spectral:oas warn on by default

no-script-tags-in-markdown

Markdown descriptions must not have "<script>" tags.

Applies to
descriptiontitle
Selects
$..[description,title]
Function
pattern
Specs
OpenAPI 2.0OpenAPI 3.0OpenAPI 3.1OpenAPI 3.2

Use it

This rule ships with OpenLint in spectral:oas. Extending the ruleset turns it on:

extends: spectral:oas
rules:
  no-script-tags-in-markdown: warn   # or off, or another severity

Definition

As defined in @openlint/openlint-rulesets. Functions show by name.

no-script-tags-in-markdown:
  description: Markdown descriptions must not have "<script>" tags.
  recommended: true
  given: '$..[description,title]'
  then:
    function: pattern
    functionOptions:
      notMatch: <script

About this rule

This rule protects against a potential hack, for anyone bringing in description documents from third parties and then generating HTML documentation. If one of those third parties does something shady like injecting <script> tags, they could easily execute arbitrary code on your domain, which if it’s the same as your main application could be all sorts of terrible.

Bad Example

openapi: "3.0.2"
info:
  title: 'some title with <script>alert("You are Hacked");</script>',

Sources