HTML not escaped when API responds with text/html - XSS vulnerability

[matthewhubblerose]

Not sure if this is by design or not, but this is an XSS vulnerability.

I've set up an API with a single GET method, that is documented to respond with Content-Type application/json. When using the "Try it out!" button, and the API instead responded with Content-Type text/html (due to an exception being handled by Apache Tomcat and generating an HTML page), the HTML was rendered in in the Swagger UI page.

A simpler test case, is where I set up the API to respond with Content-Type text/html and this body:

<h1>Hello</h1><script>alert('XSS')</script>

When making the request with the "Try it out!" button, the resulting page looked like this:

I believe that the correct way of handling text/html reponse should be encoding all of the response so that is just rendered as text in the browser. So in this case, the response should have been encoded to:

<h1>Hello</h1><script>alert('XSS')</script>

which would then be rendered as the text, rather than as HTML

[matthewhubblerose]

I should add, this is with swagger-ui version 2.0.21. It looks like this has been fixed in a later release, the master branch is escaping the response with Underscore.js now:

swagger-ui/src/main/javascript/view/OperationView.js

Line 453 in 6254644

$('.response_body', $(this.el)).html(_.escape(prettyJson));

Can someone confirm which version this was fixed in?

The code that loads in my browser looks like this:

$(".response_body", $(this.el)).html(response_body);
$(".response_headers", $(this.el)).html("<pre>" + _.escape(JSON.stringify(response.headers, null, "  ")).replace(/\n/g, "<br>") + "</pre>");

You can see the second line in the snippet is correctly escaping the response headers, but the response body itself is left unescaped. It looks like the headers were fixed for issue #492

[fehguy]

You should update to master, or 2.1.0-M2

[matthewhubblerose]

Will do.

Do you know which specific release fixed the issue though? Is there a test to prevent regression?