remove inline script (csp)

flask_smorest/spec/__init__.py

@@ -39,6 +39,7 @@ def _register_doc_blueprint(self):
  __name__,
  url_prefix=_add_leading_slash(api_url),
  template_folder='./templates',
+ static_folder='static',
  )
  # Serve json spec at 'url_prefix/openapi.json' by default
  json_path = self._app.config.get(

flask_smorest/spec/templates/swagger_ui.html

@@ -12,18 +12,10 @@
 
  <script src="{{swagger_ui_url}}swagger-ui-standalone-preset.js"></script>
  <script src="{{swagger_ui_url}}swagger-ui-bundle.js"></script>
- <script>
- window.onload = function() {
- const ui = SwaggerUIBundle({
- url: "{{ url_for('api-docs.openapi_json') }}",
- dom_id: '#swagger-ui-container',
- deepLinking: true,
- layout: "BaseLayout",
- supportedSubmitMethods: [{% for meth in swagger_ui_supported_submit_methods %}"{{meth.lower()}}",{% endfor %}],
- })
- window.ui = ui
- }
- </script>
+
+ <script id="openapi-url" type="application/json">{{ url_for('api-docs.openapi_json') }}</script>
+ <script id="supported-submit-methods" type="application/json">{{ swagger_ui_supported_submit_methods|tojson }}</script>
+ <script type="text/javascript" src={{url_for("api-docs.static", filename="js/swagger-ui-bundle.js")}}></script>
 
  </body>
 

flask_smorest/static/js/swagger-ui-bundle.js

@@ -0,0 +1,10 @@
+window.onload = function() {
+ const ui = SwaggerUIBundle({
+ url: document.getElementById('openapi-url').textContent,
+ dom_id: '#swagger-ui-container',
+ deepLinking: true,
+ layout: "BaseLayout",
+ supportedSubmitMethods: JSON.parse(document.getElementById('supported-submit-methods').textContent),
+ })
+ window.ui = ui
+}