Skip to content

Commit 415cfa2

Browse files
JamesMessingerJamesMessinger
committed
- Merged #5
- Made `options.http.withCredentials` false by default
1 parent 6e32581 commit 415cfa2

File tree

9 files changed

+735
-598
lines changed

9 files changed

+735
-598
lines changed

‎dist/ref-parser.js

+549-424
Large diffs are not rendered by default.

‎dist/ref-parser.js.map

+30-32
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/ref-parser.min.js

+74-72
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/ref-parser.min.js.map

+31-33
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/options.md

+13-13
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,16 @@ $RefParser.dereference("my-schema.yaml", {
2121
});
2222
```
2323

24-
|Option |Type |Default |Description
25-
|:----------------|:--------|:---------|:----------
26-
|`allow.json` |bool |true |Determines whether JSON files are supported
27-
|`allow.yaml` |bool |true |Determines whether YAML files are supported<br> (note: all JSON files are also valid YAML files)
28-
|`allow.empty` |bool |true |Determines whether it's ok for a `$ref` pointer to point to an empty file
29-
|`allow.unknown` |bool |true |Determines whether it's ok for a `$ref` pointer to point to an unknown/unsupported file type (such as HTML, text, image, etc.). The default is to resolve unknown files as a [`Buffer`](https://nodejs.org/api/buffer.html#buffer_class_buffer)
30-
|`$refs.internal` |bool |true |Determines whether internal `$ref` pointers (such as `#/definitions/widget`) will be dereferenced when calling [`dereference()`](ref-parser.md#dereferenceschema-options-callback). Either way, you'll still be able to get the value using [`$Refs.get()`](refs.md#getref-options)
31-
|`$refs.external` |bool |true |Determines whether external `$ref` pointers get resolved/dereferenced. If `false`, then no files/URLs will be retrieved. Use this if you only want to allow single-file schemas.
32-
|`$refs.circular` |bool or "ignore" |true |Determines whether [circular `$ref` pointers](README.md#circular-refs) are allowed. If `false`, then a `ReferenceError` will be thrown if the schema contains a circular reference.<br><br> If set to `"ignore"`, then circular references will _not_ be dereferenced, even when calling [`dereference()`](ref-parser.md#dereferenceschema-options-callback). No error will be thrown, but the [`$Refs.circular`](refs.md#circular) property will still be set to `true`.
33-
|`cache.fs` |number |60 |<a name="caching"></a>The length of time (in seconds) to cache local files. The default is one minute. Setting to zero will cache forever.
34-
|`cache.http` |number |300 |The length of time (in seconds) to cache HTTP URLs. The default is five minutes. Setting to zero will cache forever.
35-
|`cache.https` |number |300 |The length of time (in seconds) to cache HTTPS URLs. The default is five minutes. Setting to zero will cache forever.
36-
|`http.withCredentials` |bool |true |When used in browser specifies `withCredentials` option of `XMLHttpRequest` object. Setting to `false` allows loading via CORS with `Access-Control-Allow-Origin` set to `*`
24+
|Option |Type |Default |Description
25+
|:---------------------|:--------|:---------|:----------
26+
|`allow.json` |bool |true |Determines whether JSON files are supported
27+
|`allow.yaml` |bool |true |Determines whether YAML files are supported<br> (note: all JSON files are also valid YAML files)
28+
|`allow.empty` |bool |true |Determines whether it's ok for a `$ref` pointer to point to an empty file
29+
|`allow.unknown` |bool |true |Determines whether it's ok for a `$ref` pointer to point to an unknown/unsupported file type (such as HTML, text, image, etc.). The default is to resolve unknown files as a [`Buffer`](https://nodejs.org/api/buffer.html#buffer_class_buffer)
30+
|`$refs.internal` |bool |true |Determines whether internal `$ref` pointers (such as `#/definitions/widget`) will be dereferenced when calling [`dereference()`](ref-parser.md#dereferenceschema-options-callback). Either way, you'll still be able to get the value using [`$Refs.get()`](refs.md#getref-options)
31+
|`$refs.external` |bool |true |Determines whether external `$ref` pointers get resolved/dereferenced. If `false`, then no files/URLs will be retrieved. Use this if you only want to allow single-file schemas.
32+
|`$refs.circular` |bool or "ignore" |true |Determines whether [circular `$ref` pointers](README.md#circular-refs) are allowed. If `false`, then a `ReferenceError` will be thrown if the schema contains a circular reference.<br><br> If set to `"ignore"`, then circular references will _not_ be dereferenced, even when calling [`dereference()`](ref-parser.md#dereferenceschema-options-callback). No error will be thrown, but the [`$Refs.circular`](refs.md#circular) property will still be set to `true`.
33+
|`cache.fs` |number |60 |<a name="caching"></a>The length of time (in seconds) to cache local files. The default is one minute. Setting to zero will cache forever.
34+
|`cache.http` |number |300 |The length of time (in seconds) to cache HTTP URLs. The default is five minutes. Setting to zero will cache forever.
35+
|`cache.https` |number |300 |The length of time (in seconds) to cache HTTPS URLs. The default is five minutes. Setting to zero will cache forever.
36+
|`http.withCredentials`|bool |false |When used in browser specifies [`withCredentials`](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials) option of [`XMLHttpRequest`](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest) object. Set this to `true` if you're downloading files from a CORS-enabled server that requries authentication

‎lib/options.js

+9-4
Original file line numberDiff line numberDiff line change
@@ -92,11 +92,16 @@ function $RefParserOptions(options) {
9292
https: 5 * 60 // 5 minutes
9393
};
9494

95-
/* http options */
95+
/**
96+
* HTTP request options
97+
*/
9698
this.http = {
97-
/* withCredentials option of XMLHttpRequest */
98-
withCredentials: true
99-
}
99+
/**
100+
* The `withCredentials` option of XMLHttpRequest.
101+
* Set this to `true` if you're downloading files from a CORS-enabled server that requires authentication
102+
*/
103+
withCredentials: false
104+
};
100105

101106
merge(options, this);
102107
}

‎package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
"upgrade": "ncu --upgradeAll && npm update && bower update",
3232
"bump": "bump --prompt --grep lib/bundle.js dist/* --tag --push --all",
3333
"release": "npm run upgrade && npm test && npm run bump && npm publish",
34-
"start": "http-server -o -c-1"
34+
"start": "npm run watch & http-server -o -c-1"
3535
},
3636
"repository": {
3737
"type": "git",

‎tests/index.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@
5353
<script src="specs/circular-extended/circular-extended.dereferenced.js"></script>
5454
<script src="specs/circular-extended/circular-extended.spec.js"></script>
5555

56+
<script src="specs/cors/cors.spec.js"></script>
57+
5658
<script src="specs/deep/deep.parsed.js"></script>
5759
<script src="specs/deep/deep.dereferenced.js"></script>
5860
<script src="specs/deep/deep.bundled.js"></script>
@@ -83,8 +85,6 @@
8385
<script src="specs/callbacks.spec.js"></script>
8486
<script src="specs/yaml.spec.js"></script>
8587

86-
<script src="specs/cors.spec.js"></script>
87-
8888
<script>
8989
mocha.run();
9090
</script>

‎tests/specs/cors/cors.spec.js

+26-17
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,22 @@
11
'use strict';
22

3-
describe('parse from CORS with Access-Control-Allow-Origin: *', function() {
4-
var windowOnError, testDone;
5-
6-
beforeEach(function() {
7-
windowOnError = global.onerror;
8-
global.onerror = function() {
9-
testDone();
10-
return true;
11-
}
12-
});
13-
14-
afterEach(function() {
15-
global.onerror = windowOnError;
3+
describe('CORS support', function() {
4+
it('should download successfully by default', function() {
5+
// Swagger.io has CORS enabled, with "Access-Control-Allow-Origin" set to a wildcard ("*").
6+
// This should work by-default.
7+
var parser = new $RefParser();
8+
return parser
9+
.parse('http://petstore.swagger.io:80/v2/swagger.json')
10+
.then(function(schema) {
11+
expect(schema).to.be.an('object');
12+
expect(schema).not.to.be.empty;
13+
expect(parser.schema).to.equal(schema);
14+
});
1615
});
1716

18-
it('should parse successfully with http.withCredentials = false', function() {
17+
it('should download successfully with http.withCredentials = false (default)', function() {
18+
// Swagger.io has CORS enabled, with "Access-Control-Allow-Origin" set to a wildcard ("*").
19+
// So, withCredentials MUST be false (this is the default, but we're testing it explicitly here)
1920
var parser = new $RefParser();
2021
return parser
2122
.parse('http://petstore.swagger.io:80/v2/swagger.json', {
@@ -29,8 +30,14 @@ describe('parse from CORS with Access-Control-Allow-Origin: *', function() {
2930
});
3031

3132
if (userAgent.isBrowser) {
32-
it('should throw error in browser if http.withCredentials = true (default)', function(done) {
33-
testDone = done;
33+
it('should throw error in browser if http.withCredentials = true', function() {
34+
// Some old Webkit browsers throw a global error
35+
var oldOnError = global.onerror;
36+
global.onerror = function() {
37+
global.onerror = oldOnError; // restore the original error handler (failsafe)
38+
return true; // ignore the error
39+
};
40+
3441
var parser = new $RefParser();
3542
return parser
3643
.parse('http://petstore.swagger.io:80/v2/swagger.json', {
@@ -39,7 +46,9 @@ describe('parse from CORS with Access-Control-Allow-Origin: *', function() {
3946
.then(helper.shouldNotGetCalled)
4047
.catch(function(err) {
4148
expect(err.message).to.contain('Error downloading file');
42-
done();
49+
50+
// Restore the original error handler
51+
global.onerror = oldOnError;
4352
});
4453
});
4554
}

0 commit comments

Comments
 (0)