Skip to content

Security: Fix XSS and JSON injection in SearchDemographicAutoComplete2Action #296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FinnBotOrca wants to merge 6 commits into
base: develop
Choose a base branch
from
Open

Security: Fix XSS and JSON injection in SearchDemographicAutoComplete2Action #296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a3c3adf
Security: Fix XSS and JSON injection in SearchDemographicAutoComplete…
FinnBotOrca Feb 7, 2026
1479107
Security: Add privilege check and fix HTML encoding semantics
FinnBotOrca Feb 7, 2026
b5b8c44
Security: Refactor XSS fix to avoid breaking input values by using sa…
FinnBotOrca Feb 7, 2026
f21406a
Security: Refine XSS/JSON fixes and add privilege check
FinnBotOrca Feb 7, 2026
495495c
Security: Code quality refinements and null safety
FinnBotOrca Feb 7, 2026
1b749ae
chore: address bot suggestions and remove author tag
FinnBotOrca Feb 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 50 additions & 29 deletions ...main/java/io/github/carlos_emr/carlos/commn/web/SearchDemographicAutoComplete2Action.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,18 +34,21 @@
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Objects;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;

import org.apache.commons.text.StringEscapeUtils;
import org.owasp.encoder.Encode;
import org.apache.commons.lang3.StringUtils;
import io.github.carlos_emr.carlos.commn.dao.DemographicCustDao;
import io.github.carlos_emr.carlos.commn.dao.DemographicDao;
import io.github.carlos_emr.carlos.commn.model.Demographic;
import io.github.carlos_emr.carlos.commn.model.DemographicCust;
import io.github.carlos_emr.carlos.managers.SecurityInfoManager;
import io.github.carlos_emr.carlos.utility.AppointmentUtil;
import io.github.carlos_emr.carlos.utility.LoggedInInfo;
import io.github.carlos_emr.carlos.utility.MiscUtils;
Expand All @@ -56,7 +59,7 @@
import io.github.carlos_emr.carlos.prescript.data.RxProviderData.Provider;

/**
* @author jaygallagher
*
*/
import com.opensymphony.xwork2.ActionSupport;
import org.apache.struts2.ServletActionContext;
Expand All @@ -66,110 +69,128 @@
HttpServletResponse response = ServletActionContext.getResponse();
private static final ObjectMapper objectMapper = new ObjectMapper();



public String execute() throws Exception {
String providerNo = LoggedInInfo.getLoggedInInfoFromSession(request).getLoggedInProviderNo();
LoggedInInfo loggedInInfo = LoggedInInfo.getLoggedInInfoFromSession(request);
SecurityInfoManager securityInfoManager = (SecurityInfoManager) SpringUtils.getBean(SecurityInfoManager.class);
if (!securityInfoManager.hasPrivilege(loggedInInfo, "_demographic", SecurityInfoManager.READ, null)) {
throw new SecurityException("missing required sec object (_demographic)");
}

String providerNo = loggedInInfo.getLoggedInProviderNo();

boolean outOfDomain = false;
if (request.getParameter("outofdomain") != null && request.getParameter("outofdomain").equals("true")) {
outOfDomain = true;
}

DemographicDao demographicDao = (DemographicDao) SpringUtils.getBean(DemographicDao.class);
DemographicCustDao demographicCustDao = (DemographicCustDao) SpringUtils.getBean(DemographicCustDao.class);
String searchStr = request.getParameter("demographicKeyword");

if (searchStr == null) {
searchStr = request.getParameter("query");
}

if (searchStr == null) {
searchStr = request.getParameter("name");
}

if (searchStr == null) {
searchStr = request.getParameter("term");
}

boolean activeOnly = false;
activeOnly = request.getParameter("activeOnly") != null && request.getParameter("activeOnly").equalsIgnoreCase("true");
boolean jqueryJSON = request.getParameter("jqueryJSON") != null && request.getParameter("jqueryJSON").equalsIgnoreCase("true");
RxProviderData rx = new RxProviderData();


List<Demographic> list = null;

if (searchStr.length() == 8 && searchStr.matches("([0-9]*)")) {
list = demographicDao.searchDemographicByDOB(searchStr.substring(0, 4) + "-" + searchStr.substring(4, 6) + "-" + searchStr.substring(6, 8), 100, 0, providerNo, outOfDomain);
} else if (activeOnly) {
OscarProperties props = OscarProperties.getInstance();
String pstatus = props.getProperty("inactive_statuses", "IN, DE, IC, ID, MO, FI");
pstatus = pstatus.replaceAll("'", "").replaceAll("\\s", "");
List<String> stati = Arrays.asList(pstatus.split(","));

list = demographicDao.searchDemographicByNameAndNotStatus(searchStr, stati, 100, 0, providerNo, outOfDomain);
if (list.size() == 100) {
MiscUtils.getLogger().warn("More results exists than returned");
}
} else {
list = demographicDao.searchDemographicByName(searchStr, 100, 0, providerNo, outOfDomain);
if (list.size() == 100) {
MiscUtils.getLogger().warn("More results exists than returned");
}
}


List<HashMap<String, String>> secondList = new ArrayList<HashMap<String, String>>();
List<HashMap<String, String>> secondList = new ArrayList<>();
for (Demographic demo : list) {
HashMap<String, String> h = new HashMap<String, String>();
HashMap<String, String> h = new HashMap<>();
h.put("fomattedDob", demo.getFormattedDob());
h.put("formattedName", StringEscapeUtils.escapeJava(demo.getFormattedName().replaceAll("\"", "\\\"")));
h.put("formattedName", demo.getFormattedName());
h.put("formattedNameHtml", Encode.forHtml(demo.getFormattedName()));
h.put("demographicNo", String.valueOf(demo.getDemographicNo()));
h.put("status", demo.getPatientStatus());
h.put("statusHtml", Encode.forHtml(demo.getPatientStatus()));


Provider p = rx.getProvider(demo.getProviderNo());
if (demo.getProviderNo() != null) {
h.put("providerNo", demo.getProviderNo());
}
if (p.getSurname() != null && p.getFirstName() != null) {
h.put("providerName", p.getSurname() + ", " + p.getFirstName());
h.put("providerNameHtml", Encode.forHtml(p.getSurname() + ", " + p.getFirstName()));
}

if (OscarProperties.getInstance().isPropertyActive("workflow_enhance")) {
h.put("nextAppointment", AppointmentUtil.getNextAppointment(demo.getDemographicNo() + ""));
DemographicCustDao demographicCustDao = (DemographicCustDao) SpringUtils.getBean(DemographicCustDao.class);
DemographicCust demographicCust = demographicCustDao.find(demo.getDemographicNo());

if (demographicCust != null) {
String cust1 = StringUtils.trimToNull(demographicCust.getNurse());
String cust2 = StringUtils.trimToNull(demographicCust.getResident());
String cust4 = StringUtils.trimToNull(demographicCust.getMidwife());
if (cust1 != null) {
h.put("cust1", cust1);
p = rx.getProvider(cust1);
h.put("cust1Name", p.getSurname() + ", " + p.getFirstName());
if (p.getSurname() != null && p.getFirstName() != null) {
h.put("cust1Name", p.getSurname() + ", " + p.getFirstName());
h.put("cust1NameHtml", Encode.forHtml(p.getSurname() + ", " + p.getFirstName()));
}
}
if (cust2 != null) {
h.put("cust2", cust2);
p = rx.getProvider(cust2);
h.put("cust2Name", p.getSurname() + ", " + p.getFirstName());
if (p.getSurname() != null && p.getFirstName() != null) {
h.put("cust2Name", p.getSurname() + ", " + p.getFirstName());
h.put("cust2NameHtml", Encode.forHtml(p.getSurname() + ", " + p.getFirstName()));
}
}
if (cust4 != null) {
h.put("cust4", cust4);
p = rx.getProvider(cust4);
h.put("cust4Name", p.getSurname() + ", " + p.getFirstName());
if (p.getSurname() != null && p.getFirstName() != null) {
h.put("cust4Name", p.getSurname() + ", " + p.getFirstName());
h.put("cust4NameHtml", Encode.forHtml(p.getSurname() + ", " + p.getFirstName()));
}
}
}

Check notice on line 184 in src/main/java/io/github/carlos_emr/carlos/commn/web/SearchDemographicAutoComplete2Action.java

View check run for this annotation

codefactor.io / CodeFactor

src/main/java/io/github/carlos_emr/carlos/commn/web/SearchDemographicAutoComplete2Action.java#L72-L184 

Complex Method
}


secondList.add(h);
}

HashMap<String, List<HashMap<String, String>>> d = new HashMap<String, List<HashMap<String, String>>>();
HashMap<String, List<HashMap<String, String>>> d = new HashMap<>();
d.put("results", secondList);
response.setContentType("text/x-json");
response.setContentType("application/json");
if (jqueryJSON) {
response.getWriter().print(formatJSON(secondList));
response.getWriter().flush();
Expand All @@ -181,24 +202,24 @@

}

private String formatJSON(List<HashMap<String, String>> info) {
StringBuilder json = new StringBuilder("[");

HashMap<String, String> record;
int size = info.size();
for (int idx = 0; idx < size; ++idx) {
record = info.get(idx);
json.append("{\"label\":\"" + record.get("formattedName") + " " + record.get("fomattedDob") + " (" + record.get("status") + ")\",\"value\":\"" + record.get("demographicNo") + "\"");
json.append(",\"providerNo\":\"" + record.get("providerNo") + "\",\"provider\":\"" + record.get("providerName") + "\",\"nextAppt\":\"" + record.get("nextAppointment") + "\",");
json.append("\"formattedName\":\"" + record.get("formattedName") + "\"}");

if (idx < size - 1) {
json.append(",");
}
private String formatJSON(List<HashMap<String, String>> info) throws JsonProcessingException {
List<HashMap<String, String>> results = new ArrayList<>(info.size());
for (HashMap<String, String> record : info) {
HashMap<String, String> h = new HashMap<>();
String name = Objects.toString(record.get("formattedName"), "");
String dob = Objects.toString(record.get("fomattedDob"), "");
String status = Objects.toString(record.get("status"), "");

String label = name + (dob.isEmpty() ? "" : " " + dob) + (status.isEmpty() ? "" : " (" + status + ")");
h.put("label", Encode.forHtml(label));
h.put("value", record.get("demographicNo"));
h.put("providerNo", record.get("providerNo"));
h.put("provider", record.get("providerNameHtml"));
h.put("nextAppt", Encode.forHtml(Objects.toString(record.get("nextAppointment"), "")));
h.put("formattedName", record.get("formattedNameHtml"));
results.add(h);
}
json.append("]");

return json.toString();
return objectMapper.writeValueAsString(results);
}

}
2 changes: 1 addition & 1 deletion src/main/webapp/appointment/addappointment.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -584,7 +584,7 @@ Ontario, Canada
})
.autocomplete("instance")._renderItem = function (ul, item) {
return $("<li>")
.append("<div><b>" + item.label + "</b>" + "<br>" + item.provider + "</div>")
.append($("<div>").append($("<b>").text(item.label)).append("<br>").append($("<span>").text(item.provider)))
.appendTo(ul);
};

Expand Down
2 changes: 1 addition & 1 deletion src/main/webapp/appointment/editappointment.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -709,7 +709,7 @@
})
.autocomplete("instance")._renderItem = function (ul, item) {
return jQuery("<li>")
.append("<div><b>" + item.label + "</b>" + "<br>" + item.provider + "</div>")
.append(jQuery("<div>").append(jQuery("<b>").text(item.label)).append("<br>").append(jQuery("<span>").text(item.provider)))
.appendTo(ul);
};

Expand Down
2 changes: 1 addition & 1 deletion src/main/webapp/oscarMDS/CreateLab.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@
})
.autocomplete( "instance" )._renderItem = function( ul, item ) {
return $( "<li>" )
.append( "<div><b>" + item.label + "</b>" + "<br>" + item.provider + "</div>" )
.append( $( "<div>" ).append( $( "<b>" ).text( item.label ) ).append( "<br>" ).append( $( "<span>" ).text( item.provider ) ) )
.appendTo( ul );
};

Expand Down