Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
= BlueButtonParser
BlueButtonParser parses a BlueButton free-text personal health data file and translates it into a structured hash suitable for computational purposes.
BlueButton[http://www.va.gov/bluebutton/] is the initiative from the U.S. Department of Veterans Affairs to allow veterans to download their information from the "My HealtheVet" personal health record into a very simple text file. Because this file was meant to be human readable, not computationally readable, the file contains almost no markup or delimiters for sections, keys, or values.
BlueButtonParser was created by reverse-engineering the one {sample data file provided by the VA}[http://www.va.gov/BLUEBUTTON/docs/VA_My_HealtheVet_Blue_Button_Sample_Version_12_All_Data.txt] and creating some ad-hoc rules for how to parse the document. BlueButtonParser will attempt to find all the sections in the file, all the key-value pairs within that section, and even find collections of items within a section when applicable (e.g. the array of facilities in the section "TREATMENT FACILITIES").
Example free text data
----------------------------- DEMOGRAPHICS ----------------------------
Source: Self-Entered
First Name: ONE Middle Initial: A Last Name: MHVVETERAN Suffix: Alias: MHVVET Relationship to VA: Patient, Veteran, Employee
Gender: Male Blood Type: AB+ Organ Donor: Yes
Date of Birth: 01 Mar 1948 Marital Status: Married Current Occupation: Truck Driver
Example parsed data (JSON)
"DEMOGRAPHICS": { "Source": "Self-Entered", "First Name": "ONE", "Middle Initial": "A", "Last Name": "MHVVETERAN", "Suffix": null, "Alias": "MHVVET", "Relationship to VA": "Patient, Veteran, Employee", "Gender": "Male", "Blood Type": "AB+", "Organ Donor": "Yes", "Date of Birth": "01 Mar 1948", "Marital Status": "Married", "Current Occupation": "Truck Driver" }
== Install
sudo gem install blue_button_parser
== Usage require 'blue_button_parser'
my_bb_file = File.read("test/data/blue_button_example_data.txt") bbp = BlueButtonParser.new(my_bb_file)
parsed_data_hash = bbp.data
parsed_data_hash.keys
summary = parsed_data_hash["MY HEALTHEVET ACCOUNT SUMMARY"]
= Caveats
BlueButtonParser was reverse engineered based on the single sample data file provided by the VA (latest version: v12, 02 Dec 2011). Because there are no rules as to how the document should be formatted,
To keep the BlueButtonParser up-to-date, the test data file (test/data/blue_button_example_data.txt) and expect parsed output (test/data/expected_json_output.js) should be updated every time a new version of the BlueButtonData file is released.
Note however that as far as I know, there is no formal notification that a new version of the sample data file has been released, so I guess developers will just need to be vigilant. :)
After updates, make sure the tests still work and any applicable new tests get added.
= Prior work
Somebody took a stab at this in the past: http://rest-developer-edition.na8.force.com/BlueConverter
I believe the code for this example is found here: https://github.com/joshbirk/BlueConverter
BlueConverter great first pass implementation, but it needs a few corrections:
== Contributing to BlueButtonParser
== Copyright
Copyright (c) 2012 PatientsLikeMe. See LICENSE.txt for further details.
FAQs
Unknown package
We found that blue_button_parser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.