# HG changeset patch
# User Sebastien Jodogne <s.jodogne@gmail.com>
# Date 1716297548 -7200
# Node ID 41e3b79e7f4bb592696718343056ebb5a1df900a
# Parent  7b7e97724914c08bebd048b2f42c8d1be5d2b62a
added check of Nexus magic header

diff -r 7b7e97724914 -r 41e3b79e7f4b Sources/Plugin.cpp
--- a/Sources/Plugin.cpp	Sat May 18 11:37:11 2024 +0200
+++ b/Sources/Plugin.cpp	Tue May 21 15:19:08 2024 +0200
@@ -949,6 +949,19 @@
                                     "POST body missing string field \"" + std::string(KEY_CONTENT) + "\"");
   }
 
+  std::string decoded;
+  Orthanc::Toolbox::DecodeBase64(decoded, body[KEY_CONTENT].asString());
+
+  if (decoded.size() < 4 ||
+      decoded[0] != 0x20 ||
+      decoded[1] != 0x73 ||
+      decoded[2] != 0x78 ||
+      decoded[3] != 0x4e)
+  {
+    throw Orthanc::OrthancException(Orthanc::ErrorCode_BadFileFormat,
+                                    "This is not a valid Nexus file, its magic header is incorrect");
+  }
+
   Json::Value creationBody = Json::objectValue;
 
   creationBody[KEY_TAGS] = body[KEY_TAGS];