Disabling "?url=" parameter in swagger

[alegmal]

Hi,

Currently one can use "/?url=" parameter to 'inject' their code into swagger and potentially see confidential information such as cookies / headers that contain private keys. How can I disable / block the use of "/?url"?

[ponelat]

Thanks @alegmal, heads up that #4872 will be worked on soon.