Is there any mechanism already implemented in IRIS to prevent XSS exploits ?
This case happen when user input html/javascript content into fields and submit the page. If saved content is rendered as is, it's going to be executed by anyone visiting the page.
Is there any way to include a CSP page within a CLS? Example: #Include file.csp
Context: I work with a legacy that most screens are built using only CLS. I'm trying to change this by separating the frontend layers to be built only with CSP and backend layers using CLS. I improvised a method that injects an iframe to render the CSP in CLS through that iframe, but I'm still not happy. I need to know if there is any way to include this CSP using some specific resource for this.
We have a CSP pages script, which gets and sets a cookie for email tracking purposes, we had problems with cookies not being passed to this script when the URL was opened from an email client due to being cross-site, so I set Session Cookie Scope & User Cookie Scope to None instead of Strict.
This solved the issue with cookies not being passed, however the script entirely does not work anymore due to the error:
"Invalid CSP response cookie. SameSite cannot be set to None without Secure. : CSP Error"
After upgrading we had 2 major problems with the new version:
- Resending messages adds blank lines. Because we have many HL7 processes, we regulary have to resend messages if there is an outage of a server we connect with.
Any who has encounter the same error can please share your experience?
Trying to launch management portal and encountered "Server availability error". Port 57772 is open, IIS admin service and world wide web publishing service are running. checked firewall and no issues.
Hey everyone, I am implementing version control with git-source-control on our codebase and I ran into a pretty strange issue. I believe I have the set up (mostly) correct as the behavior with .cls files is exactly as expected. However, I noticed that git is not keeping track of any changes to CSP files.
Specifically, if a new CSP file is created and saved, I will get the following output:
exporting new version of /csp/testdb/wrc.csp to C:\InterSystems\IRIS\mgr\repo\TESTDB\csp\testdb\wrc.csp
I'm modifying a REST interface for a client but it seems impossible to me to modify HTTP Response Status and including custom HTTP Headers either.
My dispatch class (extending %CSP.REST) is contacted through a POST request and the latter is processed in a custom class (extending %CSP.REST as well) accessed as shown in the example below:
In today's rapidly evolving threat landscape, organizations deploying mission-critical applications must implement robust security architectures that protect sensitive data while maintaining high availability and performance. This is especially crucial for enterprises utilizing advanced database management systems like InterSystems IRIS, which often powers applications handling highly sensitive healthcare, financial, or personal data.
In this article, I will introduce my application iris-HL7v2Gen .
IRIS-HL7v2Gen is a CSP application that facilitates the dynamic generation of HL7 test messages. This process is essential for testing, debugging, and integrating healthcare data systems. The application allows users to generate a wide variety of HL7 message types, validate their structure against HL7 specifications, explore the message hierarchy, and transmit messages over TCP/IP to production systems. These features are particularly useful in settings where compliance with HL7 standards is mandatory for interoperability between different healthcare organizations or systems.
Application Features
Dynamic HL7 Message Generation: Instantly create HL7 messages for a range of message types, facilitating comprehensive testing.
Message Structure Exploration: Visualize the structure of generated messages based on HL7 specifications.
Value Set Visualization View predefined sets of allowable coded values for specific fields.
Message Validation: Validate messages against HL7 standards to ensure compliance.
TCP/IP Communication: Easily transmit messages to production using TCP/IP settings.
Broad Message Type Support: Supports 184 different HL7 message types, ensuring versatility for various healthcare integration needs.
ClassMethod: Generate a Test Message by Invoking a Class Method
Version Support: Currently Supports HL7 Version 2.5
I need to be able to take the size of the request from a given %CSP.request
however it seems the best the docs suggest is to get the length of characters in the request (using $order and Get, Count)... this is not good enough for what I need to do, Any suggestions? I scanned the docs and couldn't find anything.
I have a CSP page I am developing with the intent of pulling files from an SFTP site and placing them in a folder on the local network.
I am having an issue where the CSP page is catching a JS error. The error in the browser is - A JavaScript exception was caught during execution of HyperEvent: SyntaxError: Unexpected identifier 'downloading'. (However, the unexpected identifier changes after refreshing page, or after removing the Write statement with the work 'downloading' in it.)
I think I have narrowed it down to a piece of the Javascript code -
I'm a beginner and currently working on a project to convert CCDA files to FHIR using InterSystems IRIS. I have developed a web form to upload CCDA files, and I'm attempting to convert the uploaded CCDA files to FHIR. However, I am encountering an issue where the conversion process results in an empty entry. Here's the Output it displays on HTML page:
I am currently monitoring our license use with a new rest-service I am implementing when I noticed my licenses on my instance being consumed and never released by Visual Studio Code.
Hey, So the title pretty much describes the question: Where and How can i see the Stream that contains the response back to the client of a CSP application.
When the request is being processed and finished we return a response to the client - We do that by writing the data to a stream and that stream is sent back to the client. I wanted to know how i can access the point right before that Data is actually written to the client back (meaning the place where the response is actually being send back, the last point of contact).
Parallel query hinting boosts certain query performances on multi-processor systems via parallel processing. The SQL optimizer determines when this is beneficial. On single-processor systems, this hint has no effect.
Parallel processing can be managed by:
Setting the auto parallel option system-wide.
Using the %PARALLEL keyword in the FROM clause of specific queries.
Hello, In short, I am trying to get the Content-Length of my response,
We have a CSP application, when we get a new request we begin to process it, throughout the app we WRITE to the response in different places, now when the response is about to be sent back to the client - we would like to know its Content-Length (in the RESPONSE HEADERS). So it comes down to two questions: 1. How can we access the Content-Length of our response?
In a development environment, we have added quite a few presentation contexts to the DICOM configurations (the associations). We would need to find a way to export them from this environment to make it easier for us to import them in PRO (and avoid doing it by hand one by one).
I'm trying to rewrite a legacy portal created with all .csp files into a portal written in .cls files. The problem I have is that the old cap pages use "csp:include page='page.csp'> tags. I'm trying to use the Include method that is in the %CSP.Page master page. It doesn't seem to insert the required file. Any suggestions?
This is like my first post in this community. Let's see how this turns out. I have a question about the Intersystems Kubernetes Operator and the deployment of the webgateways.
I am responsible for the hosting and deployment of the apps. For the future we are planning to host our application in a kubernetes cluster. I am using the IKO for this. I am using webgateways, for external access as separate pods. And sidecar containers for internal access, like the management portal.
While developing web apps the security practice I consider safe and convenient is to create a special Role (e.g. equal application name) which contains security resources which application will need (SQL tables, priviledges, database access, etc) and assign it to the Web Application. So the user gets this role once it loggs in to the application (via password, no password or delegated).
Convenient, right?
So, the question is, when I deploy the app as an IPM module what should I put as a database access?
Year
Open Exchange app
.png)
.png)