oathRedirect defines an Inline Event Handler which prevents oauth2 login if CSP is set to script-src 'self'

Hi there!

Q&A

• OS: Windows 10
• Browser: edge/chrome/firefox
• Version: edge79, chrome78, firefox70
• Method of installation: npm
• Swagger-UI version: 3.23.8
• Swagger/OpenAPI version: 3.0

Content & configuration

Configuration

• on the hosting site/app set the Content-Security-Policy: script-src 'self';
• add hashes of the known inline scripts to the CSP otherwise the index page will not load, there are 3 or 4 inline scripts used by swagger that needs to be white listed.
• configure swagger to use oauth2 with implicit flow(okta can be configured as a test oath server)

Describe the bug you're encountering

We are implementing CSP rules on a site hosting the swagger UI. The oauth-redirect.html has an inline event handler that is not possible to white list using CSP Options.

oauth-redirect.html

To reproduce...

Steps to reproduce the behavior:

1. navigate to swagger index
2. click authorize
3. login at Idp, you are redirected back to oath-redirect.html
4. View Browser Console Error:

CSP Error: Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self' 'sha256-hQoyAYxxdlQX6mYg//3SgDUdhiDx4sZq5ThHlCL8Ssg=' 'sha256-wSMjdhDGsmL8uer6UgaOodrMBixq2O/zf4+5e/MFH0A=' 'sha256-eGAYk6fd1okMa1sD6UOTFlv8sY5fE/9GBBbK/dRq+HU='". Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.

Expected behavior

Redirect should work with csp script-src 'self'

The inline event handler (onload="run()") should be moved to the script block so the entire block can be whitelisted with a hash. E.g.

document.addEventListener("DOMContentLoaded", function(){
   run();
});

Start with dist/oauth2-redirect.html at the linked inline onload handler. Reproduce the OAuth2 implicit-flow redirect with Content-Security-Policy: script-src 'self', then inspect the existing script block and verify the redirect works without an inline event handler. Done means the OAuth2 redirect succeeds under that CSP configuration.