Module: DaVinciDTRTestKit::DTRPayerServerV220::ContainedBinaryValidation

Included in:
ContainedBinaryTest
Defined in:
lib/davinci_dtr_test_kit/server/v2.2.0/questionnaire_design/contained_binary_validation.rb

Constant Summary collapse

PDF_CONTENT_TYPE = 
'application/pdf'.freeze
XHTML_CONTENT_TYPE = 
'application/xhtml+xml'.freeze
XHTML_NAMESPACE = 
'http://www.w3.org/1999/xhtml'.freeze
PROHIBITED_ELEMENTS =

TODO: Review the FHIR-referenced HTML 4.0 chapters in detail and determine whether this validator needs additional allowed-element or allowed-attribute handling.

This validator interprets Binary XHTML according to the FHIR R4 Narrative fragment rules. It enforces the explicitly prohibited elements and attributes, but does not yet attempt a comprehensive HTML allowlist. https://hl7.org/fhir/R4/narrative.html#security

"The XHTML content SHALL NOT contain a head, a body element, external stylesheet references, deprecated elements, scripts, forms, base/link/xlink, frames, iframes, objects or event related attributes (e.g. onClick)."

%w[
  base body form frame frameset head iframe input link object script style
].freeze
DEPRECATED_ELEMENTS =

HTML 4.0 deprecated elements: https://www.w3.org/TR/REC-html40-971218/appendix/changes.html#h-A.1.2

%w[applet basefont center dir font isindex menu s strike u].freeze
EXECUTABLE_URL_SCHEMES = 
%w[javascript vbscript].freeze

Instance Method Summary collapse

Instance Method Details

#contained_binaries(questionnaire_responses) ⇒ Object 



30
31
32
33
34
 
# File 'lib/davinci_dtr_test_kit/server/v2.2.0/questionnaire_design/contained_binary_validation.rb', line 30

def contained_binaries(questionnaire_responses)
  questionnaire_responses.flat_map do |questionnaire_response|
    questionnaire_response.contained&.grep(FHIR::Binary) || []
  end
end

#contained_binary_is_safe?(binary) ⇒ Boolean

Returns:

  • (Boolean) 


36
37
38
39
40
41
42
43
 
# File 'lib/davinci_dtr_test_kit/server/v2.2.0/questionnaire_design/contained_binary_validation.rb', line 36

def contained_binary_is_safe?(binary)
  return true if binary.contentType == PDF_CONTENT_TYPE
  return false unless binary.contentType == XHTML_CONTENT_TYPE

  safe_xhtml?(Base64.strict_decode64(binary.data.to_s))
rescue ArgumentError
  false
end

#safe_xhtml?(xhtml) ⇒ Boolean

Returns:

  • (Boolean) 


45
46
47
48
49
50
51
52
53
54
 
# File 'lib/davinci_dtr_test_kit/server/v2.2.0/questionnaire_design/contained_binary_validation.rb', line 45

def safe_xhtml?(xhtml)
  document = parse_xhtml(xhtml)

  narrative_fragment?(document) &&
    document.errors.empty? &&
    narrative_has_content?(document) &&
    document_has_no_unsafe_content?(document)
rescue Nokogiri::XML::SyntaxError
  false
end