swagger-typescript-api
swagger-typescript-api copied to clipboard
⚠️ Vulnerability (all versions): Unescaped characters from description
generates broken ts file if description in swagger file containes forward slash */ like in this example **/information**
...
summary: Get service point file of all Nordic countries (SE,FI,DK,NO).
description: |-
Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
Download the file using the URL in reponse.
...
Looks like I can inject some javascript using swagger docs only by adding something in a description: **/ alert(12) /**
So this issue can be converted to a security issue
@smorimoto - take a look please
The same issues go to any other place, like summary, name, tags and so on