search

open-horizon / edge-sync-service

Cloud - Edge synchronization service (MMS)
Apache License 2.0
24 stars 26 forks source link

Remove swagger-ui directory (if not being used) #54

Closed bmpotter closed 1 year ago

bmpotter commented 3 years ago

The swagger-ui directory was copied from https://github.com/swagger-api/swagger-ui . It's purpose was to be served by core/base/http.go so that a developer could view the swagger info for the CSS/ESS API.

But the swagger-ui has known vulnerabilities, which have been identified by code scans. And i don't think we ever expose this specific API to view the swagger info in the CSS management hub container. If this is correct, we should remove the whole directory and the code in core/base/http.go that uses it.

As an alternative, the sync service swagger.json file can be viewed by any of these methods:

  1. Via the exchange, for example: sync service swagger from roks-stg exchange
  2. Via the sample swagger server
  3. A product built on top of open-horizon can provide a way to view the swagger.json file, for example: https://www.ibm.com/support/knowledgecenter/SSFKVV_4.2/api/mms_swagger.json
megha070 commented 3 years ago

@bmpotter Can I take this up? And could you please help me get started with this issue?

bmpotter commented 3 years ago

@megha070 At this time i would prefer that you focus on the exchange-api, because we know we will need changes in that for the vault work. (We don't know yet if we will need CSS changes.) I think a good first issue for you in the exchange is https://github.com/open-horizon/exchange-api/issues/174 .