pythonasyncioapiasyncfastapiframeworkjsonjson-schemaopenapiopenapi3pydanticpython-typespython3redocreststarletteswaggerswagger-uiuvicornweb
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Tree:
b679bd3db2
add-tests-for-parameter-defaults
check-zh-translation-prompt
fix-broken-links-in-index.md
fix-links
fix-multiple-upload-file-in-swagger
fix-nested-annotated-types-in-field_annotation_is_scalar_sequence
fix-response_model_---parameters-with-Iterable
master
pin-actions-by-sha
set-dependabot-interval-monthly
translate-de-add-missing-3f9149da
translate-es-add-missing-383d2b2a
translate-fr-add-missing-1e3f6254
translate-hi-add-missing-51ac334b
translate-hi-add-missing-a37a4519
translate-ja-add-missing-4420c861
translate-ko-add-missing-2ec5599d
translate-pt-add-missing-f27acfbd
translate-ru-add-missing-d209aaf8
translate-tr-add-missing-5286437a
translate-uk-add-missing-5d45eb9e
translate-zh-add-missing-6eac157d
translate-zh-hant-add-missing-2ac5aaff
update-dependabot-config
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.17
0.1.19
0.10.0
0.10.1
0.10.2
0.10.3
0.100.0
0.100.0-beta1
0.100.0-beta2
0.100.0-beta3
0.100.1
0.101.0
0.101.1
0.102.0
0.103.0
0.103.1
0.103.2
0.104.0
0.104.1
0.105.0
0.106.0
0.107.0
0.108.0
0.109.0
0.109.1
0.109.2
0.11.0
0.110.0
0.110.1
0.110.2
0.110.3
0.111.0
0.111.1
0.112.0
0.112.1
0.112.2
0.112.3
0.112.4
0.113.0
0.114.0
0.114.1
0.114.2
0.115.0
0.115.1
0.115.10
0.115.11
0.115.12
0.115.13
0.115.14
0.115.2
0.115.3
0.115.4
0.115.5
0.115.6
0.115.7
0.115.8
0.115.9
0.116.0
0.116.1
0.116.2
0.117.0
0.117.1
0.118.0
0.118.1
0.118.2
0.118.3
0.119.0
0.119.1
0.12.0
0.12.1
0.120.0
0.120.1
0.120.2
0.120.3
0.120.4
0.121.0
0.121.1
0.121.2
0.121.3
0.122.0
0.122.1
0.123.0
0.123.1
0.123.10
0.123.2
0.123.3
0.123.4
0.123.5
0.123.6
0.123.7
0.123.8
0.123.9
0.124.0
0.124.1
0.124.2
0.124.3
0.124.4
0.125.0
0.126.0
0.127.0
0.127.1
0.128.0
0.128.1
0.128.2
0.128.3
0.128.4
0.128.5
0.128.6
0.128.7
0.128.8
0.129.0
0.129.1
0.129.2
0.13.0
0.130.0
0.131.0
0.132.0
0.132.1
0.133.0
0.133.1
0.134.0
0.135.0
0.135.1
0.135.2
0.135.3
0.135.4
0.136.0
0.136.1
0.136.2
0.136.3
0.137.0
0.137.1
0.137.2
0.138.0
0.138.1
0.138.2
0.139.0
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.2.0
0.2.1
0.20.0
0.20.1
0.21.0
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.27.1
0.27.2
0.28.0
0.29.0
0.29.1
0.3.0
0.30.0
0.30.1
0.31.0
0.32.0
0.33.0
0.34.0
0.35.0
0.36.0
0.37.0
0.38.0
0.38.1
0.39.0
0.4.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.44.1
0.45.0
0.46.0
0.47.0
0.47.1
0.48.0
0.49.0
0.49.1
0.49.2
0.5.0
0.5.1
0.50.0
0.51.0
0.52.0
0.53.0
0.53.1
0.53.2
0.54.0
0.54.1
0.54.2
0.55.0
0.55.1
0.56.0
0.56.1
0.57.0
0.58.0
0.58.1
0.59.0
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.60.0
0.60.1
0.60.2
0.61.0
0.61.1
0.61.2
0.62.0
0.63.0
0.64.0
0.65.0
0.65.1
0.65.2
0.65.3
0.66.0
0.66.1
0.67.0
0.68.0
0.68.1
0.68.2
0.69.0
0.7.0
0.7.1
0.70.0
0.70.1
0.71.0
0.72.0
0.73.0
0.74.0
0.74.1
0.75.0
0.75.1
0.75.2
0.76.0
0.77.0
0.77.1
0.78.0
0.79.0
0.79.1
0.8.0
0.80.0
0.81.0
0.82.0
0.83.0
0.84.0
0.85.0
0.85.1
0.85.2
0.86.0
0.87.0
0.88.0
0.89.0
0.89.1
0.9.0
0.9.1
0.90.0
0.90.1
0.91.0
0.92.0
0.93.0
0.94.0
0.94.1
0.95.0
0.95.1
0.95.2
0.96.0
0.96.1
0.97.0
0.98.0
0.99.0
0.99.1
v0.1.16
${ noResults }
tiangolo.fastapi/fastapi/openapi
Ismail Pelaseyed
b679bd3db2
The /docs and /redoc endpoints embed openapi_url, oauth2_redirect_url, title, and CDN URLs directly into HTML and JavaScript using f-strings without escaping. When root_path comes from a reverse proxy header (like X-Forwarded-Prefix), an attacker can inject arbitrary JavaScript into the generated page. This applies html.escape() to values in HTML attribute and text contexts, and uses the existing _html_safe_json() (which produces properly quoted JSON strings) for values embedded in JavaScript contexts. This is the same approach already used for swagger_ui_parameters. |
3 months ago | |
|---|---|---|
| .. | ||
| __init__.py | ♻️ Refactor, fix and update code | 8 years ago |
| constants.py | ✨ Add support for Pydantic v2 (#9816) | 3 years ago |
| docs.py | fix: escape user-controlled values in Swagger UI and ReDoc HTML | 3 months ago |
| models.py | 👷 Add `ty` to precommit (#15091) | 4 months ago |
| utils.py | 👷 Add `ty` to precommit (#15091) | 4 months ago |