
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
= BlueButtonParser
BlueButtonParser parses a BlueButton free-text personal health data file and translates it into a structured hash suitable for computational purposes.
BlueButton[http://www.va.gov/bluebutton/] is the initiative from the U.S. Department of Veterans Affairs to allow veterans to download their information from the "My HealtheVet" personal health record into a very simple text file. Because this file was meant to be human readable, not computationally readable, the file contains almost no markup or delimiters for sections, keys, or values.
BlueButtonParser was created by reverse-engineering the one {sample data file provided by the VA}[http://www.va.gov/BLUEBUTTON/docs/VA_My_HealtheVet_Blue_Button_Sample_Version_12_All_Data.txt] and creating some ad-hoc rules for how to parse the document. BlueButtonParser will attempt to find all the sections in the file, all the key-value pairs within that section, and even find collections of items within a section when applicable (e.g. the array of facilities in the section "TREATMENT FACILITIES").
Example free text data
----------------------------- DEMOGRAPHICS ----------------------------
Source: Self-Entered
First Name: ONE Middle Initial: A Last Name: MHVVETERAN Suffix: Alias: MHVVET Relationship to VA: Patient, Veteran, Employee
Gender: Male Blood Type: AB+ Organ Donor: Yes
Date of Birth: 01 Mar 1948 Marital Status: Married Current Occupation: Truck Driver
Example parsed data (JSON)
"DEMOGRAPHICS": { "Source": "Self-Entered", "First Name": "ONE", "Middle Initial": "A", "Last Name": "MHVVETERAN", "Suffix": null, "Alias": "MHVVET", "Relationship to VA": "Patient, Veteran, Employee", "Gender": "Male", "Blood Type": "AB+", "Organ Donor": "Yes", "Date of Birth": "01 Mar 1948", "Marital Status": "Married", "Current Occupation": "Truck Driver" }
== Install
sudo gem install blue_button_parser
== Usage require 'blue_button_parser'
my_bb_file = File.read("test/data/blue_button_example_data.txt") bbp = BlueButtonParser.new(my_bb_file)
parsed_data_hash = bbp.data
parsed_data_hash.keys
summary = parsed_data_hash["MY HEALTHEVET ACCOUNT SUMMARY"]
= Caveats
BlueButtonParser was reverse engineered based on the single sample data file provided by the VA (latest version: v12, 02 Dec 2011). Because there are no rules as to how the document should be formatted,
To keep the BlueButtonParser up-to-date, the test data file (test/data/blue_button_example_data.txt) and expect parsed output (test/data/expected_json_output.js) should be updated every time a new version of the BlueButtonData file is released.
Note however that as far as I know, there is no formal notification that a new version of the sample data file has been released, so I guess developers will just need to be vigilant. :)
After updates, make sure the tests still work and any applicable new tests get added.
= Prior work
Somebody took a stab at this in the past: http://rest-developer-edition.na8.force.com/BlueConverter
I believe the code for this example is found here: https://github.com/joshbirk/BlueConverter
BlueConverter great first pass implementation, but it needs a few corrections:
== Contributing to BlueButtonParser
== Copyright
Copyright (c) 2012 PatientsLikeMe. See LICENSE.txt for further details.
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.