Repository navigation
Strip query string from relative document URLs in Swagger UI - #4152
Merged
martincostello merged 3 commits intoSep 15, 2026
Merged
martincostello merged 3 commits into
martincostello merged 3 commits into
Conversation
The initializer script resolves relative document URLs against window.location.href and only removed the fragment, so a request for index.html?foo=bar produced a document link of swagger.json?foo=bar. Drop the query string as well.
There was a problem hiding this comment.
🟡 Changes recommended
Configured endpoint query parameters are currently removed during URL normalization.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates Swagger UI relative document URL resolution to remove page query strings and fragments.
Changes:
- Adjusts URL normalization in
index.js. - Adds an integration test for the served initializer script.
File summaries
| File | Description |
|---|---|
test/Swashbuckle.AspNetCore.IntegrationTests/SwaggerUIIntegrationTests.cs |
Tests the updated initializer script behavior. |
src/Swashbuckle.AspNetCore.SwaggerUI/index.js |
Normalizes relative document URLs. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Splitting after the replacement also removed a query string configured on the document URL itself (e.g. v1/swagger.json?tenant=foo). Drop the page's query string and fragment first, then splice in the document URL.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #4152 +/- ##
==========================================
+ Coverage 95.22% 95.24% +0.01%
==========================================
Files 111 111
Lines 4128 4142 +14
Branches 845 848 +3
==========================================
+ Hits 3931 3945 +14
Misses 197 197
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The integration test only checked that the served index.js contained the new expression, which does not exercise the behaviour the change is meant to fix. Load swagger/index.html?foo=bar in Chromium against the TopLevelSwaggerDoc site, whose document URL is the relative v1.json, and assert that the document URL Swagger UI shows in the info panel ends with /swagger/v1.json. Against the previous index.js the same test fails with .../swagger/v1.json?foo=bar.
GabeSilvaDev
force-pushed
the
fix/2721-strip-query-from-document-url
branch
from
September 14, 2026 17:04
8d157a3 to
c0021c0
Compare
martincostello
approved these changes
Sep 15, 2026
Contributor
|
Thanks for your contribution @GabeSilvaDev - the changes from this pull request have been published as part of version 10.3.0 📦, which is now available from NuGet.org 🚀 |
This was referenced Oct 7, 2026
Open
This was referenced Oct 13, 2026
Merged
Bump the dotnet-compatible-updates group with 10 updates
DanielCosta3415/integracao-controlid-poc#13
Open
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
The issue or feature being addressed
Fixes #2721
Details on the issue fix or feature implementation
The Swagger UI initializer script (
index.js) resolves relative document URLs againstwindow.location.hrefand only stripped the fragment, so a request forswagger/index.html?foo=barproduced a document link ofswagger/swagger.json?foo=bar. This is what scanners such as Burp Suite flag as a reflected open-redirect finding, as described in the issue.The page URL now has its query string and fragment removed (
split(/[?#]/)[0]) before the document URL is spliced in, so nothing from the page URL is carried over. The document URL itself is treated exactly as before: a configured query string such asv1/swagger.json?tenant=foois kept, and only a fragment is dropped. Absolute and root-relative document URLs are not touched.Added an integration test in
SwaggerUIIntegrationTests(same style asSwaggerUIMiddleware_ReturnsInitializerScript) asserting the served script strips the page URL before the replacement; it failed before the change.