Markdown descriptions of API calls allows for XSS

[joevennix]

To reproduce, insert a <script> into the description of a method in the JSON schema. An example sinatra server is attached. To reproduce, go to the URL:

http://swaggerhost/index.html?url=http://localhost:4567/swagger.json#!/pet/getPetById

And you will see an alert().

The sinatra server script can be downloaded here:

https://gist.github.com/joevennix/effa381d5fa520662b07

[joevennix]

It would be a good idea to move any inline <script> tags into their own files, and add a CSP <meta> tag that prevents inline scripts from running. That would prevent most of these reflected XSS vulns.

[fehguy]

Fixed in a906cff