Class: OpenEHR::Parser::Base

Inherits:
Object
  • Object
show all
Defined in:
lib/openehr/parser.rb

Direct Known Subclasses

ADLParser, OPTParser, XMLArchetypeParser

Constant Summary collapse

SAFE_PARSE_OPTIONS =

Explicit, safe Nokogiri ParseOptions for untrusted OPT/archetype XML. Deliberately lists RECOVER|NONET|BIG_LINES by name rather than referencing Nokogiri::XML::ParseOptions::DEFAULT_XML - the whole point is to not silently follow that constant if a future Nokogiri release (or a downstream app pinning an older one) changes it.

  • RECOVER: parse malformed-but-well-intentioned XML leniently (matches today's implicit default; see docs/design/xxe-safe-parse-options-plan.md for real-fixture evidence that at least one downstream consumer OPT currently depends on this).
  • NONET: forbid network access during parsing. Nokogiri's own docs: "UNSAFE to unset this option" for untrusted input.
  • BIG_LINES: line numbers as long int, unrelated to safety.
  • NOENT (entity substitution) and DTDLOAD (external DTD subset loading) are deliberately NOT set - both default off in Nokogiri and both documented "UNSAFE to set...for untrusted documents". This is what actually gates XXE (see the plan's attack-proof section: enabling either makes local-file and external-DTD entity resolution succeed).
Nokogiri::XML::ParseOptions.new(
  Nokogiri::XML::ParseOptions::RECOVER |
  Nokogiri::XML::ParseOptions::NONET |
  Nokogiri::XML::ParseOptions::BIG_LINES
)

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(filename) ⇒ Base

Returns a new instance of Base.



34
35
36
 
# File 'lib/openehr/parser.rb', line 34

def initialize(filename)
  @filename = filename
end

Instance Attribute Details

#filename ⇒ Object (readonly)

Returns the value of attribute filename.



32
33
34
 
# File 'lib/openehr/parser.rb', line 32

def filename
  @filename
end

Instance Method Details

#parse ⇒ Object

Raises:

  • (NotImplementedError) 


38
39
40
 
# File 'lib/openehr/parser.rb', line 38

def parse
  raise NotImplementedError
end