fhirsmith 0.3.0

package/vcl/vcl.js

@@ -0,0 +1,253 @@
+//
+// Copyright 2025, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+const express = require('express');
+const {parseVCLAndSetId, validateVCLExpression, VCLParseException} = require('./vcl-parser.js');
+
+const Logger = require('../library/logger');
+const vclLog = Logger.getInstance().child({ module: 'vcl' });
+
+class VCLModule {
+  constructor(stats) {
+    this.router = express.Router();
+    this.config = null;
+    this.setupSecurityMiddleware();
+    this.setupRoutes();
+    this.stats = stats;
+  }
+
+  setupSecurityMiddleware() {
+    // Security headers middleware
+    this.router.use((req, res, next) => {
+      res.setHeader('X-Content-Type-Options', 'nosniff');
+      res.setHeader('X-Frame-Options', 'DENY');
+      res.setHeader('X-XSS-Protection', '1; mode=block');
+      res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+      res.setHeader('Content-Security-Policy', [
+        "default-src 'self'",
+        "script-src 'self' 'unsafe-inline'",
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data: https:",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "frame-ancestors 'none'"
+      ].join('; '));
+      res.removeHeader('X-Powered-By');
+      next();
+    });
+
+  }
+
+  // Parameter validation middleware
+  validateQueryParams(allowedParams = {}) {
+    return (req, res, next) => {
+      try {
+        const normalized = {};
+
+        // Check for parameter pollution (arrays) and validate
+        for (const [key, value] of Object.entries(req.query)) {
+          if (Array.isArray(value)) {
+            return res.status(400).json({
+              error: 'Parameter pollution detected',
+              parameter: key
+            });
+          }
+
+          if (allowedParams[key]) {
+            const config = allowedParams[key];
+
+            if (value !== undefined) {
+              if (typeof value !== 'string') {
+                return res.status(400).json({
+                  error: `Parameter ${key} must be a string`
+                });
+              }
+
+              if (value.length > (config.maxLength || 255)) {
+                return res.status(400).json({
+                  error: `Parameter ${key} too long (max ${config.maxLength || 255})`
+                });
+              }
+
+              if (config.pattern && !config.pattern.test(value)) {
+                return res.status(400).json({
+                  error: `Parameter ${key} has invalid format`
+                });
+              }
+
+              normalized[key] = value;
+            } else if (config.required) {
+              return res.status(400).json({
+                error: `Parameter ${key} is required`
+              });
+            } else {
+              normalized[key] = config.default || '';
+            }
+          } else if (value !== undefined) {
+            // Unknown parameter
+            return res.status(400).json({
+              error: `Unknown parameter: ${key}`
+            });
+          }
+        }
+
+        // Set default values for missing optional parameters
+        for (const [key, config] of Object.entries(allowedParams)) {
+          if (normalized[key] === undefined && !config.required) {
+            normalized[key] = config.default || '';
+          }
+        }
+
+        // Clear and repopulate in-place (Express 5 makes req.query a read-only getter)
+        for (const key of Object.keys(req.query)) delete req.query[key];
+        Object.assign(req.query, normalized);
+        next();
+      } catch (error) {
+        vclLog.error('Parameter validation error:', error);
+        res.status(500).json({ error: 'Parameter validation failed' });
+      }
+    };
+  }
+
+  // Enhanced HTML escaping
+  escapeHtml(str) {
+    if (!str || typeof str !== 'string') return '';
+
+    const escapeMap = {
+      '&': '&',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&#x27;',
+      '/': '&#x2F;',
+      '`': '&#x60;',
+      '=': '&#x3D;'
+    };
+
+    return str.replace(/[&<>"'`=/]/g, (match) => escapeMap[match]);
+  }
+
+  // VCL expression validation
+  validateVCLInput(vcl) {
+    if (!vcl || typeof vcl !== 'string') {
+      throw new Error('VCL expression must be a non-empty string');
+    }
+
+    // Length validation
+    if (vcl.length > 10000) {
+      throw new Error('VCL expression too long (max 10000 characters)');
+    }
+
+    // Basic character validation - allow VCL-specific characters
+    // VCL expressions can contain: letters, numbers, dots, hyphens, underscores, 
+    // colons, slashes, pipes, parentheses, square brackets, equals, commas, spaces
+    const allowedCharsPattern = /^[a-zA-Z0-9.\-_:/|()[\]=, \t\r\n]*$/;
+    if (!allowedCharsPattern.test(vcl)) {
+      throw new Error('VCL expression contains invalid characters');
+    }
+
+    // Check for potential injection patterns
+    const suspiciousPatterns = [
+      /<script/i,
+      /javascript:/i,
+      /on\w+\s*=/i,
+      /expression\s*\(/i,
+      /eval\s*\(/i,
+      /document\./i,
+      /window\./i
+    ];
+
+    for (const pattern of suspiciousPatterns) {
+      if (pattern.test(vcl)) {
+        throw new Error('VCL expression contains potentially malicious content');
+      }
+    }
+
+    return vcl;
+  }
+
+  async initialize(config) {
+    this.config = config;
+  }
+
+  setupRoutes() {
+    // Parameter validation config for VCL endpoint
+    const vclParams = {
+      vcl: {
+        required: true,
+        maxLength: 10000
+      }
+    };
+
+    // VCL parsing endpoint
+    this.router.get('/', this.validateQueryParams(vclParams), (req, res) => {
+      const start = Date.now();
+      try {
+        var {vcl} = req.query;
+
+        // Validation
+        if (!vcl) {
+          return res.status(400).json({
+            error: 'VCL expression is required as query parameter: ?vcl=<expression>'
+          });
+        }
+
+        if (vcl.startsWith('http://fhir.org/VCL/')) {
+          vcl = vcl.substring(20);
+        }
+
+        try {
+          // Validate the VCL expression first
+          if (!validateVCLExpression(vcl)) {
+            return res.status(400).json({
+              error: 'Invalid VCL expression syntax'
+            });
+          }
+
+          // Parse the VCL expression and generate ValueSet with ID
+          const valueSet = parseVCLAndSetId(vcl);
+
+          // Return the ValueSet as JSON
+          res.json(valueSet);
+
+        } catch (error) {
+          vclLog.error('VCL parsing error:' + error);
+
+          if (error instanceof VCLParseException) {
+            return res.status(400).json({
+              error: 'VCL parsing error',
+              message: error.message,
+              position: error.position >= 0 ? error.position : undefined
+            });
+          } else {
+            return res.status(500).json({
+              error: 'Internal server error while parsing VCL',
+              message: error.message
+            });
+          }
+        }
+      } finally {
+        this.stats.countRequest('vcl', Date.now() - start);
+      }
+    });
+  }
+
+  async shutdown() {
+    // VCL module doesn't have any resources to clean up
+  }
+
+  getStatus() {
+    return {
+      enabled: true
+    };
+  }
+
+  countRequest(name, tat) {
+    this.stats.countRequest(name, tat);
+  }
+}
+
+module.exports = VCLModule;

package/windows-install.js

@@ -0,0 +1,19 @@
+// npm install -g node-windows
+// npm link node-windows
+
+var Service = require('node-windows').Service;
+
+// Create a new service object
+var svc = new Service({
+  name:'FHIRServer-Node',
+  description: 'FHIRsmith',
+  script: "C:\\FHIRsmith\\server.js"
+});
+
+// Listen for the "install" event, which indicates the
+// process is available as a service.
+svc.on('install',function(){
+  svc.start();
+});
+
+svc.install();

package/xig/xig-template.html

@@ -0,0 +1,124 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<html xml:lang="en" lang="en">
+<head>
+    <title>FHIRsmith: [%title%]</title>
+
+  <meta charset="utf-8"/>
+  <meta content="width=device-width, initial-scale=1.0" name="viewport"/>
+  <meta content="http://hl7.org/fhir" name="author"/>
+  <meta charset="utf-8" http-equiv="X-UA-Compatible" content="IE=edge" />
+
+  <link rel="stylesheet" href="/fhir.css"/>
+
+
+    <!-- Bootstrap core CSS -->
+  <link rel="stylesheet" href="/assets/css/bootstrap.css"/>
+  <link rel="stylesheet" href="/assets/css/bootstrap-fhir.css"/>
+
+    <!-- Project extras -->
+  <link rel="stylesheet" href="/assets/css/project.css"/>
+  <link rel="stylesheet" href="/assets/css/pygments-manni.css"/>
+
+    <!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
+    <!-- [if lt IE 9]>
+    <script src="/assets/js/html5shiv.js"></script>
+    <script src="/assets/js/respond.min.js"></script>
+    <![endif] -->
+
+    <!-- Favicons -->
+  <link sizes="144x144" rel="apple-touch-icon-precomposed" href="/assets/ico/apple-touch-icon-144-precomposed.png"/>
+  <link sizes="114x114" rel="apple-touch-icon-precomposed" href="/assets/ico/apple-touch-icon-114-precomposed.png"/>
+  <link sizes="72x72" rel="apple-touch-icon-precomposed" href="/assets/ico/apple-touch-icon-72-precomposed.png"/>
+  <link rel="apple-touch-icon-precomposed" href="/assets/ico/apple-touch-icon-57-precomposed.png"/>
+  <link rel="shortcut icon" href="/assets/ico/favicon.png"/>
+<script type="text/javascript" src="/assets/js/json2.js"></script>
+<script type="text/javascript" src="/assets/js/statuspage.js"></script>
+<script type="text/javascript" src="/assets/js/jquery.min.js"></script>
+<script type="text/javascript" src="/assets/js/jquery-ui.min.js"></script>
+<link rel="stylesheet" href="/assets/css/jquery.ui.all.css">
+<script type="text/javascript" src="/assets/js/jquery.ui.core.js"></script>
+<script type="text/javascript" src="/assets/js/jquery.ui.widget.js"></script>
+<script type="text/javascript" src="/assets/js/jquery.ui.mouse.js"></script>
+<script type="text/javascript" src="/assets/js/jquery.ui.resizable.js"></script>
+<script type="text/javascript" src="/assets/js/jquery.ui.draggable.js"></script>
+<script type="text/javascript" src="/assets/js/jtip.js"></script>
+<script type="text/javascript" src="/assets/js/jcookie.js"></script>
+<script type="text/javascript" src="/assets/js/fhir-gw.js"></script>
+</head>
+
+<body>
+  
+	<div id="segment-navbar" class="segment">  <!-- segment-breadcrumb -->
+		<div id="stripe"> </div>
+		<div class="container">  <!-- container -->
+		<div style="background-color: #ad1f2f; padding: 6px; color: white;">  <!-- container -->
+  <a href="http://www.hl7.org/fhir" style="color: gold" title="Fast Healthcare Interoperability Resources - Home Page"><img border="0" src="/icon-fhir-16.png" style="vertical-align: text-bottom"/> <b>FHIR</b></a> &copy; HL7.org &nbsp;|&nbsp;
+  <a href="https://github.com/HealthIntersections/FHIRsmith/blob/main/README.md" style="color: gold"><img border="0" src="/FHIRsmith16.png" style="vertical-align: text-bottom"/> FHIRsmith</a> [%ver%] &nbsp;|&nbsp;
+  <a href="/" style="color: gold"> Server Home</a> &nbsp;|&nbsp;
+  <a href="/xig" style="color: gold">XIG Home</a>  &nbsp;|&nbsp;
+  <a href="/xig/stats" style="color: gold">XIG Stats</a>  &nbsp;|&nbsp;
+		</div>  <!-- /container -->
+		</div>  <!-- /container -->
+</div>
+
+	<!-- /segment-breadcrumb -->
+
+	<div id="segment-content" class="segment">  <!-- segment-content -->
+	<div class="container">  <!-- container -->
+            <div class="row">
+            	<div class="inner-wrapper">
+ <div class="col-9">
+
+  <h2><img border="0" src="../FHIRsmith32.png" style="vertical-align: text-bottom"/> FHIR IG analytics</h2>
+
+[%content%]
+
+
+ </div>
+
+
+				</div>  <!-- /inner-wrapper -->
+            </div>  <!-- /row -->
+        </div>  <!-- /container -->
+    </div>  <!-- /segment-content -->
+
+
+	<div id="segment-footer" class="segment">  <!-- segment-footer -->
+		<div class="container">  <!-- container -->
+			<div class="inner-wrapper">
+				<p>
+                    <a href="http://www.hl7.org/fhir" style="color: gold" title="Fast Healthcare Interoperability Resources - Home Page"><img border="0" src="/icon-fhir-16.png" style="vertical-align: text-bottom"/> <b>FHIR</b></a> &copy; HL7.org 2011+.  &nbsp;|&nbsp;
+                    <a href="https://github.com/HealthIntersections/FHIRsmith/blob/main/README.md" style="color: gold"><img border="0" src="/FHIRsmith16.png" style="vertical-align: text-bottom"/> FHIRsmith</a>  [%ver%]  &copy; HealthIntersections.com.au 2023+ &nbsp;|&nbsp;
+        XIG built as of [%download-date%] &nbsp;|&nbsp; [%total-resources%] resources in [%total-packages%] packages &nbsp;|&nbsp; ([%ms%] ms)
+        </p>
+			</div>  <!-- /inner-wrapper -->
+		</div>  <!-- /container -->
+	</div>  <!-- /segment-footer -->
+
+
+	<div id="segment-post-footer" class="segment hidden">  <!-- segment-post-footer -->
+		<div class="container">  <!-- container -->
+		</div>  <!-- /container -->
+	</div>  <!-- /segment-post-footer -->
+
+
+
+
+
+      <!-- JS and analytics only. -->
+      <!-- Bootstrap core JavaScript
+================================================== -->
+  <!-- Placed at the end of the document so the pages load faster -->
+<!-- <script src="/assets/js/jquery.js"/> -->
+<script src="/assets/js/bootstrap.min.js"/>
+<script src="/assets/js/respond.min.js"/>
+
+<script src="/assets/js/fhir.js"/>
+
+  <!-- Analytics Below
+================================================== -->
+
+</body>
+
+</html>