We have a web service to provide dicom modality worklist operations. We have a security concern about sanitizing the user inputs (especially for attributes like Study Description, Requested Procedure Description etc.) to prevent script injection vulnerability, as these attributes have VR (value representation) as 'Long String' which accepts all characters except 'Backslash' and control characters, there is a possibility to inject some malicious script. This would pass through our service and may sit in the archive / PACS posing some obvious threats there for the clients that would consume the meta information from PACS.

I believe I am not the first one to face this problem. How have the community tackled this? Any recommendations would be helpful.

I am sceptical about going with the blacklisting route as that may restrict some use cases in the field.

1 Answer 1


... may sit in the archive / PACS posing some obvious threats there

Sitting in the archive does not pose any risk. Embedding in a context were the data gets interpreted as script poses a risk instead.

If you cannot restrict what can be put into the archive, then you must regulate how the content of the archive should be used - i.e. it needs to properly escaped after retrieving from the archive and before including in the output. Note that rules for escaping differ depending on the putput context, i.e. HTML, script, CSS, SQL statements, shell commands ... all have different rules.

If there are limits of what can be put into the archive, then you should enforce these limits before sending the data to the archive. Enforcing can be done be either by rejecting invalid input outright or by sanitizing/filtering the input to remove anything not allowed.

Note that depending on the possible input restrictions it might still be necessary to also escape the output even if input filtering is done. This is needed when the possible input restrictions are too weak to prevent misuse. And a good defense in depth practice is to both restrict/filter the input as much as possible while also escaping the output - because one never knows if the input filtering was sufficient.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .