From c93d775a1f837d733398bde26f85f126b2c675c7 Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 22 Aug 2023 18:38:42 +0200 Subject: [PATCH] improved data sanitation --- .../dev/dsf/fhir/adapter/HtmlFhirAdapter.java | 34 +++++++++---------- .../adapter/SearchBundleHtmlGenerator.java | 4 +-- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/HtmlFhirAdapter.java b/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/HtmlFhirAdapter.java index bcc90bb71..6cb2ab0ee 100644 --- a/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/HtmlFhirAdapter.java +++ b/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/HtmlFhirAdapter.java @@ -34,6 +34,7 @@ import org.hl7.fhir.r4.model.IdType; import org.hl7.fhir.r4.model.Resource; import org.hl7.fhir.r4.model.Task; +import org.springframework.web.util.HtmlUtils; import ca.uhn.fhir.context.FhirContext; import ca.uhn.fhir.model.api.annotation.ResourceDef; @@ -155,7 +156,7 @@ public void writeTo(Resource resource, Class type, Type genericType, Annotati """.replace("${basePath}", basePath)); - out.write("" + getTitle(uriInfo) + "\n"); + out.write("" + getTitle() + "\n"); out.write("\n"); out.write("\n"); @@ -269,14 +270,14 @@ public void writeTo(Resource resource, Class type, Type genericType, Annotati out.flush(); } - private String getTitle(UriInfo uri) + private String getTitle() { - if (uri == null || uri.getPath() == null || uriInfo.getPath().isBlank()) + if (uriInfo == null || uriInfo.getPath() == null || uriInfo.getPath().isBlank()) return "DSF"; else if (uriInfo.getPath().endsWith("/")) - return "DSF: " + uriInfo.getPath().substring(0, uriInfo.getPath().length() - 1); + return "DSF: " + HtmlUtils.htmlEscape(uriInfo.getPath().substring(0, uriInfo.getPath().length() - 1)); else - return "DSF: " + uriInfo.getPath(); + return "DSF: " + HtmlUtils.htmlEscape(uriInfo.getPath()); } private String getUrlHeading(Resource resource) throws MalformedURLException @@ -289,20 +290,22 @@ private String getUrlHeading(Resource resource) throws MalformedURLException for (int i = 2; i < pathSegments.length; i++) { - u += "/" + pathSegments[i]; - heading.append("/" + pathSegments[i] + ""); + String pathSegment = HtmlUtils.htmlEscape(pathSegments[i]); + u += "/" + pathSegment; + heading.append("/" + pathSegment + ""); } if (uri.getQuery() != null) { - u += "?" + uri.getQuery(); - heading.append("?" + uri.getQuery() + ""); + String querValue = HtmlUtils.htmlEscape(uri.getQuery()); + u += "?" + querValue; + heading.append("?" + querValue + ""); } else if (uriInfo.getQueryParameters().containsKey("_summary")) { - u += "?_summary=" + uriInfo.getQueryParameters().getFirst("_summary"); - heading.append("?_summary=" - + uriInfo.getQueryParameters().getFirst("_summary") + ""); + String summaryValue = HtmlUtils.htmlEscape(uriInfo.getQueryParameters().getFirst("_summary")); + u += "?_summary=" + summaryValue; + heading.append("?_summary=" + summaryValue + ""); } heading.append('\n'); @@ -460,11 +463,8 @@ private boolean isHtmlEnabled(Class resourceType, String basePath, Resource r { URI resourceUri = getResourceUri(resource); - if (htmlGeneratorsByType.containsKey(resourceType)) - return uriInfo != null && htmlGeneratorsByType.get(resourceType).stream() - .anyMatch(g -> g.isResourceSupported(basePath, resourceUri, resource)); - else - return false; + return htmlGeneratorsByType.containsKey(resourceType) && htmlGeneratorsByType.get(resourceType).stream() + .anyMatch(g -> g.isResourceSupported(basePath, resourceUri, resource)); } private String adaptFormInputsIfTask(Resource resource) diff --git a/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/SearchBundleHtmlGenerator.java b/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/SearchBundleHtmlGenerator.java index 81b4528f1..f94d84109 100644 --- a/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/SearchBundleHtmlGenerator.java +++ b/dsf-fhir/dsf-fhir-server/src/main/java/dev/dsf/fhir/adapter/SearchBundleHtmlGenerator.java @@ -23,6 +23,7 @@ import org.hl7.fhir.r4.model.StringType; import org.hl7.fhir.r4.model.Task; import org.hl7.fhir.r4.model.Task.ParameterComponent; +import org.springframework.web.util.HtmlUtils; import jakarta.ws.rs.core.MultivaluedMap; import jakarta.ws.rs.core.PathSegment; @@ -150,8 +151,7 @@ public void writeHtml(String basePath, URI resourceUri, Bundle resource, OutputS .filter(OperationOutcomeIssueComponent::hasDiagnostics) .map(i -> i.getSeverity().getDisplay() + ": " + i.getDiagnostics()).toList(); for (String diag : diagnostics) - out.write("

" + diag.replaceAll("&", "&") - .replaceAll("\"", """).replaceAll("<", "<").replaceAll(">", ">") + "

"); + out.write("

" + HtmlUtils.htmlEscape(diag) + "

"); out.write(""); }