Disable LiquidEngine evaluation by default

org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/utils/LiquidEngine.java

@@ -35,6 +35,8 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
 
  */
 
+import lombok.Getter;
+import lombok.Setter;
 import org.hl7.fhir.exceptions.FHIRException;
 import org.hl7.fhir.exceptions.PathEngineException;
 import org.hl7.fhir.r4.context.IWorkerContext;
@@ -52,6 +54,14 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
 @MarkedToMoveToAdjunctPackage
 public class LiquidEngine implements IHostApplicationServices {
 
+  /**
+    * IMPORTANT: LiquidEngine evaluation is permitted to access all resource elements, including sensitive information and
+    * authorization tokens. This should only be set to true if this code is being executed in a trusted environment with
+    * trusted Liquid templates.
+    */
+  @Getter @Setter
+  private static boolean allowLiquidEvaluation = false;
+
   public interface ILiquidEngineIcludeResolver {
     public String fetchInclude(LiquidEngine engine, String name);
   }
@@ -96,6 +106,9 @@ public LiquidDocument parse(String source, String sourceName) throws FHIRExcepti
   }
 
   public String evaluate(LiquidDocument document, Resource resource, Object appContext) throws FHIRException {
+    if (!allowLiquidEvaluation) {
+      throw new FHIRException("Liquid document evaluation is disabled as a security measure - see org.hl7.fhir.r4.utils.LiquidEngine#allowLiquidEvaluation");
+    }
     StringBuilder b = new StringBuilder();
     LiquidEngineContext ctxt = new LiquidEngineContext(appContext);
     for (LiquidNode n : document.body) {

org.hl7.fhir.r4/src/test/java/org/hl7/fhir/r4/test/LiquidEngineTests.java

@@ -19,7 +19,9 @@
 import org.hl7.fhir.r4.utils.LiquidEngine.LiquidDocument;
 import org.hl7.fhir.utilities.FileUtilities;
 import org.hl7.fhir.utilities.filesystem.ManagedFileAccess;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -40,6 +42,16 @@ public class LiquidEngineTests implements ILiquidEngineIcludeResolver {
   private JsonObject test;
   private LiquidEngine engine;
 
+  @BeforeAll
+  static void beforeAll() {
+    LiquidEngine.setAllowLiquidEvaluation(true);
+  }
+
+  @AfterAll
+  static void afterAll() {
+    LiquidEngine.setAllowLiquidEvaluation(false);
+  }
+
   @BeforeEach
   public void setUp() {
     engine = new LiquidEngine(TestingUtilities.context(), null);

org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/utils/LiquidEngine.java

@@ -36,6 +36,8 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
 
  */
 
+import lombok.Getter;
+import lombok.Setter;
 import org.hl7.fhir.exceptions.FHIRException;
 import org.hl7.fhir.exceptions.PathEngineException;
 import org.hl7.fhir.r4b.context.IWorkerContext;
@@ -60,6 +62,14 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
 @MarkedToMoveToAdjunctPackage
 public class LiquidEngine implements IHostApplicationServices {
 
+  /**
+    * IMPORTANT: LiquidEngine evaluation is permitted to access all resource elements, including sensitive information and
+    * authorization tokens. This should only be set to true if this code is being executed in a trusted environment with
+    * trusted Liquid templates.
+    */
+  @Getter @Setter
+  private static boolean allowLiquidEvaluation = false;
+
   public interface ILiquidRenderingSupport {
     String renderForLiquid(Object appContext, Base i) throws FHIRException;
   }
@@ -128,6 +138,9 @@ public LiquidDocument parse(String source, String sourceName) throws FHIRExcepti
   }
 
   public String evaluate(LiquidDocument document, Base resource, Object appContext) throws FHIRException {
+    if (!allowLiquidEvaluation) {
+      throw new FHIRException("Liquid document evaluation is disabled as a security measure - see org.hl7.fhir.r4b.utils.LiquidEngine#allowLiquidEvaluation");
+    }
     StringBuilder b = new StringBuilder();
     LiquidEngineContext ctxt = new LiquidEngineContext(appContext);
     for (LiquidNode n : document.body) {

org.hl7.fhir.r4b/src/test/java/org/hl7/fhir/r4b/test/LiquidEngineTests.java

@@ -16,7 +16,9 @@
 import org.hl7.fhir.r4b.utils.LiquidEngine;
 import org.hl7.fhir.r4b.utils.LiquidEngine.ILiquidEngineIncludeResolver;
 import org.hl7.fhir.r4b.utils.LiquidEngine.LiquidDocument;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
@@ -35,6 +37,16 @@ public class LiquidEngineTests implements ILiquidEngineIncludeResolver {
   private JsonObject test;
   private LiquidEngine engine;
 
+  @BeforeAll
+  static void beforeAll() {
+    LiquidEngine.setAllowLiquidEvaluation(true);
+  }
+
+  @AfterAll
+  static void afterAll() {
+    LiquidEngine.setAllowLiquidEvaluation(false);
+  }
+
   @BeforeEach
   public void setUp() throws Exception {
     engine = new LiquidEngine(TestingUtilities.context(), null);

org.hl7.fhir.r4b/src/test/java/org/hl7/fhir/r4b/test/NarrativeGenerationTests.java

@@ -31,12 +31,14 @@
 import org.hl7.fhir.r4b.renderers.utils.RenderingContext.ResourceRendererMode;
 import org.hl7.fhir.r4b.test.utils.TestingUtilities;
 
+import org.hl7.fhir.r4b.utils.LiquidEngine;
 import org.hl7.fhir.utilities.TerminologyServiceOptions;
 import org.hl7.fhir.utilities.FileUtilities;
 import org.hl7.fhir.utilities.Utilities;
 import org.hl7.fhir.utilities.xhtml.XhtmlComposer;
 import org.hl7.fhir.utilities.xhtml.XhtmlNode;
 import org.hl7.fhir.utilities.xml.XMLUtil;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -48,6 +50,16 @@
 
 public class NarrativeGenerationTests {
 
+  @BeforeAll
+  static void beforeAll() {
+    LiquidEngine.setAllowLiquidEvaluation(true);
+  }
+
+  @AfterAll
+  static void afterAll() {
+    LiquidEngine.setAllowLiquidEvaluation(false);
+  }
+
   public class TestProfileKnowledgeProvider implements ProfileKnowledgeProvider {
 
     private IWorkerContext context;

org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/liquid/LiquidEngine.java

@@ -36,6 +36,8 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
 
  */
 
+import lombok.Getter;
+import lombok.Setter;
 import org.hl7.fhir.exceptions.FHIRException;
 import org.hl7.fhir.exceptions.PathEngineException;
 import org.hl7.fhir.r5.context.IWorkerContext;
@@ -62,6 +64,14 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS
 @MarkedToMoveToAdjunctPackage
 public class LiquidEngine implements IHostApplicationServices {
 
+  /**
+  * IMPORTANT: LiquidEngine evaluation is permitted to access all resource elements, including sensitive information and
+  * authorization tokens. This should only be set to true if this code is being executed in a trusted environment with
+  * trusted Liquid templates.
+  */
+  @Getter @Setter
+  private static boolean allowLiquidEvaluation = false;
+
   public static class LiquidforloopObject extends Base {
 
     private static final long serialVersionUID = 6951452522873320076L;
@@ -227,6 +237,9 @@ public LiquidDocument parse(String source, String sourceName) throws FHIRExcepti
   }
 
   public String evaluate(LiquidDocument document, Base resource, Object appContext) throws FHIRException {
+    if (!allowLiquidEvaluation) {
+      throw new FHIRException("Liquid document evaluation is disabled as a security measure - see org.hl7.fhir.r5.liquid.LiquidEngine#allowLiquidEvaluation");
+    }
     StringBuilder b = new StringBuilder();
     LiquidEngineContext ctxt = new LiquidEngineContext(appContext, vars );
     for (LiquidNode n : document.body) {

org.hl7.fhir.r5/src/test/java/org/hl7/fhir/r5/test/LiquidEngineTests.java

@@ -16,7 +16,9 @@
 import org.hl7.fhir.r5.liquid.LiquidEngine.LiquidDocument;
 import org.hl7.fhir.r5.model.Resource;
 import org.hl7.fhir.r5.test.utils.TestingUtilities;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
@@ -35,6 +37,16 @@ public class LiquidEngineTests implements ILiquidEngineIncludeResolver {
   private JsonObject test;
   private LiquidEngine engine;
 
+  @BeforeAll
+  public static void beforeAll() {
+    LiquidEngine.setAllowLiquidEvaluation(true);
+  }
+
+  @AfterAll
+  public static void afterAll() {
+    LiquidEngine.setAllowLiquidEvaluation(false);
+  }
+
   @BeforeEach
   public void setUp() throws Exception {
     engine = new LiquidEngine(TestingUtilities.getSharedWorkerContext(), null);

org.hl7.fhir.r5/src/test/java/org/hl7/fhir/r5/test/NarrativeGenerationTests.java

@@ -18,6 +18,7 @@
 import org.hl7.fhir.r5.extensions.ExtensionUtilities;
 import org.hl7.fhir.r5.formats.JsonParser;
 import org.hl7.fhir.r5.formats.XmlParser;
+import org.hl7.fhir.r5.liquid.LiquidEngine;
 import org.hl7.fhir.r5.model.Base;
 import org.hl7.fhir.r5.model.ElementDefinition.ElementDefinitionBindingComponent;
 import org.hl7.fhir.r5.model.Resource;
@@ -43,6 +44,7 @@
 import org.hl7.fhir.utilities.xhtml.XhtmlComposer;
 import org.hl7.fhir.utilities.xhtml.XhtmlNode;
 import org.hl7.fhir.utilities.xml.XMLUtil;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -53,6 +55,15 @@
 import org.xml.sax.SAXException;
 
 public class NarrativeGenerationTests {
+  @BeforeAll
+  public static void beforeAll() {
+    LiquidEngine.setAllowLiquidEvaluation(true);
+  }
+
+  @AfterAll
+  public static void afterAll() {
+    LiquidEngine.setAllowLiquidEvaluation(false);
+  }
 
   public static class TestProfileKnowledgeProvider implements ProfileKnowledgeProvider {
 

org.hl7.fhir.r5/src/test/java/org/hl7/fhir/r5/utils/LiquidJsonTest.java

@@ -22,11 +22,23 @@
 import org.hl7.fhir.utilities.json.JsonException;
 import org.hl7.fhir.utilities.json.model.JsonObject;
 import org.hl7.fhir.utilities.json.parser.JsonParser;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
 public class LiquidJsonTest extends BaseHostServices {
 
+  @BeforeAll
+  public static void beforeAll() {
+    LiquidEngine.setAllowLiquidEvaluation(true);
+  }
+
+  @AfterAll
+  public static void afterAll() {
+    LiquidEngine.setAllowLiquidEvaluation(false);
+  }
+
   private ContextUtilities cu;
   private ProfileUtilities pu;
 

org.hl7.fhir.validation.cli/src/main/java/org/hl7/fhir/validation/cli/ValidatorCli.java

@@ -86,6 +86,7 @@ public class ValidatorCli {
 
   public static void main(String[] args) {
     System.setProperty("slf4j.internal.verbosity", "WARN");
+    org.hl7.fhir.r5.liquid.LiquidEngine.setAllowLiquidEvaluation(true);
     CLI cli = new CLI(new ValidationService());
     try {
       int exitCode = cli.parseArgsAndExecuteCommand(args);

org.hl7.fhir.validation/src/test/java/org/hl7/fhir/generation/tests/TestInstanceGenerationTester.java

@@ -30,13 +30,24 @@
 import org.hl7.fhir.utilities.json.model.JsonObject;
 import org.hl7.fhir.utilities.json.parser.JsonParser;
 import org.hl7.fhir.utilities.npm.FilesystemPackageCacheManager;
+import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Assertions;
-import org.junit.jupiter.api.Disabled;
+import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 
 @Slf4j
 public class TestInstanceGenerationTester {
 
+   @BeforeAll
+    static void beforeAll() {
+      org.hl7.fhir.r4.utils.LiquidEngine.setAllowLiquidEvaluation(true);
+    }
+
+    @AfterAll
+    static void afterAll() {
+      org.hl7.fhir.r4.utils.LiquidEngine.setAllowLiquidEvaluation(false);
+    }
+
   @Test
   public void testDataFactory() throws IOException, FHIRException, SQLException {
     FilesystemPackageCacheManager pcm = new FilesystemPackageCacheManager.Builder().build();