make buildOpenApiUrl return a URI

[rootvector2]

per review, buildOpenApiUrl now returns a java.net.URI instead of a String, and the URI is passed through generateSwaggerUIHtml / generateSwaggerUIScript right up to the point it's embedded in the html, so the url is parsed and validated at construction rather than being a raw string. the original escapeJs approach and its test are dropped.

[cortlepp]

Hey,
thanks for looking into this, but I don't think this is valid. First of all, the operator of the axis instance chooses the server name, that is not in our threat model (since the administrator can obviously change the behavior of axis, it's kind of their job). Secondly, even if they wanted to deploy the server to a malicious host name, that would still have to be a valid host name in order for any of this to work, and you just can't put a script tag inside of a host name (see the relevant RFCs for details).

I'd agree though that it would look nicer (and be more obviously correct) if buildOpenApiUrl would return a URI instead of a String (and we would pass that around right until we embed it into the html). If you want to improve the clarity of the code in that way I'd be open to reviewing such an MR.

[rootvector2]

fair enough on the threat model. reworked it along the lines you suggested: buildOpenApiUrl now returns a java.net.URI that gets passed around until it's embedded in the html, so the url is parsed and validated at construction instead of being a raw string. dropped escapeJs and its test, and updated the title/body to match. mvn -pl modules/openapi test passes.

[cortlepp]

Thanks @rootvector2 !

[rootvector2]

thanks for the merge, glad this one landed.