orthanc: OrthancExplorer/explorer.js comparison

comparison OrthancExplorer/explorer.js @ 2292:ccd44d546b47

Fix XSS inside DICOM in Orthanc Explorer

author	Sebastien Jodogne <s.jodogne@gmail.com>
date	Tue, 27 Jun 2017 17:54:45 +0200
parents	e0517f25919e
children	a95beca72e99

comparison

equal deleted inserted replaced

-:b9856b1615d6
+:ccd44d546b47
 //$.mobile.defaultPageTransition = 'slide';
 var currentPage = '';
 var currentUuid = '';
-// http://stackoverflow.com/a/4673436
-String.prototype.format = function() {
-var args = arguments;
-return this.replace(/{(\d+)}/g, function(match, number) {
-/*return typeof args[number] != 'undefined'
-? args[number]
-: match;*/
-return args[number];
-});
-};
 function DeepCopy(obj)
 {
 return jQuery.extend(true, {}, obj);
 }
 });
 }
-function CompleteFormatting(s, link, isReverse)
+function CompleteFormatting(node, link, isReverse, count)
 {
+if (count != null)
+{
+node = node.add($('<span>')
+.addClass('ui-li-count')
+.text(count));
+}
 if (link != null)
 {
-s = 'href="' + link + '">' + s + '</a>';
+node = $('<a>').attr('href', link).append(node);
 if (isReverse)
-s = 'data-direction="reverse" '+ s;
+node.attr('data-direction', 'reverse')
+}
-s = '<a ' + s;
-}
+node = $('<li>').append(node);
 if (isReverse)
-return '<li data-icon="back">' + s + '</li>';
+node.attr('data-icon', 'back');
-else
-return '<li>' + s + '</li>';
+return node;
 }
-function FormatMainDicomTags(tags, tagsToIgnore)
+function FormatMainDicomTags(target, tags, tagsToIgnore)
 {
-var s = '';
 for (var i in tags)
 {
 if (tagsToIgnore.indexOf(i) == -1)
 {
 var v = tags[i];
 i == "DicomSeriesInstanceUID")
 {
 v = SplitLongUid(v);
 }
+target.append($('<p>')
-s += ('<p>{0}: <strong>{1}</strong></p>').format(i, v);
+.text(i + ': ')
-}
+.append($('<strong>').text(v)));
 }
+}
-return s;
 }
 function FormatPatient(patient, link, isReverse)
 {
-var s = ('<h3>{0}</h3>{1}' +
+var node = $('<div>').append($('<h3>').text(patient.MainDicomTags.PatientName));
-'<span class="ui-li-count">{2}</span>'
-).format
+FormatMainDicomTags(node, patient.MainDicomTags, [
-(patient.MainDicomTags.PatientName,
+"PatientName"
-FormatMainDicomTags(patient.MainDicomTags, [
+// "OtherPatientIDs"
-"PatientName"
+]);
-/*"OtherPatientIDs" */
-]),
+return CompleteFormatting(node, link, isReverse, patient.Studies.length);
-patient.Studies.length
-);
-return CompleteFormatting(s, link, isReverse);
 }
 function FormatStudy(study, link, isReverse)
 {
-var s = ('<h3>{0}</h3>{1}' +
+var node = $('<div>').append($('<h3>').text(study.MainDicomTags.StudyDescription));
-'<span class="ui-li-count">{2}</span>'
-).format
+FormatMainDicomTags(node, study.MainDicomTags, [
-(study.MainDicomTags.StudyDescription,
-FormatMainDicomTags(study.MainDicomTags, [
 "StudyDescription",
 "StudyTime"
-]),
+]);
-study.Series.length
-);
+return CompleteFormatting(node, link, isReverse, study.Series.length);
-return CompleteFormatting(s, link, isReverse);
 }
 function FormatSeries(series, link, isReverse)
 }
 else
 {
 c = series.Instances.length + '/' + series.ExpectedNumberOfInstances;
 }
-var s = ('<h3>{0}</h3>' +
+var node = $('<div>')
-'<p><em>Status: <strong>{1}</strong></em></p>{2}' +
+.append($('<h3>').text(series.MainDicomTags.SeriesDescription))
-'<span class="ui-li-count">{3}</span>').format
+.append($('<p>').append($('<em>')
-(series.MainDicomTags.SeriesDescription,
+.text('Status: ')
-series.Status,
+.append($('<strong>').text(series.Status))));
-FormatMainDicomTags(series.MainDicomTags, [
+FormatMainDicomTags(node, series.MainDicomTags, [
 "SeriesDescription",
 "SeriesTime",
 "Manufacturer",
 "ImagesInAcquisition",
 "SeriesDate",
 "ImageOrientationPatient"
-]),
+]);
-c
-);
+return CompleteFormatting(node, link, isReverse, c);
-return CompleteFormatting(s, link, isReverse);
 }
 function FormatInstance(instance, link, isReverse)
 {
-var s = ('<h3>Instance {0}</h3>{1}').format
+var node = $('<div>').append($('<h3>').text('Instance: ' + instance.IndexInSeries));
-(instance.IndexInSeries,
-FormatMainDicomTags(instance.MainDicomTags, [
+FormatMainDicomTags(node, instance.MainDicomTags, [
 "AcquisitionNumber",
 "InstanceNumber",
 "InstanceCreationDate",
 "InstanceCreationTime",
 "ImagePositionPatient"
-])
+]);
-);
+return CompleteFormatting(node, link, isReverse);
-return CompleteFormatting(s, link, isReverse);
 }
 $('[data-role="page"]').live('pagebeforeshow', function() {
 $.ajax({
 dataType: 'json',
 async: false,
 cache: false,
 success: function(s) {
 if (s.Name != "") {
-$('.orthanc-name').html('<a class="ui-link" href="explorer.html">' + s.Name + '</a> &raquo; ');
+$('.orthanc-name').append($('<a>')
+.addClass('ui-link')
+.attr('href', 'explorer.html')
+.text(s.Name)
+.append(' &raquo; '));
 }
 }
 });
 });
 $('li', target).remove();
 for (var i = 0; i < studies.length; i++) {
 if (i == 0 || studies[i].MainDicomTags.StudyDate != studies[i - 1].MainDicomTags.StudyDate)
 {
-target.append('<li data-role="list-divider">{0}</li>'.format
+target.append($('<li>')
-(FormatDicomDate(studies[i].MainDicomTags.StudyDate)));
+.attr('data-role', 'list-divider')
+.text(FormatDicomDate(studies[i].MainDicomTags.StudyDate)));
 }
 target.append(FormatStudy(studies[i], '#study?uuid=' + studies[i].ID));
 }
 var target = $('#list-series');
 $('li', target).remove();
 for (var i = 0; i < series.length; i++) {
 if (i == 0 || series[i].MainDicomTags.SeriesDate != series[i - 1].MainDicomTags.SeriesDate)
 {
-target.append('<li data-role="list-divider">{0}</li>'.format
+target.append($('<li>')
-(FormatDicomDate(series[i].MainDicomTags.SeriesDate)));
+.attr('data-role', 'list-divider')
+.text(FormatDicomDate(series[i].MainDicomTags.SeriesDate)));
 }
 target.append(FormatSeries(series[i], '#series?uuid=' + series[i].ID));
 }
 target.listview('refresh');
 currentPage = 'study';
 });
 }
 }
+function EscapeHtml(value)
+{
+var ENTITY_MAP = {
+'&': '&amp;',
+'<': '&lt;',
+'>': '&gt;',
+'"': '&quot;',
+"'": '&#39;',
+'/': '&#x2F;',
+'`': '&#x60;',
+'=': '&#x3D;'
+};
+return String(value).replace(/[&<>"'`=\/]/g, function (s) {
+return ENTITY_MAP[s];
+});
+}
 function ConvertForTree(dicom)
 {
 var result = [];
 for (var i in dicom) {
 if (dicom[i] != null) {
-var label = i + '<span class="tag-name"> (<i>' + dicom[i]["Name"] + '</i>)</span>: ';
+var label = (i + '<span class="tag-name"> (<i>' +
+EscapeHtml(dicom[i]["Name"]) +
+'</i>)</span>: ');
 if (dicom[i]["Type"] == 'String')
 {
 result.push({
-label: label + '<strong>' + dicom[i]["Value"] + '</strong>',
+label: label + '<strong>' + EscapeHtml(dicom[i]["Value"]) + '</strong>',
 children: []
 });
 }
 else if (dicom[i]["Type"] == 'TooLong')
 {
 Sort(instances, function(x) { return x.IndexInSeries; }, true, false);
 var images = [];
 for (var i = 0; i < instances.length; i++) {
 images.push([ '../instances/' + instances[i].ID + '/preview',
-'{0}/{1}'.format(i + 1, instances.length) ])
+(i + 1).toString() + '/' + instances.length.toString() ])
 }
 jQuery.slimbox(images, 0, {
 overlayFadeDuration : 1,
 resizeDuration : 1,