Obsolete & Vulnerable SwaggerUI

[LukasForst]

Hey,

we discovered that one your projects is using this library apistrap to provide Swagger UI. Unfortunately, according to the apidocs.html you're using version3.21.0 that is vulnerable to XSS - see GHSA-qrmm-w75w-3wpx .

Our temporary workaround is to disable Swagger UI completely by setting oapi.ui_url = None OR by including following CSP header with all swagger related stuff:

Content-Security-Policy: default-src 'self'; connect-src 'self'; media-src data:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; 

Not sure, if you're using this library anywhere else, but I'd recommend updating Swagger UI dependency to latest version.

[janbuchar]

Hello, thanks for the heads up! We already migrated most of our relevant infrastructure to FastAPI, but we will surely upgrade swagger ui here at some point.