Make direct URLs with urls.primaryName query param possible without QUERY_CONFIG_ENABLED

[gueuselambix]

Because of https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx you have disabled QUERY_CONFIG_ENABLED by default, but this breaks direct links to specs when working with urls.

The topbar itself adds "?urls.primaryName=" to the address bar, but when you refresh the page you end up on the first spec.

Users are now forced to enable QUERY_CONFIG_ENABLED (which has security implications), just to allow those direct URLs.

So I think you either don't add that queryParam to the address bar (because it sets the wrong expectation), or you explicitly allow that urls.primaryName without having to set QUERY_CONFIG_ENABLED to true

[itb-devs-de]

Just stumbled over this problem myself and don't want introduce security issues by enabling QUERY_CONFIG_ENABLED. Swagger UI should be able to distinguish between a url and a valid primaryName. Hope this can be fixed soon.

[cgockeln42]

I would also be very interested in a fix and solution for this. Introducing a security issue to use the direct links is not really worth the possible problems coming later. Therefore, like the previous speakers, I hope that a fix will come quickly.

[gueuselambix]

Any news on this?