audit` script
* disable mocha exclusivity
* update package-lock.json
* cypress@3.4.0
* `npm audit fix`
* @release-it/conventional-changelog@1.1.0
* release-it@12
