mirror/tiangolo.fastapi - tiangolo.fastapi - Всем привет, ну это уж ваше дело

python asyncio api async fastapi framework json json-schema openapi openapi3 pydantic python-types python3 redoc rest starlette swagger swagger-ui uvicorn web

History

Ismail Pelaseyed b679bd3db2 fix: escape user-controlled values in Swagger UI and ReDoc HTML The /docs and /redoc endpoints embed openapi_url, oauth2_redirect_url, title, and CDN URLs directly into HTML and JavaScript using f-strings without escaping. When root_path comes from a reverse proxy header (like X-Forwarded-Prefix), an attacker can inject arbitrary JavaScript into the generated page. This applies html.escape() to values in HTML attribute and text contexts, and uses the existing _html_safe_json() (which produces properly quoted JSON strings) for values embedded in JavaScript contexts. This is the same approach already used for swagger_ui_parameters.		3 months ago
..
.agents/skills/fastapi	📝 Update Skill, optimize context, trim and refactor into references (#15031)	4 months ago
_compat	👷 Add `ty` to precommit (#15091)	4 months ago
dependencies	👷 Add `ty` to precommit (#15091)	4 months ago
middleware	📝 Use `WSGIMiddleware` from `a2wsgi` instead of deprecated `fastapi.middleware.wsgi.WSGIMiddleware` (#14756)	5 months ago
openapi	fix: escape user-controlled values in Swagger UI and ReDoc HTML	3 months ago
security	✏️ Fix typo for `client_secret` in OAuth2 form docstrings (#14946)	4 months ago
__init__.py	🔖 Release version 0.136.0	3 months ago
__main__.py	♻️ Add support for `pip install "fastapi[standard]"` with standard dependencies and `python -m fastapi` (#11935)	2 years ago
applications.py	🔥 Remove April Fool's `@app.vibe()` 🤪 (#15363)	3 months ago
background.py	🎨 Update internal types for Python 3.10 (#14898)	5 months ago
cli.py	👷 Add `ty` to precommit (#15091)	4 months ago
concurrency.py	♻️ Upgrade internal syntax to Python 3.9+ 🎉 (#14564)	7 months ago
datastructures.py	👷 Add `ty` to precommit (#15091)	4 months ago
encoders.py	👷 Add `ty` to precommit (#15091)	4 months ago
exception_handlers.py	⬆️ Upgrade Starlette supported version range to >=0.40.0,<0.49.0 (#14077)	10 months ago
exceptions.py	🎨 Update internal types for Python 3.10 (#14898)	5 months ago
logger.py	🔊 Refactor logging (#781)	7 years ago
param_functions.py	👷 Add `ty` to precommit (#15091)	4 months ago
params.py	👷 Add `ty` to precommit (#15091)	4 months ago
py.typed	✨ add py.typed to ship typing information (#209)	7 years ago
requests.py	⬆ Require Pydantic > 1.0 (#1862)	6 years ago
responses.py	⬆️ Support free-threaded Python 3.14t (#15149)	3 months ago
routing.py	👷 Add `ty` to precommit (#15091)	4 months ago
sse.py	✨ Add support for Server Sent Events (#15030)	4 months ago
staticfiles.py	✨ Improve type annotations, add support for mypy --strict, internally and for external packages (#2547)	6 years ago
templating.py	✨ Improve type annotations, add support for mypy --strict, internally and for external packages (#2547)	6 years ago
testclient.py	✨ Improve type annotations, add support for mypy --strict, internally and for external packages (#2547)	6 years ago
types.py	🎨 Update internal types for Python 3.10 (#14898)	5 months ago
utils.py	🎨 Update internal types for Python 3.10 (#14898)	5 months ago
websockets.py	✨ Export `WebSocketState` in `fastapi.websockets` (#4376)	4 years ago