We have our own API project, where we are using Quarkus for developing the APIs. We are using swagger UI provided by the Quarkus. When we open the swagger UI and click on View Source we get –
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><title>OpenAPI UI (Powered by Quarkus 3.11.1)</title><link rel="stylesheet" type="text/css" href="swagger-ui.css"><link rel="stylesheet" type="text/css" href="theme-feeling-blue.css"><link rel="shortcut icon" href="favicon.ico" type="image/x-icon"><link rel="icon" href="favicon.ico" type="image/x-icon"><link rel="stylesheet" type="text/css" href="style.css">
</head><body><div id="swagger-ui"/><script src="swagger-ui-bundle.js" charset="UTF-8"/><script src="swagger-ui-standalone-preset.js" charset="UTF-8"> </script><script>
window.onload = function() {
// If Url is relative, append the host and port
var oar = "/q/swagger-ui/oauth2-redirect.html";
if(oar.startsWith("/")){
oar = window.location.protocol + "//" + window.location.host + oar;
}
var ui = SwaggerUIBundle({
url: '/q/openapi',
dom_id: '#swagger-ui',
deepLinking: true,
persistAuthorization: true,
presets: [SwaggerUIBundle.presets.apis,SwaggerUIStandalonePreset],
plugins: [SwaggerUIBundle.plugins.DownloadUrl],
layout: 'StandaloneLayout',
oauth2RedirectUrl: oar,
})
}
</script><script defer> function waitForSwaggerUI() { var linkElement=document.getElementsByClassName("link" )[0]; if (linkElement !==undefined) { clearInterval(checkInterval); const urlParams=new URLSearchParams(window.location.search); const embed=urlParams.get('embed' ); if(!embed){ linkElement.innerHTML="<a id='swaggerUiLogoLink' href='/q/dev'><img src='logo.png' alt='OpenAPI UI (Powered by Quarkus 3.11.1)' height='44' align='middle'></a><a id='swaggerUiTitleLink' href='/q/swagger-ui'></a>" ; }else{ linkElement.style.display='none' ; var downloadElement=document.getElementsByClassName("download-url-input" )[0]; if (downloadElement !==undefined) { downloadElement.style.width="100%" ; } } } } var checkInterval=setInterval(waitForSwaggerUI, 100); </script></body></html>
In the application.properties file, we have defined a CSP header –
quarkus.http.header.”Content-Security-Policy”.value=default-src ‘self’;script-src ‘self’ ‘unsafe-inline’;style-src ‘self’; img-src ‘self’ data:;connect-src ‘self’ https://XXXXXX
As there is an inline JavaScript included on the swagger UI page, the ZAP scanning gives alert to avoid use of unsafe-inline.
How could we get rid of this inline script? I see there are options of having nonce or hash for the scripts, but it would require change in the actual JavaScript, which we cannot do as it is provided by the Quarkus-Swagger-UI.
New contributor
Saket Dorlikar is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1