We have a web service to provide dicom modality worklist operations. We have a security concern about sanitizing the user inputs (especially for attributes like Study Description, Requested Procedure Description etc.) to prevent script injection vulnerability, as these attributes have VR (value representation) as 'Long String' which accepts all characters except 'Backslash' and control characters, there is a possibility to inject some malicious script. This would pass through our service and may sit in the archive / PACS posing some obvious threats there for the clients that would consume the meta information from PACS.
I believe I am not the first one to face this problem. How have the community tackled this? Any recommendations would be helpful.
I am sceptical about going with the blacklisting route as that may restrict some use cases in the field.