-
Notifications
You must be signed in to change notification settings - Fork 1
Migrating to swagger3 / openapi #26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
c1d56ff
80d3318
f12bf44
40c0568
087e03d
c6226d2
2381983
c1feb18
cf206b6
0246695
1baf099
9b2b663
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| = Swagger utilities | ||
|
|
||
| This contains a few utility methods to deal with swagger. | ||
|
|
||
| It has a dependency on a webjars for swagger frontend itself, and supplies a simply taglib to wire that into the actual HTML. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
|
|
||
| <parent> | ||
| <artifactId>vpro-shared-parent</artifactId> | ||
| <groupId>nl.vpro.shared</groupId> | ||
| <version>3.1-SNAPSHOT</version> | ||
| </parent> | ||
| <artifactId>vpro-shared-swagger3</artifactId> | ||
| <version>3.1-SNAPSHOT</version> | ||
|
|
||
| <properties> | ||
| </properties> | ||
|
|
||
| <dependencies> | ||
| <dependency> | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Severe OSS Vulnerability: pkg:maven/nl.vpro.shared/vpro-shared-jackson2@2.30-SNAPSHOT0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies Componentspkg:maven/com.google.guava/guava@31.1-jreSEVERE Vulnerabilities (1)
The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
(at-me in a reply with |
||
| <groupId>nl.vpro.shared</groupId> | ||
| <artifactId>vpro-shared-jackson2</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Severe OSS Vulnerability: pkg:maven/nl.vpro.shared/vpro-shared-web@2.30-SNAPSHOT0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies Componentspkg:maven/com.google.guava/guava@31.1-jreSEVERE Vulnerabilities (1)
The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
(at-me in a reply with |
||
| <groupId>nl.vpro.shared</groupId> | ||
| <artifactId>vpro-shared-web</artifactId> | ||
| </dependency> | ||
|
|
||
| <dependency> | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Critical OSS Vulnerability: pkg:maven/io.swagger.core.v3/swagger-core@2.1.132 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies Componentspkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1CRITICAL Vulnerabilities (2)CVE-2020-36518
sonatype-2021-4682
The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.
(at-me in a reply with
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. ignore There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I've recorded this as ignored for this pull request. |
||
| <groupId>io.swagger.core.v3</groupId> | ||
| <artifactId>swagger-core</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Critical OSS Vulnerability: pkg:maven/io.swagger.core.v3/swagger-jaxrs2@2.1.132 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies Componentspkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1CRITICAL Vulnerabilities (2)CVE-2020-36518
sonatype-2021-4682
The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.
(at-me in a reply with |
||
| <groupId>io.swagger.core.v3</groupId> | ||
| <artifactId>swagger-jaxrs2</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.jboss.spec.javax.ws.rs</groupId> | ||
| <artifactId>jboss-jaxrs-api_2.1_spec</artifactId> | ||
| <version>2.0.1.Final</version> | ||
| <scope>provided</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>jakarta.servlet</groupId> | ||
| <artifactId>jakarta.servlet-api</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.webjars</groupId> | ||
| <artifactId>swagger-ui</artifactId> | ||
| <version>4.9.1</version> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.projectlombok</groupId> | ||
| <artifactId>lombok</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>nl.vpro.shared</groupId> | ||
| <artifactId>vpro-shared-test</artifactId> | ||
| <scope>test</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.meeuw</groupId> | ||
| <artifactId>mihxil-json-grep</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.apache.logging.log4j</groupId> | ||
| <artifactId>log4j-core</artifactId> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>jakarta.annotation</groupId> | ||
| <artifactId>jakarta.annotation-api</artifactId> | ||
| </dependency> | ||
| </dependencies> | ||
| </project> | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| package nl.vpro.rs.media; | ||
|
|
||
| import lombok.extern.slf4j.Slf4j; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| import javax.servlet.*; | ||
| import javax.servlet.http.HttpServletResponse; | ||
|
|
||
| /** | ||
| * MSE-4330. Er was gewoon een index.jsp die dat deed, maar dat werkt niet meer, omdat om een of andere reden het resteasy servlet er altijd tussen zat (terwijl niet eens gemapt) | ||
| * @author Michiel Meeuwissen | ||
| * @since 2.6 | ||
| */ | ||
| @Slf4j | ||
mihxil marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| public class WelcomeFilter implements Filter { | ||
|
|
||
|
|
||
|
|
||
| @Override | ||
| public void init(FilterConfig filterConfig) { | ||
|
|
||
| } | ||
|
|
||
| @Override | ||
| public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException { | ||
| ((HttpServletResponse)servletResponse).sendRedirect("docs/api"); | ||
|
|
||
| } | ||
|
|
||
| @Override | ||
| public void destroy() { | ||
|
|
||
| } | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| /* | ||
| * Copyright (C) 2013 All rights reserved | ||
| * VPRO The Netherlands | ||
| */ | ||
| package nl.vpro.swagger; | ||
|
|
||
| import lombok.extern.slf4j.Slf4j; | ||
|
|
||
| import java.util.*; | ||
|
|
||
| import javax.annotation.PostConstruct; | ||
| import javax.ws.rs.ApplicationPath; | ||
| import javax.ws.rs.core.Application; | ||
|
|
||
|
|
||
| /** | ||
| * Static helper to expose a dummy JAX-RS Application. Swagger needs such an application to expose the API docs for | ||
| * the given endpoints. | ||
| * | ||
| * @author Roelof Jan Koekoek | ||
| * @since 2.0 | ||
| */ | ||
| @Slf4j | ||
mihxil marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| @ApplicationPath("") | ||
| public class SwaggerApplication extends Application { | ||
| private static final Set<Object> singletons = new HashSet<>(); | ||
|
|
||
| @Override | ||
| public Set<Class<?>> getClasses() { | ||
| Set<Class<?>> set = new HashSet<>(); | ||
| return set; | ||
| } | ||
|
|
||
| @Override | ||
| public Set<Object> getSingletons() { | ||
| return singletons; | ||
| } | ||
|
|
||
| @PostConstruct | ||
| public void init() { | ||
| //inject(); | ||
| } | ||
|
|
||
| /** | ||
| * Inject Swagger annotated JAX-RS api's you want to publish. Swagger only calls #getSingletons on the first | ||
| * API documentation request, so you must take care that your services get injected before an application accepts | ||
| * web requests. (Using @PostConstruct on your services is a viable solution) | ||
| * | ||
| * @param services | ||
| */ | ||
| public static void inject(Object... services) { | ||
| singletons.addAll(Arrays.asList(services)); | ||
| } | ||
|
|
||
|
|
||
|
|
||
| } | ||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,125 @@ | ||||||
| package nl.vpro.swagger; | ||||||
|
|
||||||
| import lombok.extern.slf4j.Slf4j; | ||||||
|
|
||||||
| import java.io.IOException; | ||||||
| import java.io.OutputStream; | ||||||
|
|
||||||
| import javax.servlet.*; | ||||||
| import javax.servlet.http.*; | ||||||
| import javax.ws.rs.core.MediaType; | ||||||
|
|
||||||
| import org.meeuw.json.grep.Sed; | ||||||
| import org.meeuw.json.grep.matching.*; | ||||||
|
|
||||||
| import nl.vpro.web.HttpServletRequestUtils; | ||||||
|
|
||||||
| /** | ||||||
| * This filter can be used to fill in 'api.basePath' using the request, so you don't have to configure it any more. | ||||||
| * @author Michiel Meeuwissen | ||||||
| * @since 0.21 | ||||||
| */ | ||||||
| @Slf4j | ||||||
mihxil marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
| public class SwaggerFilter implements Filter { | ||||||
|
|
||||||
|
|
||||||
| @Override | ||||||
| public void init(FilterConfig filterConfig) { | ||||||
|
|
||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public void doFilter( | ||||||
| ServletRequest request, | ||||||
| ServletResponse response, FilterChain chain) throws IOException, ServletException { | ||||||
| HttpServletRequest req = (HttpServletRequest) request; | ||||||
|
|
||||||
| if (! req.getPathInfo().endsWith(".json")) { | ||||||
| String accept = req.getHeader("accept"); | ||||||
| if (accept != null) { | ||||||
| boolean json = false; | ||||||
| try { | ||||||
| String[] mtypes = accept.split(";", 2)[0].split(","); | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. StringSplitter: String.split(String) has surprising behavior (details)
Suggested change
(at-me in a reply with
Collaborator
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. ignore There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I've recorded this as ignored for this pull request. |
||||||
| for (String mtype : mtypes) { | ||||||
| if (MediaType.valueOf(mtype).isCompatible(MediaType.APPLICATION_JSON_TYPE)) { | ||||||
| json = true; | ||||||
| break; | ||||||
| } | ||||||
| } | ||||||
| } catch (Exception e) { | ||||||
| log.warn(e.getMessage()); | ||||||
| } | ||||||
| if (!json) { | ||||||
| log.debug("Not json"); | ||||||
| chain.doFilter(request, response); | ||||||
| return; | ||||||
| } | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| PathMatcher matcher = getPathMatcher(req); | ||||||
|
|
||||||
| final ServletOutputStream servletOutputStream = response.getOutputStream(); | ||||||
| final OutputStream out = transform(servletOutputStream, matcher); | ||||||
| HttpServletResponseWrapper wrapped = new HttpServletResponseWrapper((HttpServletResponse) response) { | ||||||
| @Override | ||||||
| public ServletOutputStream getOutputStream() { | ||||||
| return new ServletOutputStream() { | ||||||
| @Override | ||||||
| public boolean isReady() { | ||||||
| return servletOutputStream.isReady(); | ||||||
|
|
||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public void setWriteListener(WriteListener writeListener) { | ||||||
| servletOutputStream.setWriteListener(writeListener); | ||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public void write(int b) throws IOException { | ||||||
| out.write(b); | ||||||
|
|
||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public void write(byte[] b) throws IOException { | ||||||
| out.write(b); | ||||||
| } | ||||||
|
|
||||||
| @Override | ||||||
| public void write(byte[] b, int off, int len) throws IOException { | ||||||
| out.write(b, off, len); | ||||||
| } | ||||||
| }; | ||||||
| } | ||||||
| }; | ||||||
|
|
||||||
| chain.doFilter(request, wrapped); | ||||||
| out.close(); | ||||||
|
|
||||||
| } | ||||||
|
|
||||||
|
|
||||||
| PathMatcher getPathMatcher(HttpServletRequest req) { | ||||||
| String host = req.getServerName() + HttpServletRequestUtils.getPortPostFixIfNeeded(req); | ||||||
| String basePath = req.getContextPath() + "/api"; | ||||||
| return getPathMatcher(basePath, host); | ||||||
| } | ||||||
|
|
||||||
| PathMatcher getPathMatcher(String basePath, String host) { | ||||||
| return new PathMatcherOrChain( | ||||||
| new PathMatcherAndChain( | ||||||
| new SinglePathMatcher(new PreciseMatch("servers"), new ArrayEntryMatch(), new PreciseMatch("url")), | ||||||
| new ScalarEqualsMatcher("${api.basePath}", basePath) | ||||||
| ) | ||||||
| ); | ||||||
| } | ||||||
|
|
||||||
| public OutputStream transform(OutputStream to, PathMatcher pathMatcher) throws IOException { | ||||||
| return Sed.transform(to, pathMatcher); | ||||||
| } | ||||||
|
|
||||||
|
|
||||||
|
|
||||||
| } | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Critical OSS Vulnerability:
pkg:maven/nl.vpro.shared/vpro-shared-jackson2@2.30-SNAPSHOT
2 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies
Components
pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1
CRITICAL Vulnerabilities (2)
CVE-2020-36518
sonatype-2021-4682
The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.
pkg:maven/com.google.guava/guava@31.1-jre
SEVERE Vulnerabilities (1)
The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
(at-me in a reply with
helporignore)