chrome-tools 1.0.1 → 1.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-tools",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "CLI & Node.js library to extract Chrome browser data (bookmarks, history, cookies, autofill, extensions, and more) on macOS",
   "type": "module",
   "main": "./src/index.js",

package/src/core/crypto.js

@@ -12,8 +12,20 @@ const AES_IV = Buffer.alloc(16, " "); // 16 spaces (0x20)
  * @returns {string} The decrypted plaintext, or an error placeholder.
  */
 export function decryptValue(encryptedBlob, derivedKey) {
+  const decrypted = decryptValueBuffer(encryptedBlob, derivedKey);
+  return Buffer.isBuffer(decrypted) ? decrypted.toString("utf-8") : decrypted;
+}
+
+/**
+ * Decrypts a Chrome encrypted blob and returns the raw plaintext bytes.
+ *
+ * @param {Buffer|Uint8Array} encryptedBlob - The encrypted blob from the database.
+ * @param {Buffer} derivedKey - The derived 16-byte key.
+ * @returns {Buffer|string} The decrypted plaintext bytes, or an error placeholder.
+ */
+export function decryptValueBuffer(encryptedBlob, derivedKey) {
   if (!encryptedBlob || encryptedBlob.length === 0) {
-    return "";
+    return Buffer.alloc(0);
   }
 
   const blob = Buffer.isBuffer(encryptedBlob)
@@ -31,7 +43,7 @@ export function decryptValue(encryptedBlob, derivedKey) {
     const decipher = createDecipheriv("aes-128-cbc", derivedKey, AES_IV);
     let decrypted = decipher.update(ciphertext);
     decrypted = Buffer.concat([decrypted, decipher.final()]);
-    return decrypted.toString("utf-8");
+    return decrypted;
   } catch {
     return "<decryption failed>";
   }

package/src/modules/cookies.js

@@ -1,9 +1,24 @@
 import { join } from "node:path";
+import { createHash } from "node:crypto";
 import { resolveTargetProfiles } from "../core/chrome.js";
 import { deriveEncryptionKey } from "../core/keychain.js";
-import { decryptValue, chromeTimeToDate } from "../core/crypto.js";
+import { decryptValueBuffer, chromeTimeToDate } from "../core/crypto.js";
 import { queryDatabase, tableExists } from "../core/db.js";
 
+function decodeCookieValue(encryptedValue, derivedKey, hostKey) {
+  const decrypted = decryptValueBuffer(encryptedValue, derivedKey);
+  if (!Buffer.isBuffer(decrypted)) {
+    return decrypted;
+  }
+
+  const hostHash = createHash("sha256").update(hostKey).digest();
+  const valueBytes = decrypted.length >= hostHash.length && decrypted.subarray(0, hostHash.length).equals(hostHash)
+    ? decrypted.subarray(hostHash.length)
+    : decrypted;
+
+  return valueBytes.toString("utf-8");
+}
+
 /**
  * Extracts cookies from Chrome's Cookies database.
  * Encrypted values are decrypted using the same mechanism as passwords.
@@ -51,7 +66,7 @@ export function getCookies({ chromeDir, profile, domain, decrypt = true, limit =
       for (const row of rows) {
         let cookieValue = row.value || "";
         if (!cookieValue && row.encrypted_value && derivedKey) {
-          cookieValue = decryptValue(row.encrypted_value, derivedKey);
+          cookieValue = decodeCookieValue(row.encrypted_value, derivedKey, row.host_key);
         }
 
         results.push({