Conversation
…eri dan triase IGD.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix the problem, we need to ensure that any user-controlled data is properly sanitized or escaped before being inserted into the DOM. In this case, we can use the text() method to set the content of the modal instead of using html(). This will treat the content as plain text rather than HTML, preventing any potential XSS attacks.
- Replace the
.html()method with.text()method to ensure that the content is treated as plain text. - Update the relevant lines in the file
plugins/pasien/view/admin/display.html.
| @@ -159,3 +159,3 @@ | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| $("#modal_cetak_cover_rm").modal('show').text('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
|
|
||
| @@ -170,3 +170,3 @@ | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| $("#modal_cetak_identitas_pasien").modal('show').text('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
|
|
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix this issue, we need to ensure that any user-controlled data is properly sanitized or escaped before being inserted into the DOM. In this case, we can use the text() method to set the content of the modal, which will treat the content as plain text rather than HTML, thus preventing any potential XSS attacks.
- Replace the
.html()method with.text()to ensure that the content is treated as plain text. - Update the code to properly handle the insertion of the iframe by creating the element programmatically and setting its attributes.
| @@ -207,3 +207,12 @@ | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| var iframe = $('<iframe>', { | ||
| src: loadURL, | ||
| frameborder: 'no', | ||
| width: '100%', | ||
| height: '100%' | ||
| }); | ||
| var container = $('<div>', { | ||
| style: 'text-align:center;margin:20px auto;width:90%;height:95%;' | ||
| }).append(iframe); | ||
| $("#modal_cetak_cover_rm").modal('show').empty().append(container); | ||
|
|
||
| @@ -218,3 +227,12 @@ | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| var iframe = $('<iframe>', { | ||
| src: loadURL, | ||
| frameborder: 'no', | ||
| width: '100%', | ||
| height: '100%' | ||
| }); | ||
| var container = $('<div>', { | ||
| style: 'text-align:center;margin:20px auto;width:90%;height:95%;' | ||
| }).append(iframe); | ||
| $("#modal_cetak_identitas_pasien").modal('show').empty().append(container); | ||
|
|
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix the problem, we need to ensure that any user-controlled data is properly sanitized or escaped before being inserted into the HTML. In this case, we can use the text method to set the content of the modal in a safe way, and then separately set the src attribute of the iframe element. This approach ensures that the URL is not interpreted as HTML.
| @@ -217,4 +217,5 @@ | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').text('Loading...').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| $("#modal_cetak_identitas_pasien iframe").attr("src", loadURL); | ||
|
|
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix the problem, we need to ensure that any data inserted into the HTML is properly sanitized or escaped to prevent XSS attacks. In this case, we can use the text() method to set the content of the modal in a safe way, ensuring that any HTML special characters are escaped.
- Replace the direct HTML insertion with a safer method that escapes any potentially dangerous characters.
- Specifically, we will use the
text()method to set the content of the modal, and then append theiframeelement separately.
| @@ -542,4 +542,14 @@ | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/coverrm/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| var loadURL = baseURL + '/jasper/coverrm/' + encodeURIComponent(no_rkm_medis) + '?t=' + mlite.token; | ||
| $("#modal_cetak_cover_rm").modal('show').text(''); // Clear any existing content | ||
| var iframe = $('<iframe>', { | ||
| src: loadURL, | ||
| frameborder: 'no', | ||
| width: '100%', | ||
| height: '100%' | ||
| }); | ||
| var container = $('<div>', { | ||
| style: 'text-align:center;margin:20px auto;width:90%;height:95%;' | ||
| }).append(iframe); | ||
| $("#modal_cetak_cover_rm").append(container); | ||
|
|
||
| @@ -553,4 +563,14 @@ | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + encodeURIComponent(no_rkm_medis) + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').text(''); // Clear any existing content | ||
| var iframe = $('<iframe>', { | ||
| src: loadURL, | ||
| frameborder: 'no', | ||
| width: '100%', | ||
| height: '100%' | ||
| }); | ||
| var container = $('<div>', { | ||
| style: 'text-align:center;margin:20px auto;width:90%;height:95%;' | ||
| }).append(iframe); | ||
| $("#modal_cetak_identitas_pasien").append(container); | ||
|
|
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix the problem, we need to ensure that any user-controlled input is properly sanitized or escaped before being inserted into the HTML. In this case, we can use the text method instead of the html method to insert the URL into the modal content. This will prevent the browser from interpreting the string as HTML and mitigate the risk of XSS.
- Replace the
htmlmethod with thetextmethod to ensure that the URL is treated as plain text. - Update the relevant lines in the file
plugins/rawat_jalan/view/admin/display.html.
| @@ -554,3 +554,3 @@ | ||
| var loadURL = baseURL + '/jasper/identitaspasien/' + no_rkm_medis + '?t=' + mlite.token; | ||
| $("#modal_cetak_identitas_pasien").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
| $("#modal_cetak_identitas_pasien").modal('show').text('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); | ||
|
|
| var baseURL = mlite.url + '/' + mlite.admin; | ||
| event.preventDefault(); | ||
| var loadURL = baseURL + '/jasper/odontogram/' + no_rawat.replace(/\//g,'') + '?t=' + mlite.token; | ||
| $("#modal_cetak_odontogram").modal('show').html('<div style="text-align:center;margin:20px auto;width:90%;height:95%;"><iframe src="' + loadURL + '" frameborder="no" width="100%" height="100%"></iframe></div>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML
2 participants
Modul penilaian medis igd.
Modul penilaian medis ralan.
Modul penilaian medis ranap.
Modul penilaian medis keperawatan dan medis.
Assesmen nyeri.
Triase IGD.