From a4cda56502aca53404849f9838c4662aefbf0d0e Mon Sep 17 00:00:00 2001
From: ev-agelos <evagelos.theo@gmail.com>
Date: Fri, 27 Mar 2020 08:52:17 +0100
Subject: [PATCH] remove inline script (csp)

---
 flask_smorest/spec/__init__.py               |  1 +
 flask_smorest/spec/templates/swagger_ui.html | 16 ++++------------
 flask_smorest/static/js/swagger-ui-bundle.js | 10 ++++++++++
 3 files changed, 15 insertions(+), 12 deletions(-)
 create mode 100644 flask_smorest/static/js/swagger-ui-bundle.js

diff --git a/flask_smorest/spec/__init__.py b/flask_smorest/spec/__init__.py
index b39d0eb5..8f698abf 100644
--- a/flask_smorest/spec/__init__.py
+++ b/flask_smorest/spec/__init__.py
@@ -39,6 +39,7 @@ def _register_doc_blueprint(self):
                 __name__,
                 url_prefix=_add_leading_slash(api_url),
                 template_folder='./templates',
+                static_folder='static',
             )
             # Serve json spec at 'url_prefix/openapi.json' by default
             json_path = self._app.config.get(
diff --git a/flask_smorest/spec/templates/swagger_ui.html b/flask_smorest/spec/templates/swagger_ui.html
index 06ed47a8..8377d23c 100644
--- a/flask_smorest/spec/templates/swagger_ui.html
+++ b/flask_smorest/spec/templates/swagger_ui.html
@@ -12,18 +12,10 @@
 
    <script src="{{swagger_ui_url}}swagger-ui-standalone-preset.js"></script>
    <script src="{{swagger_ui_url}}swagger-ui-bundle.js"></script>
-   <script>
-     window.onload = function() {
-       const ui = SwaggerUIBundle({
-         url: "{{ url_for('api-docs.openapi_json') }}",
-         dom_id: '#swagger-ui-container',
-         deepLinking: true,
-         layout: "BaseLayout",
-         supportedSubmitMethods: [{% for meth in swagger_ui_supported_submit_methods %}"{{meth.lower()}}",{% endfor %}],
-       })
-       window.ui = ui
-     }
-   </script>
+
+   <script id="openapi-url" type="application/json">{{ url_for('api-docs.openapi_json') }}</script>
+   <script id="supported-submit-methods" type="application/json">{{ swagger_ui_supported_submit_methods|tojson }}</script>
+   <script type="text/javascript" src={{url_for("api-docs.static", filename="js/swagger-ui-bundle.js")}}></script>
 
  </body>
 
diff --git a/flask_smorest/static/js/swagger-ui-bundle.js b/flask_smorest/static/js/swagger-ui-bundle.js
new file mode 100644
index 00000000..92ac329e
--- /dev/null
+++ b/flask_smorest/static/js/swagger-ui-bundle.js
@@ -0,0 +1,10 @@
+window.onload = function() {
+    const ui = SwaggerUIBundle({
+        url: document.getElementById('openapi-url').textContent,
+        dom_id: '#swagger-ui-container',
+        deepLinking: true,
+        layout: "BaseLayout",
+        supportedSubmitMethods: JSON.parse(document.getElementById('supported-submit-methods').textContent),
+    })
+    window.ui = ui
+}