Page MenuHomePhabricator

Tool "wikifactmine-api" loads assets from swagger.io
Closed, ResolvedPublic

Description

https://tools.wmflabs.org/wikifactmine-api/: https://online.swagger.io/validator?url=https://tools.wmflabs.org/wikifactmine-api/swagger.yaml

Loading from external providers are discouraged. Please see parent tasks and J65.

You may want to setup a proxy, or make the validator static content and host the image locally in your tool.
Or alternatively you could ask for consent before loading it. Eg.: replace the icon with a button that says something like "load validator on online.swagger.io", and if the user press it then replace the button with the validator icon.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 11 2017, 12:48 AM
Tarrow closed this task as Resolved.Aug 11 2017, 4:04 PM

Thanks, I didn't actually realise the default swagger did this out of the box.

For other people who find this the answer is to set validatorUrl: null in the SwaggerUi constructor in index.html.