You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently grape-swagger-rails has hard-coded support for passing through a few of the Swagger-UI options from the grape-swagger-rails initializer to the SwaggerUi initializer, in the index.html.erb file. Good examples of this include the docExpansion option, and the validatorUrl option. Here's a link to a recent pull request that added the validatorUrl option: #46.
@dblock rightfully pointed out that it would be better if we could come up with a clean way to pass through ALL of the Swagger-UI options, to completely support the features of Swagger-UI. Then we could strip out all the special case code that we currently have for supporting these options piecemeal.
There's a complete list of Swagger-UI options here: https://github.com/swagger-api/swagger-ui#parameters. I wonder if we might be best off making some kind of a whitelist of supported parameters to pass through, rather than just automatically passing through any and all options that are set. It will require a little more maintenance since when new options are added they would have to be added to the whitelist, but it might head off potential security issues.
Another point in favor of using some kind of list of supported parameters... it looks like the Swagger-UI params don't use a completely consistent case. Most are lowerCamelCase, but at least one (dom_id) is snake_case, which means that automatically converting from snake_case in the grape_swagger_rails.rb initializer to lowerCamelCase will fail in that case. Seems that a list showing how to translate from the Ruby name for the parameter to the JavaScript name for the parameter may be needed.
The text was updated successfully, but these errors were encountered:
Currently grape-swagger-rails has hard-coded support for passing through a few of the Swagger-UI options from the grape-swagger-rails initializer to the SwaggerUi initializer, in the index.html.erb file. Good examples of this include the docExpansion option, and the validatorUrl option. Here's a link to a recent pull request that added the validatorUrl option: #46.
@dblock rightfully pointed out that it would be better if we could come up with a clean way to pass through ALL of the Swagger-UI options, to completely support the features of Swagger-UI. Then we could strip out all the special case code that we currently have for supporting these options piecemeal.
There's a complete list of Swagger-UI options here: https://github.com/swagger-api/swagger-ui#parameters. I wonder if we might be best off making some kind of a whitelist of supported parameters to pass through, rather than just automatically passing through any and all options that are set. It will require a little more maintenance since when new options are added they would have to be added to the whitelist, but it might head off potential security issues.
Another point in favor of using some kind of list of supported parameters... it looks like the Swagger-UI params don't use a completely consistent case. Most are lowerCamelCase, but at least one (dom_id) is snake_case, which means that automatically converting from snake_case in the
grape_swagger_rails.rb
initializer to lowerCamelCase will fail in that case. Seems that a list showing how to translate from the Ruby name for the parameter to the JavaScript name for the parameter may be needed.The text was updated successfully, but these errors were encountered: