Mercurial > hg > orthanc

changeset 5465:2829889bfa57 pg-transactions

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
merge mainline -> pg-transactions
author Alain Mazy <am@osimis.io>
date Wed, 13 Dec 2023 15:44:33 +0100
parents 38f1d06875ad (current diff) 8f1a0ba5c759 (diff)
children dceed5e3d6a9
files
diffstat 7 files changed, 19 insertions(+), 7 deletions(-) [+]
line wrap: on
line diff
--- a/NEWS	Tue Dec 12 17:20:10 2023 +0100
+++ b/NEWS	Wed Dec 13 15:44:33 2023 +0100
@@ -91,6 +91,9 @@
 * Upgraded minizip library to stay away from CVE-2023-45853 although Orthanc is likely not affected since zip
   filenames are based on DICOM Tag values whose length is limited in size.
   Great thanks to James Addison for notifying us about the vulnerability and patch to apply !
+* Fix XSS in Orthanc error reporting (as reported by Sébastien Doria, Vumetric Cybersecurity) by:
+  - always including a 'Content-Type' header in HTTP responses with a body.
+  - always including 'X-Content-Type-Options: nosniff'
 
 
 Version 1.12.1 (2023-07-04)
--- a/OrthancFramework/Sources/Cache/MemoryStringCache.h	Tue Dec 12 17:20:10 2023 +0100
+++ b/OrthancFramework/Sources/Cache/MemoryStringCache.h	Wed Dec 13 15:44:33 2023 +0100
@@ -59,7 +59,7 @@
 
 
     public:
-      Accessor(MemoryStringCache& cache);
+      explicit Accessor(MemoryStringCache& cache);
       ~Accessor();
 
       bool Fetch(std::string& value, const std::string& key);
--- a/OrthancFramework/Sources/FileStorage/StorageCache.h	Tue Dec 12 17:20:10 2023 +0100
+++ b/OrthancFramework/Sources/FileStorage/StorageCache.h	Wed Dec 13 15:44:33 2023 +0100
@@ -48,7 +48,7 @@
       {
         StorageCache& storageCache_;
       public:
-        Accessor(StorageCache& cache);
+        explicit Accessor(StorageCache& cache);
 
         void Add(const std::string& uuid, 
                  FileContentType contentType,
--- a/OrthancFramework/Sources/HttpServer/HttpOutput.cpp	Tue Dec 12 17:20:10 2023 +0100
+++ b/OrthancFramework/Sources/HttpServer/HttpOutput.cpp	Wed Dec 13 15:44:33 2023 +0100
@@ -178,6 +178,9 @@
 
     if (state_ == State_WritingHeader)
     {
+      // always include this header to prevent MIME Confusion attacks: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
+      AddHeader("X-Content-Type-Options", "nosniff");
+
       // Send the HTTP header before writing the body
 
       stream_.OnHttpStatusReceived(status_);
@@ -351,8 +354,8 @@
 
 
   void HttpOutput::SendStatus(HttpStatus status,
-			      const char* message,
-			      size_t messageSize)
+                              const char* message,
+                              size_t messageSize)
   {
     if (status == HttpStatus_301_MovedPermanently ||
         //status == HttpStatus_401_Unauthorized ||
@@ -363,6 +366,13 @@
     }
     
     stateMachine_.SetHttpStatus(status);
+
+    if (messageSize > 0)
+    {
+      // we assume that the body always contains a json description of the error
+      stateMachine_.SetContentType("application/json");
+    }
+
     stateMachine_.SendBody(message, messageSize);
   }
 
--- a/OrthancFramework/Sources/Logging.cpp	Tue Dec 12 17:20:10 2023 +0100
+++ b/OrthancFramework/Sources/Logging.cpp	Wed Dec 13 15:44:33 2023 +0100
@@ -27,7 +27,6 @@
 #include "OrthancException.h"
 
 #include <stdint.h>
-#include <boost/thread/thread.hpp>
 
 
 /*********************************************************
@@ -473,6 +472,7 @@
  * mimics behavior from Google Log.
  *********************************************************/
 
+#include <boost/thread/thread.hpp>
 #include <cassert>
 
 namespace
--- a/OrthancServer/Sources/LuaScripting.cpp	Tue Dec 12 17:20:10 2023 +0100
+++ b/OrthancServer/Sources/LuaScripting.cpp	Wed Dec 13 15:44:33 2023 +0100
@@ -245,7 +245,7 @@
     JobEvent event_;
 
   public:
-    LuaJobEvent(const JobEvent& event) :
+    explicit LuaJobEvent(const JobEvent& event) :
       event_(event)
     {
     }
--- a/OrthancServer/Sources/Search/ISqlLookupFormatter.cpp	Tue Dec 12 17:20:10 2023 +0100
+++ b/OrthancServer/Sources/Search/ISqlLookupFormatter.cpp	Wed Dec 13 15:44:33 2023 +0100
@@ -664,7 +664,6 @@
 
     if (mainDicomTagsComparisons.size() > 0)
     {
-      std::string comparisons;
       for (std::vector<std::string>::const_iterator it = mainDicomTagsComparisons.begin(); it < mainDicomTagsComparisons.end(); ++it)
       {
         sql += (" AND internalId IN (SELECT id FROM MainDicomTags WHERE " + *it + ") ");