search

cqframework / sample-content-ig

Sample Content IG
Apache License 2.0
7 stars 13 forks source link

Request: Escape string fields expected to contain freeform user input #10

Closed jkotanchik-SB closed 9 months ago

jkotanchik-SB commented 1 year ago

Fields that contain user supplied input may contain characters not supported by the parser. Where possible, use the FHIRPath escape function to avoid exceptions during parsing.

Noted areas: Measure Description: https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L176

Group Population Descriptions: https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L194 https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L582

SDE Description & SDE Criteria Descriptions: https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L668-L675

RAV Description & RAV Criteria Descriptions: https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L691-L699

CQL Statement Extension Values: https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L495-L497 https://github.com/cqframework/sample-content-ig/blob/bca8df99f5361c4829d1065bca67c5e7ab9fed0a/templates/liquid/Measure.liquid#L650-L652

brynrhodes commented 1 year ago

At some point the publisher changed behavior to automatically do this escaping, so that if we put the .escape call in the expression, what we actually get is rendered escapes in the output. We used to have .escape in most fields that could contain user input, but we have since removed them because of the change in the publisher behavior.

Can you confirm where you are seeing this issue?

brynrhodes commented 9 months ago

Closing this issue as not needed, given that the publisher does this processing (and other consumers of liquid template output would be expected to do the same as appropriate for display in their particular environment). Feel free to reopen or submit another issue if needed.