search

springdoc / springdoc-openapi

Library for OpenAPI 3 with spring-boot
https://springdoc.org
Apache License 2.0
3.26k stars 493 forks source link

Allow links to definitions to be shared via urls.primaryName parameter if configured in your list of URLs #2013

Closed tpwst555 closed 1 year ago

tpwst555 commented 1 year ago

Is your feature request related to a problem? Please describe. We are unable to share links to specs that are not on the default definition. This presents a problem because users must manually navigate to the location within a spec if it is not the default definition.

I understand query parameters were disabled for security, however parameter validation can be added to ensure the value of urls.primaryName is an allowed URL.

This was recently implemented by swagger-ui: https://github.com/swagger-api/swagger-ui/pull/8168

Describe the solution you'd like

Describe alternatives you've considered I have tried using queryConfigEnabled, but this setting is not working: springdoc.swagger-ui.queryConfigEnabled=true

Also, this option seems to present a security risk which could be avoided with parameter validation.

bnasslahsen commented 1 year ago

see the answer here https://github.com/springdoc/springdoc-openapi/issues/1439#issuecomment-1009907899

tpwst555 commented 1 year ago

Apologies, I'm not sure how this is a duplicate. I did read that bug and understand why it is a security issue. This is a feature request to add parameter validation so we can securely share links without enabling the queryConfigEnabled flag. (Which has been addressed in swagger-ui project.)

bnasslahsen commented 1 year ago

@tpwst555,

Feel free to propose directly a PR, if you have any feature request.