mermade/openapi-webconverter

Mermade Swagger 2.0 to OpenAPI 3.0.0 converter front-end

openapi-webconverter's Issues

Fix Content-type

Hi Mike. Great work!
Just a small improvement.

curl -k -i https://openapi-converter.herokuapp.com/api/v1/validate?url=https://openapi3.herokuapp.com:443/api/openapi.json -H
pplication/json"

Returns text/html instead of application/json:

HTTP/1.1 200 OK
Server: Cowboy
Connection: keep-alive
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Content-Length: 15
Etag: W/"f-NQVRlQfKHCoInEbhALgECMonhCE"
Vary: Accept-Encoding
Date: Wed, 08 Mar 2017 16:53:32 GMT
Via: 1.1 vegur

{"status":true}

Access-Control-Allow-Origin

Hi -

Your other tool (https://github.com/Mermade/openapi-gui) attempts to communicate with hosted "converter" (when provided swagger-json is v2); however, it won't work because of cross-domain configuration is missing on the target (https://openapi-converter.herokuapp.com/api/v1/convert). Just thought I should report this :)

Thanks.
Hari

POST returns non-JSON payload

Hi Mark,

Great job so far, thank you for maintaining the package.

I would like to flag an issue with the POST validate endpoint. If I send a yaml content with application/json accept header, the response I get back has the header Content-Type: application/json but the response payload is actually not a JSON but a status: true in plain text without curly braces.

Happy to investigate and create a PR as needed.

Local File Inclusion via /validate?url=

Hello,

I found a LFI vulnerability in the validate endpoint by pointing the url parameter to any file the process has access to.

It's caused by using fs.readFileSync() without any kind of user input check in the superFetch function