fhirsmith 0.16.1 → 0.18.0

package/library/mailer.js

@@ -0,0 +1,77 @@
+// library/mailer.js
+// Outbound email for the server, over SMTP (nodemailer). One of these is made from the
+// top-level "email" block of config.json, and anything that wants to send mail asks it
+// whether it's configured first - a server with no "email" block simply doesn't send.
+//
+//   "email": {
+//     "host": "smtp.example.org",
+//     "port": 587,                  // default 587; 465 implies secure
+//     "secure": false,              // TLS from the start (true for 465), else STARTTLS
+//     "user": "...", "password": "...",   // optional - leave out for an open relay
+//     "from": "FHIRsmith <fhirsmith@example.org>"
+//   }
+//
+// nodemailer is only loaded when a message is actually sent, so a server that doesn't
+// send mail doesn't need it installed.
+
+class Mailer {
+
+  constructor(config, log) {
+    this.config = config || {};
+    this.log = log || console;
+    this.transport = null;
+  }
+
+  /**
+   * Whether enough has been configured to send: a host to send through and an
+   * address to send from.
+   */
+  configured() {
+    return Boolean(this.config.host && this.config.from);
+  }
+
+  _transport() {
+    if (!this.transport) {
+      const nodemailer = require('nodemailer');
+      const port = this.config.port || 587;
+      const options = {
+        host: this.config.host,
+        port: port,
+        secure: this.config.secure ?? (port === 465)
+      };
+      if (this.config.user) {
+        options.auth = {user: this.config.user, pass: this.config.password};
+      }
+      this.transport = nodemailer.createTransport(options);
+    }
+    return this.transport;
+  }
+
+  /**
+   * Send one message. `to` is an address or a list of them; text is the body.
+   * Resolves with nodemailer's result, or throws - callers decide what a
+   * failure means to them.
+   */
+  async send({to, subject, text, html}) {
+    if (!this.configured()) {
+      throw new Error('Email is not configured (email.host and email.from are needed)');
+    }
+    if (!to || (Array.isArray(to) && to.length === 0)) {
+      throw new Error('No recipient given');
+    }
+    const message = {
+      from: this.config.from,
+      to: Array.isArray(to) ? to.join(', ') : to,
+      subject: subject,
+      text: text
+    };
+    if (html) {
+      message.html = html;
+    }
+    const result = await this._transport().sendMail(message);
+    this.log.info(`Email sent to ${message.to}: ${subject}`);
+    return result;
+  }
+}
+
+module.exports = Mailer;

package/library/narrative-check.js

@@ -0,0 +1,222 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+/**
+ * Checks FHIR narrative (and any other XHTML that will be shown in a page) for active
+ * content: anything that can run script, submit or navigate on its own, load another
+ * document, or restyle the page around it.
+ *
+ * FHIR's rule is that narrative "SHALL contain only the basic HTML formatting elements ...,
+ * <a> elements (either name or href), images and internally contained style attributes",
+ * and "SHALL NOT contain a head, a body element, external stylesheet references, deprecated
+ * elements, scripts, forms, base/link/xlink, frames, iframes, objects or event related
+ * attributes". This checks the active-content part of that, not the whole rule.
+ *
+ * The XHTML is parsed the way a browser parses it when it is inserted into a page (parse5
+ * implements the HTML parsing algorithm), so entity-encoded, mixed-case or malformed markup
+ * is checked as the browser would see it, not as it is written.
+ */
+
+const parse5 = require('parse5');
+
+// Elements that run script, load or embed another document, submit data, or change how
+// the page around them is read. svg and math are here because FHIR narrative has no
+// inline graphics (images are <img>), and both can carry script.
+const ACTIVE_ELEMENTS = new Set([
+  'script', 'style', 'link', 'meta', 'base',
+  'iframe', 'frame', 'frameset', 'object', 'embed', 'applet', 'portal', 'template',
+  'form', 'input', 'button', 'select', 'textarea', 'isindex', 'keygen',
+  'svg', 'math', 'head', 'body', 'html'
+]);
+
+// Attributes that hold a URL
+const URL_ATTRIBUTES = new Set([
+  'href', 'src', 'action', 'formaction', 'xlink:href', 'background', 'poster', 'srcset',
+  'data', 'codebase', 'cite', 'longdesc', 'usemap', 'dynsrc', 'lowsrc', 'ping', 'manifest'
+]);
+
+// Attributes that are active whatever their value
+const ACTIVE_ATTRIBUTES = new Set(['srcdoc', 'http-equiv', 'formaction']);
+
+// CSS in a style attribute that runs script or binds behaviour (old IE and Gecko)
+const ACTIVE_CSS = /expression\(|javascript:|vbscript:|-moz-binding|behavior:|@import/;
+
+// The scheme of a URL, as a browser reads it: leading spaces and control characters
+// are ignored, and so are tabs and newlines anywhere
+function urlScheme(url) {
+  // eslint-disable-next-line no-control-regex -- control characters are what browsers strip
+  const cleaned = String(url).replace(/^[\x00-\x20]+/, '').replace(/[\t\n\r]/g, '');
+  const m = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(cleaned);
+  return m ? { scheme: m[1].toLowerCase(), rest: cleaned.substring(m[0].length) } : null;
+}
+
+// Every URL in an attribute value (srcset has several)
+function urlsIn(name, value) {
+  if (name === 'srcset') {
+    return String(value).split(',').map(s => s.trim().split(/\s+/)[0]).filter(Boolean);
+  }
+  return [value];
+}
+
+// CSS comments removed by a single pass: the obvious regex, /\/\*[\s\S]*?\*\//g, rescans to
+// the end of the string for every unterminated '/*', which is quadratic - a style attribute
+// of a few hundred KB of '/* ' held the event loop for seconds
+function stripCssComments(css) {
+  let out = '';
+  let i = 0;
+  for (;;) {
+    const start = css.indexOf('/*', i);
+    if (start < 0) {
+      return out + css.substring(i);
+    }
+    out += css.substring(i, start);
+    const end = css.indexOf('*/', start + 2);
+    if (end < 0) {
+      return out;
+    }
+    i = end + 2;
+  }
+}
+
+// CSS with comments removed and escapes decoded, so \65 xpression( is seen as expression(
+function normaliseCss(css) {
+  return stripCssComments(String(css))
+    .replace(/\\([0-9a-fA-F]{1,6})\s?/g, (_, hex) => {
+      const cp = parseInt(hex, 16);
+      return cp > 0 && cp <= 0x10ffff ? String.fromCodePoint(cp) : '';
+    })
+    .replace(/\\(.)/g, '$1')
+    .replace(/\s+/g, '')
+    .toLowerCase();
+}
+
+function describe(node) {
+  return `<${node.tagName}>`;
+}
+
+function checkAttribute(node, attr, problems) {
+  const name = (attr.prefix ? `${attr.prefix}:${attr.name}` : attr.name).toLowerCase();
+  const value = attr.value || '';
+  if (name.startsWith('on')) {
+    problems.push(`an event handler attribute (${name}) on ${describe(node)}`);
+    return;
+  }
+  if (ACTIVE_ATTRIBUTES.has(name)) {
+    problems.push(`a ${name} attribute on ${describe(node)}`);
+    return;
+  }
+  if (name === 'style') {
+    if (ACTIVE_CSS.test(normaliseCss(value))) {
+      problems.push(`script or behaviour in the style attribute of ${describe(node)}`);
+    }
+    return;
+  }
+  if (URL_ATTRIBUTES.has(name)) {
+    for (const url of urlsIn(name, value)) {
+      const s = urlScheme(url);
+      if (!s) {
+        continue;
+      }
+      if (s.scheme === 'javascript' || s.scheme === 'vbscript' || s.scheme === 'livescript') {
+        problems.push(`a ${s.scheme}: URL in the ${name} of ${describe(node)}`);
+      } else if (s.scheme === 'data') {
+        // an inline image is fine: an image can't run script
+        const isImage = node.tagName === 'img' && (name === 'src' || name === 'srcset')
+          && /^image\//i.test(s.rest.trim());
+        if (!isImage) {
+          problems.push(`a data: URL in the ${name} of ${describe(node)}`);
+        }
+      }
+    }
+  }
+}
+
+function walk(node, problems) {
+  if (node.tagName) {
+    if (ACTIVE_ELEMENTS.has(node.tagName.toLowerCase())) {
+      problems.push(`a ${describe(node)} element`);
+    }
+    for (const attr of node.attrs || []) {
+      checkAttribute(node, attr, problems);
+    }
+  }
+  // a <template>'s content is a separate fragment
+  for (const child of [...(node.childNodes || []), ...(node.content ? [node.content] : [])]) {
+    walk(child, problems);
+  }
+}
+
+/**
+ * Checks XHTML for active content.
+ *
+ * @param {string} xhtml - e.g. a narrative's text.div
+ * @returns {string|null} what was found (the first few things, if several), or null if
+ *   there is no active content
+ */
+function checkNarrative(xhtml) {
+  if (xhtml == null || xhtml === '') {
+    return null;
+  }
+  if (typeof xhtml !== 'string') {
+    return 'the narrative is not a string';
+  }
+  const problems = [];
+  walk(parse5.parseFragment(xhtml), problems);
+  if (problems.length === 0) {
+    return null;
+  }
+  const shown = [...new Set(problems)];
+  const more = shown.length > 3 ? ` (and ${shown.length - 3} more)` : '';
+  return `active content in the narrative: ${shown.slice(0, 3).join('; ')}${more}`;
+}
+
+/**
+ * Checks every narrative in a resource: its own, its contained resources', and those of
+ * the resources in a Bundle's entries.
+ *
+ * @param {object} resource - the resource as JSON
+ * @returns {string|null} what was found, with where, or null
+ */
+function checkResourceNarratives(resource) {
+  const check = (res, where) => {
+    if (!res || typeof res !== 'object') {
+      return null;
+    }
+    const found = checkNarrative(res.text?.div);
+    if (found) {
+      return `${where}: ${found}`;
+    }
+    for (const [i, c] of (Array.isArray(res.contained) ? res.contained : []).entries()) {
+      const r = check(c, `${where}.contained[${i}]${c?.id ? ` (#${c.id})` : ''}`);
+      if (r) {
+        return r;
+      }
+    }
+    for (const [i, e] of (Array.isArray(res.entry) ? res.entry : []).entries()) {
+      const r = check(e?.resource, `${where}.entry[${i}]`);
+      if (r) {
+        return r;
+      }
+    }
+    return null;
+  };
+  return check(resource, resource?.resourceType ? `${resource.resourceType}${resource.id ? '/' + resource.id : ''}` : 'resource');
+}
+
+/**
+ * As checkResourceNarratives, but throws.
+ *
+ * @param {object} resource
+ * @param {string} [context] - for the message, e.g. the package it came from
+ */
+function assertNoActiveContent(resource, context) {
+  const found = checkResourceNarratives(resource);
+  if (found) {
+    throw new Error(context ? `${context}: ${found}` : found);
+  }
+}
+
+module.exports = { checkNarrative, checkResourceNarratives, assertNoActiveContent };

package/library/npm-audit.js

@@ -371,6 +371,31 @@ class NpmAudit {
     return this.findings.some(f => f.severity === 'critical' || f.severity === 'high');
   }
 
+  /**
+   * For the daily report: plain text, and only when there's something to act
+   * on - packages with known vulnerabilities (and what to do about them), a
+   * check that couldn't be run, or a newer FHIRsmith release. '' otherwise.
+   */
+  reportText() {
+    if (!this.enabled) {
+      return '';
+    }
+    const sentences = [];
+    if (this.findings.length > 0) {
+      const list = this.findings.map(f => `${f.name} ${f.installed.join('/')} (${f.severity}: ${f.range})`).join(', ');
+      sentences.push(`npm audit found ${this.summary()} in the packages this server uses: ${list}. ${this.advice()}`);
+    }
+    if (this.lastError) {
+      sentences.push(this.checkedAt
+        ? `The latest npm audit check failed: ${this.lastError}.`
+        : `The npm audit check could not be run: ${this.lastError}.`);
+    }
+    if (this.findings.length === 0 && this.installedVersion && compareVersions(this.installedVersion, this.latestVersion) < 0) {
+      sentences.push(`FHIRsmith ${this.latestVersion} is available (this server is running ${this.installedVersion}).`);
+    }
+    return sentences.join(' ');
+  }
+
   /**
    * Home page: nothing unless there is something to report
    */

package/library/package-manager.js

@@ -520,8 +520,10 @@ class PackageManager {
         const packagePath = path.join(this.cacheFolder, packageName);
 
         try {
-            const stats = await fs.stat(packagePath);
-            if (stats.isDirectory()) {
+            // the folder alone is not enough: a download that failed after the folder was made
+            // leaves an empty one, which must not count as the package
+            const stats = await fs.stat(path.join(packagePath, 'package', 'package.json'));
+            if (stats.isFile()) {
                 return packageName;
             }
         } catch (error) {

package/library/sqlite-session-store.js

@@ -130,4 +130,32 @@ class SqliteSessionStore extends session.Store {
   }
 }
 
-module.exports = { SqliteSessionStore };
+/**
+ * The callback API this store uses (run, get), over a better-sqlite3 database - for the
+ * modules that keep their data with better-sqlite3 rather than sqlite3.
+ * @param {object} db - an open better-sqlite3 Database
+ */
+function betterSqlite(db) {
+  return {
+    run(sql, params, cb) {
+      let info;
+      try {
+        info = db.prepare(sql).run(...params);
+      } catch (e) {
+        return cb(e);
+      }
+      cb.call(info, null);
+    },
+    get(sql, params, cb) {
+      let row;
+      try {
+        row = db.prepare(sql).get(...params);
+      } catch (e) {
+        return cb(e);
+      }
+      cb(null, row);
+    }
+  };
+}
+
+module.exports = { SqliteSessionStore, betterSqlite };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fhirsmith",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "txVersion": "1.9.6",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",
@@ -19,6 +19,8 @@
     "test:xig": "jest --testPathPatterns=xig",
     "test:packages": "jest --testPathPatterns=packages",
     "test:token": "jest --testPathPatterns=token",
+    "test:testing": "jest --testPathPatterns=tests/testing",
+    "test:ips": "jest --testPathPatterns=tests/ips",
     "test:integration": "jest --testPathPatterns=integration",
     "test:unit": "jest --testPathPatterns=unit",
     "lint": "eslint . --ext .js --ignore-path .gitignore",
@@ -46,21 +48,25 @@
     "express-rate-limit": "^7.4.1",
     "express-session": "^1.19.0",
     "fast-xml-parser": "^5.3.4",
-    "fhir-validator-wrapper": "1.4.0",
+    "fhir-validator-wrapper": "1.5.0",
     "fhirpath": "^5.2.1",
     "fs-extra": "^11.3.3",
     "ini": "^6.0.0",
     "inquirer": "^8.2.5",
+    "jose": "^5.10.0",
     "liquidjs": "^10.25.5",
     "lusca": "^1.7.0",
     "natural": "^8.1.1",
     "node-cron": "^4.6.0",
+    "nodemailer": "^10.2.0",
     "pako": "^2.1.0",
+    "parse5": "^7.3.0",
     "passport": "^0.7.0",
     "passport-facebook": "^3.0.0",
     "passport-github2": "^0.1.12",
     "passport-google-oauth20": "^2.0.0",
     "properties-file": "^3.6.4",
+    "qrcode-generator": "^2.0.4",
     "re2js": "^2.8.0",
     "rimraf": "^5.0.10",
     "sqlite3": "^6.0.1",