Interface: LoadSpecOptions

Defined in: core/src/OASUtils.ts:22

Options that restrict where OASUtils.loadSpec is permitted to load a specification from. Intended for callers that accept a spec path/URL from an external or untrusted source (e.g. a request parameter), to prevent path traversal (arbitrary local file read) and SSRF (requests to arbitrary/internal hosts).

Properties

allowedDirs?

optional allowedDirs?: string[]

Defined in: core/src/OASUtils.ts:24

If set, file must resolve to a path contained within one of these directories.

---

allowedHosts?

optional allowedHosts?: string[]

Defined in: core/src/OASUtils.ts:26

If set, a file given as a URL must have a hostname contained in this list.