cyberchef 10.24.0 → 11.0.0

package/.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
 {
 	"name": "CyberChef",
 	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-	"image": "mcr.microsoft.com/devcontainers/javascript-node:1-18-bookworm",
+	"image": "mcr.microsoft.com/devcontainers/javascript-node:24-trixie",
 
 	// Features to add to the dev container. More info: https://containers.dev/features.
 	"features": {

package/.nvmrc

@@ -1 +1 @@
-18
+24

package/CHANGELOG.md

@@ -13,6 +13,22 @@ All major and minor version changes will be documented in this file. Details of
 
 ## Details
 
+## [11.0.0] - 2026-04-28
+- Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348]
+- Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347]
+- Fix XSS in Show Base64 offsets [@C85297] | [#2346]
+- Make compatible with node >=22 [@GCHQDeveloper581] | [#2273]
+- Fix(node): enable asynchronous operation support in Node.js API [@engin0223] [@GCHQDeveloper581] | [#2342]
+- Feature: Change to nginx-unprivileged image for better kubernetes support [@hsolberg] | [#1922]
+
+Breaking changes:
+- Minimum supported node version - now v24 (was v16)
+- Change of exported port on Docker Container - now 8080 (was 80)
+- Node API now exports "bake" and "execute" functions as async.
+
+<details>
+    <summary>Click to expand v10 minor versions</summary>
+
 ### [10.24.0] - 2026-04-27
 - Update CONTRIBUTING.md [@GCHQDeveloper581] | [#2333]
 - Fix, and link, Fernet tests [@GCHQDeveloper581] | [#2335]
@@ -277,6 +293,8 @@ All major and minor version changes will be documented in this file. Details of
 - Added 'Levenshtein Distance' operation [@mikecat] | [#1498]
 - Added 'Swap case' operation [@mikecat] | [#1499]
 
+</details>
+
 ## [10.0.0] - 2023-03-22
 - [Full details explained here](https://github.com/gchq/CyberChef/wiki/Character-encoding,-EOL-separators,-and-editor-features)
 - Status bars added to the Input and Output [@n1474335] | [#1405]
@@ -620,6 +638,7 @@ All major and minor version changes will be documented in this file. Details of
 ## [4.0.0] - 2016-11-28
 -  Initial open source commit [@n1474335] | [b1d73a72](https://github.com/gchq/CyberChef/commit/b1d73a725dc7ab9fb7eb789296efd2b7e4b08306)
 
+[11.0.0]: https://github.com/gchq/CyberChef/releases/tag/v11.0.0
 [10.24.0]: https://github.com/gchq/CyberChef/releases/tag/v10.24.0
 [10.23.0]: https://github.com/gchq/CyberChef/releases/tag/v10.23.0
 [10.22.0]: https://github.com/gchq/CyberChef/releases/tag/v10.22.0
@@ -901,6 +920,9 @@ All major and minor version changes will be documented in this file. Details of
 [@BjoernAkAManf]: https://github.com/BjoernAkAManf
 [@ko80240]: https://github.com/ko80240
 [@BigYellowHammer]: https://github.com/BigYellowHammer
+[@hsolberg]: https://github.com/hsolberg
+[@lzandman]: https://github.com/lzandman
+[@engin0223]: https://github.com/engin0223
 
 
 [8ad18b]: https://github.com/gchq/CyberChef/commit/8ad18bc7db6d9ff184ba3518686293a7685bf7b7
@@ -1192,4 +1214,10 @@ All major and minor version changes will be documented in this file. Details of
 [#2315]: https://github.com/gchq/CyberChef/pull/2315
 [#2313]: https://github.com/gchq/CyberChef/pull/2313
 [#2311]: https://github.com/gchq/CyberChef/pull/2311
+[#2348]: https://github.com/gchq/CyberChef/pull/2348
+[#2347]: https://github.com/gchq/CyberChef/pull/2347
+[#2346]: https://github.com/gchq/CyberChef/pull/2346
+[#2273]: https://github.com/gchq/CyberChef/pull/2273
+[#2342]: https://github.com/gchq/CyberChef/pull/2342
+[#1922]: https://github.com/gchq/CyberChef/pull/1922
 

package/Dockerfile

@@ -4,7 +4,7 @@
 # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds
 # This is because npm "chromedriver" package is not compatiable with all platforms
 # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation
-FROM --platform=$BUILDPLATFORM node:18-alpine AS builder
+FROM --platform=$BUILDPLATFORM node:24-alpine AS builder
 
 WORKDIR /app
 
@@ -27,7 +27,7 @@ RUN npm run build
 #########################################
 # Package static build files into nginx #
 #########################################
-FROM nginx:stable-alpine AS cyberchef
+FROM nginxinc/nginx-unprivileged:stable-alpine AS cyberchef
 
 LABEL maintainer="GCHQ <oss@gchq.gov.uk>"
 

package/Gruntfile.js

@@ -6,7 +6,7 @@ const BundleAnalyzerPlugin = require("webpack-bundle-analyzer").BundleAnalyzerPl
 const glob = require("glob");
 const path = require("path");
 
-const nodeFlags = "--experimental-modules --experimental-json-modules --experimental-specifier-resolution=node --no-warnings --no-deprecation";
+const nodeFlags = "--no-warnings --no-deprecation";
 
 /**
  * Grunt configuration for building the app in various formats.

package/README.md

@@ -36,7 +36,7 @@ docker build --tag cyberchef --ulimit nofile=10000 .
 ```
 2. Run the docker container
 ```bash
-docker run -it -p 8080:80 cyberchef
+docker run -it -p 8080:8080 cyberchef
 ```
 3. Navigate to `http://localhost:8080` in your browser
 
@@ -45,7 +45,7 @@ docker run -it -p 8080:80 cyberchef
 If you prefer to skip the build process, you can use the pre-built image
 
 ```bash
-docker run -it -p 8080:80 ghcr.io/gchq/cyberchef:latest
+docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest
 ```
 
 Just like before, navigate to `http://localhost:8080` in your browser.
@@ -120,7 +120,7 @@ CyberChef is built to support
 
 ## Node.js support
 
-CyberChef is built to fully support Node.js `v16`. For more information, see the ["Node API" wiki page](https://github.com/gchq/CyberChef/wiki/Node-API)
+CyberChef is built to fully support Node.js `v24`. For more information, see the ["Node API" wiki page](https://github.com/gchq/CyberChef/wiki/Node-API)
 
 
 ## Contributing

package/babel.config.js

@@ -16,6 +16,9 @@ module.exports = function(api) {
                     "regenerator": true
                 }
             ]
-        ]
+        ],
+        "generatorOpts": {
+            "importAttributesKeyword": "with"
+        }
     };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyberchef",
-  "version": "10.24.0",
+  "version": "11.0.0",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
   "author": "n1474335 <n1474335@gmail.com>",
   "homepage": "https://gchq.github.io/CyberChef",
@@ -36,7 +36,7 @@
   "browserslist": [
     "Chrome >= 50",
     "Firefox >= 38",
-    "node >= 16"
+    "node >= 24"
   ],
   "devDependencies": {
     "@babel/eslint-parser": "^7.28.6",
@@ -55,14 +55,14 @@
     "chromedriver": "^146.0.6",
     "cli-progress": "^3.12.0",
     "colors": "^1.4.0",
-    "compression-webpack-plugin": "^11.1.0",
-    "copy-webpack-plugin": "^13.0.1",
+    "compression-webpack-plugin": "^12.0.0",
+    "copy-webpack-plugin": "^14.0.0",
     "core-js": "^3.49.0",
-    "cspell": "^8.19.4",
-    "css-loader": "7.1.4",
+    "cspell": "^9.7.0",
+    "css-loader": "^7.1.4",
     "eslint": "^9.39.4",
     "eslint-plugin-jsdoc": "^50.8.0",
-    "globals": "^15.15.0",
+    "globals": "^17.4.0",
     "grunt": "^1.6.2",
     "grunt-chmod": "~1.1.1",
     "grunt-concurrent": "^3.0.0",
@@ -87,8 +87,8 @@
     "sitemap": "^8.0.3",
     "terser": "^5.46.2",
     "webpack": "^5.106.2",
-    "webpack-bundle-analyzer": "^4.10.2",
-    "webpack-dev-server": "5.0.4",
+    "webpack-bundle-analyzer": "^5.0.0",
+    "webpack-dev-server": "^5.0.4",
     "webpack-node-externals": "^3.0.0",
     "worker-loader": "^3.0.8"
   },
@@ -164,11 +164,12 @@
     "notepack.io": "^3.0.1",
     "ntlm": "^0.1.3",
     "nwmatcher": "^1.4.4",
-    "otpauth": "9.3.6",
+    "otpauth": "^9.5.0",
     "path": "^0.12.7",
     "popper.js": "^1.16.1",
     "process": "^0.11.10",
     "protobufjs": "^7.5.5",
+    "punycode.js": "^2.3.1",
     "qr-image": "^3.2.0",
     "reflect-metadata": "^0.2.2",
     "rison": "^0.1.1",
@@ -194,18 +195,21 @@
     "start": "npx grunt dev",
     "build": "npx grunt prod",
     "node": "npx grunt node",
-    "repl": "node --experimental-modules --experimental-json-modules --experimental-specifier-resolution=node --no-experimental-fetch --no-warnings src/node/repl.mjs",
-    "test": "npx grunt configTests && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation --openssl-legacy-provider --no-experimental-fetch tests/node/index.mjs && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation --openssl-legacy-provider --no-experimental-fetch --trace-uncaught tests/operations/index.mjs",
+    "repl": "node --no-warnings src/node/repl.mjs",
+    "test": "npx grunt configTests && node --no-warnings --no-deprecation --openssl-legacy-provider tests/node/index.mjs && node --no-warnings --no-deprecation --openssl-legacy-provider --trace-uncaught tests/operations/index.mjs",
     "testnodeconsumer": "npx grunt testnodeconsumer",
     "testui": "npx grunt testui",
     "testuidev": "npx nightwatch --env=dev",
     "lint": "npx grunt lint",
     "lint:grammar": "cspell ./src",
     "postinstall": "npx grunt exec:fixCryptoApiImports && npx grunt exec:fixSnackbarMarkup",
-    "newop": "node --experimental-modules --experimental-json-modules src/core/config/scripts/newOperation.mjs",
-    "minor": "node --experimental-modules --experimental-json-modules src/core/config/scripts/newMinorVersion.mjs && npm version minor --git-tag-version=false && echo \"Updated to version v$(npm pkg get version | xargs), please create a pull request and once merged use 'npm run tag'\"",
+    "newop": "node src/core/config/scripts/newOperation.mjs",
+    "minor": "node src/core/config/scripts/newMinorVersion.mjs && npm version minor --git-tag-version=false && echo \"Updated to version v$(npm pkg get version | xargs), please create a pull request and once merged use 'npm run tag'\"",
     "tag": "git tag -s \"v$(npm pkg get version | xargs)\" -m \"$(npm pkg get version | xargs)\" && echo \"Created v$(npm pkg get version | xargs), now check and push the tag\"",
     "getheapsize": "node -e 'console.log(`node heap limit = ${require(\"v8\").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'",
     "setheapsize": "export NODE_OPTIONS=--max_old_space_size=2048"
+  },
+  "engines": {
+    "node": ">=24 <25"
   }
 }

package/src/core/ChefWorker.js

@@ -7,7 +7,7 @@
  */
 
 import Chef from "./Chef.mjs";
-import OperationConfig from "./config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "./config/OperationConfig.json" with { type: "json" };
 import OpModules from "./config/modules/OpModules.mjs";
 import loglevelMessagePrefix from "loglevel-message-prefix";
 

package/src/core/Recipe.mjs

@@ -4,7 +4,7 @@
  * @license Apache-2.0
  */
 
-import OperationConfig from "./config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "./config/OperationConfig.json" with { type: "json" };
 import OperationError from "./errors/OperationError.mjs";
 import Operation from "./Operation.mjs";
 import DishError from "./errors/DishError.mjs";

package/src/core/lib/Magic.mjs

@@ -1,4 +1,4 @@
-import OperationConfig from "../config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "../config/OperationConfig.json" with { type: "json" };
 import Utils, { isWorkerEnvironment } from "../Utils.mjs";
 import Recipe from "../Recipe.mjs";
 import Dish from "../Dish.mjs";

package/src/core/operations/FromPunycode.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import punycode from "punycode";
+import punycode from "punycode.js";
 
 /**
  * From Punycode operation

package/src/core/operations/ShowBase64Offsets.mjs

@@ -77,84 +77,84 @@ class ShowBase64Offsets extends Operation {
             staticSection = offset0.slice(0, -3);
             offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64(staticSection, alphabet).slice(0, -2)) + "'>" +
-                staticSection + "</span>" +
-                "<span class='hl5'>" + offset0.substr(offset0.length - 3, 1) + "</span>" +
-                "<span class='hl3'>" + offset0.substr(offset0.length - 2) + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset0.substr(offset0.length - 3, 1)) + "</span>" +
+                "<span class='hl3'>" + Utils.escapeHtml(offset0.substr(offset0.length - 2)) + "</span>";
         } else if (len0 % 4 === 3) {
             staticSection = offset0.slice(0, -2);
             offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64(staticSection, alphabet).slice(0, -1)) + "'>" +
-                staticSection + "</span>" +
-                "<span class='hl5'>" + offset0.substr(offset0.length - 2, 1) + "</span>" +
-                "<span class='hl3'>" + offset0.substr(offset0.length - 1) + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset0.substr(offset0.length - 2, 1)) + "</span>" +
+                "<span class='hl3'>" + Utils.escapeHtml(offset0.substr(offset0.length - 1)) + "</span>";
         } else {
             staticSection = offset0;
             offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64(staticSection, alphabet)) + "'>" +
-                staticSection + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>";
         }
 
         if (!showVariable) {
-            offset0 = staticSection;
+            offset0 = Utils.escapeHtml(staticSection);
         }
 
 
         // Highlight offset 1
-        padding = "<span class='hl3'>" + offset1.substr(0, 1) + "</span>" +
-            "<span class='hl5'>" + offset1.substr(1, 1) + "</span>";
+        padding = "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(0, 1)) + "</span>" +
+            "<span class='hl5'>" + Utils.escapeHtml(offset1.substr(1, 1)) + "</span>";
         offset1 = offset1.substr(2);
         if (len1 % 4 === 2) {
             staticSection = offset1.slice(0, -3);
             offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1, -2)) + "'>" +
-                staticSection + "</span>" +
-                "<span class='hl5'>" + offset1.substr(offset1.length - 3, 1) + "</span>" +
-                "<span class='hl3'>" + offset1.substr(offset1.length - 2) + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset1.substr(offset1.length - 3, 1)) + "</span>" +
+                "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(offset1.length - 2)) + "</span>";
         } else if (len1 % 4 === 3) {
             staticSection = offset1.slice(0, -2);
             offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1, -1)) + "'>" +
-                staticSection + "</span>" +
-                "<span class='hl5'>" + offset1.substr(offset1.length - 2, 1) + "</span>" +
-                "<span class='hl3'>" + offset1.substr(offset1.length - 1) + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset1.substr(offset1.length - 2, 1)) + "</span>" +
+                "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(offset1.length - 1)) + "</span>";
         } else {
             staticSection = offset1;
             offset1 = padding +  "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1)) + "'>" +
-                staticSection + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>";
         }
 
         if (!showVariable) {
-            offset1 = staticSection;
+            offset1 = Utils.escapeHtml(staticSection);
         }
 
         // Highlight offset 2
-        padding = "<span class='hl3'>" + offset2.substr(0, 2) + "</span>" +
-            "<span class='hl5'>" + offset2.substr(2, 1) + "</span>";
+        padding = "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(0, 2)) + "</span>" +
+            "<span class='hl5'>" + Utils.escapeHtml(offset2.substr(2, 1)) + "</span>";
         offset2 = offset2.substr(3);
         if (len2 % 4 === 2) {
             staticSection = offset2.slice(0, -3);
             offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2, -2)) + "'>" +
-                staticSection + "</span>" +
-                "<span class='hl5'>" + offset2.substr(offset2.length - 3, 1) + "</span>" +
-                "<span class='hl3'>" + offset2.substr(offset2.length - 2) + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset2.substr(offset2.length - 3, 1)) + "</span>" +
+                "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(offset2.length - 2)) + "</span>";
         } else if (len2 % 4 === 3) {
             staticSection = offset2.slice(0, -2);
             offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2, -2)) + "'>" +
-                staticSection + "</span>" +
-                "<span class='hl5'>" + offset2.substr(offset2.length - 2, 1) + "</span>" +
-                "<span class='hl3'>" + offset2.substr(offset2.length - 1) + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset2.substr(offset2.length - 2, 1)) + "</span>" +
+                "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(offset2.length - 1)) + "</span>";
         } else {
             staticSection = offset2;
             offset2 = padding +  "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2)) + "'>" +
-                staticSection + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>";
         }
 
         if (!showVariable) {
-            offset2 = staticSection;
+            offset2 = Utils.escapeHtml(staticSection);
         }
 
         return (showVariable ? "Characters highlighted in <span class='hl5'>green</span> could change if the input is surrounded by more data." +

package/src/core/operations/ToPunycode.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import punycode from "punycode";
+import punycode from "punycode.js";
 
 /**
  * To Punycode operation

package/src/node/NodeRecipe.mjs

@@ -88,16 +88,17 @@ class NodeRecipe {
      * @param {NodeDish} dish
      * @returns {NodeDish}
      */
-    execute(dish) {
-        return this.opList.reduce((prev, curr) => {
-            // CASE where opList item is op and args
+    async execute(dish) {
+        let prev = dish;
+        for (const curr of this.opList) {
             if (Object.prototype.hasOwnProperty.call(curr, "op") &&
                 Object.prototype.hasOwnProperty.call(curr, "args")) {
-                return curr.op(prev, curr.args);
+                prev = await curr.op(prev, curr.args);
+            } else {
+                prev = await curr(prev);
             }
-            // CASE opList item is just op.
-            return curr(prev);
-        }, dish);
+        }
+        return prev;
     }
 }
 

package/src/node/api.mjs

@@ -10,7 +10,7 @@
 
 import NodeDish from "./NodeDish.mjs";
 import NodeRecipe from "./NodeRecipe.mjs";
-import OperationConfig from "../core/config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "../core/config/OperationConfig.json" with { type: "json" };
 import { sanitise, removeSubheadingsFromArray, sentenceToCamelCase } from "./apiUtils.mjs";
 import ExcludedOperationError from "../core/errors/ExcludedOperationError.mjs";
 
@@ -324,10 +324,10 @@ export function help(input) {
  * @returns {NodeDish} of the result
  * @throws {TypeError} if invalid recipe given.
  */
-export function bake(input, recipeConfig) {
-    const recipe =  new NodeRecipe(recipeConfig);
+export async function bake(input, recipeConfig) {
+    const recipe = new NodeRecipe(recipeConfig);
     const dish = ensureIsDish(input);
-    return recipe.execute(dish);
+    return await recipe.execute(dish);
 }
 
 

package/src/web/index.js

@@ -17,8 +17,8 @@ import * as CanvasComponents from "../core/lib/CanvasComponents.mjs";
 
 // CyberChef
 import App from "./App.mjs";
-import Categories from "../core/config/Categories.json" assert {type: "json"};
-import OperationConfig from "../core/config/OperationConfig.json" assert {type: "json"};
+import Categories from "../core/config/Categories.json" with { type: "json" };
+import OperationConfig from "../core/config/OperationConfig.json" with { type: "json" };
 
 
 /**

package/src/web/static/sitemap.mjs

@@ -1,5 +1,5 @@
 import sm from "sitemap";
-import OperationConfig from "../../core/config/OperationConfig.json" assert { type: "json" };
+import OperationConfig from "../../core/config/OperationConfig.json" with { type: "json" };
 
 /**
  * Generates an XML sitemap for all CyberChef operations and a number of recipes.

package/tests/lib/wasmFetchPolyfill.mjs

@@ -0,0 +1,31 @@
+/**
+ * Polyfill for Node.js 22+ where globalThis.fetch is built-in but rejects
+ * bare filesystem paths. WASM libraries like argon2-browser call fetch() with
+ * an absolute path (e.g. "/path/to/argon2.wasm") expecting a browser-style
+ * fallback, but Node.js 22's fetch throws synchronously for non-URL strings.
+ *
+ * This wrapper intercepts such calls and serves the file via Node's fs module,
+ * returning a synthetic Response so the WASM module loads correctly.
+ */
+
+import { readFile } from "fs/promises";
+
+if (globalThis.fetch) {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async function patchedFetch(url, options) {
+        const urlStr = typeof url === "string" ?
+            url :
+            url instanceof URL ?
+                url.href :
+                String(url);
+        // Intercept bare filesystem paths (absolute POSIX or Windows)
+        if (urlStr.startsWith("/") || /^[A-Za-z]:[/\\]/.test(urlStr)) {
+            const buffer = await readFile(urlStr);
+            return new Response(buffer, {
+                status: 200,
+                headers: { "Content-Type": "application/wasm" },
+            });
+        }
+        return originalFetch(url, options);
+    };
+}

package/tests/node/consumers/cjs-consumer.js

@@ -8,9 +8,9 @@
 
 const assert = require("assert");
 
-require("cyberchef").then(chef => {
+require("cyberchef").then(async chef => {
 
-    const d = chef.bake("Testing, 1 2 3", [
+    const d = await chef.bake("Testing, 1 2 3", [
         chef.toHex,
         chef.reverse,
         {

package/tests/node/consumers/esm-consumer.mjs

@@ -9,7 +9,7 @@ import assert from "assert";
 import chef from "cyberchef";
 import { bake, toHex, reverse, unique, multiply } from "cyberchef";
 
-const a = bake("Testing, 1 2 3", [
+const a = await bake("Testing, 1 2 3", [
     toHex,
     reverse,
     {
@@ -28,7 +28,7 @@ const a = bake("Testing, 1 2 3", [
 
 assert.equal(a.value, "630957449041920");
 
-const b = chef.bake("Testing, 1 2 3", [
+const b = await chef.bake("Testing, 1 2 3", [
     chef.toHex,
     chef.reverse,
     {

package/tests/node/tests/Categories.mjs

@@ -1,6 +1,6 @@
 import TestRegister from "../../lib/TestRegister.mjs";
-import Categories from "../../../src/core/config/Categories.json" assert {type: "json"};
-import OperationConfig from "../../../src/core/config/OperationConfig.json" assert {type: "json"};
+import Categories from "../../../src/core/config/Categories.json" with { type: "json" };
+import OperationConfig from "../../../src/core/config/OperationConfig.json" with { type: "json" };
 import it from "../assertionHandler.mjs";
 import assert from "assert";
 

package/tests/node/tests/nodeApi.mjs

@@ -170,77 +170,77 @@ TestRegister.addApiTests([
         assert(chef.bake);
     }),
 
-    it("chef.bake: should return NodeDish", () => {
-        const result = chef.bake("input", "to base 64");
+    it("chef.bake: should return NodeDish", async () => {
+        const result = await chef.bake("input", "to base 64");
         assert(result instanceof NodeDish);
     }),
 
-    it("chef.bake: should take an input and an op name and perform it", () => {
-        const result = chef.bake("some input", "to base 32");
+    it("chef.bake: should take an input and an op name and perform it", async () => {
+        const result = await chef.bake("some input", "to base 32");
         assert.strictEqual(result.toString(), "ONXW2ZJANFXHA5LU");
     }),
 
-    it("chef.bake: should complain if recipe isnt a valid object", () => {
-        assert.throws(() => chef.bake("some input", 3264), {
+    it("chef.bake: should complain if recipe isnt a valid object", async () => {
+        await assert.rejects(() => chef.bake("some input", 3264), {
             name: "TypeError",
             message: "Recipe can only contain function names or functions"
         });
     }),
 
-    it("chef.bake: Should complain if string op is invalid", () => {
-        assert.throws(() => chef.bake("some input", "not a valid operation"), {
+    it("chef.bake: Should complain if string op is invalid", async () => {
+        await assert.rejects(() => chef.bake("some input", "not a valid operation"), {
             name: "TypeError",
             message: "Couldn't find an operation with name 'not a valid operation'."
         });
     }),
 
-    it("chef.bake: Should take an input and an operation and perform it", () => {
-        const result = chef.bake("https://google.com/search?q=help", chef.parseURI);
+    it("chef.bake: Should take an input and an operation and perform it", async () => {
+        const result = await chef.bake("https://google.com/search?q=help", chef.parseURI);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = help\n");
     }),
 
-    it("chef.bake: Should complain if an invalid operation is inputted", () => {
-        assert.throws(() => chef.bake("https://google.com/search?q=help", () => {}), {
+    it("chef.bake: Should complain if an invalid operation is inputted", async () => {
+        await assert.rejects(() => chef.bake("https://google.com/search?q=help", () => {}), {
             name: "TypeError",
             message: "Inputted function not a Chef operation."
         });
     }),
 
-    it("chef.bake: accepts an array of operation names and performs them all in order", () => {
-        const result = chef.bake("https://google.com/search?q=that's a complicated question", ["URL encode", "URL decode", "Parse URI"]);
+    it("chef.bake: accepts an array of operation names and performs them all in order", async () => {
+        const result = await chef.bake("https://google.com/search?q=that's a complicated question", ["URL encode", "URL decode", "Parse URI"]);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = that's a complicated question\n");
     }),
 
-    it("chef.bake: forgiving with operation names", () =>{
-        const result = chef.bake("https://google.com/search?q=that's a complicated question", ["urlencode", "url decode", "parseURI"]);
+    it("chef.bake: forgiving with operation names", async () =>{
+        const result = await chef.bake("https://google.com/search?q=that's a complicated question", ["urlencode", "url decode", "parseURI"]);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = that's a complicated question\n");
     }),
 
-    it("chef.bake: forgiving with operation names", () =>{
-        const result = chef.bake("hello", ["to base 64"]);
+    it("chef.bake: forgiving with operation names", async () =>{
+        const result = await chef.bake("hello", ["to base 64"]);
         assert.strictEqual(result.toString(), "aGVsbG8=");
     }),
 
-    it("chef.bake: if recipe is empty array, return input as dish", () => {
-        const result = chef.bake("some input", []);
+    it("chef.bake: if recipe is empty array, return input as dish", async () => {
+        const result = await chef.bake("some input", []);
         assert.strictEqual(result.toString(), "some input");
         assert(result instanceof NodeDish, "Result is not instance of NodeDish");
     }),
 
-    it("chef.bake: accepts an array of operations as recipe", () => {
-        const result = chef.bake("https://google.com/search?q=that's a complicated question", [chef.URLEncode, chef.URLDecode, chef.parseURI]);
+    it("chef.bake: accepts an array of operations as recipe", async () => {
+        const result = await chef.bake("https://google.com/search?q=that's a complicated question", [chef.URLEncode, chef.URLDecode, chef.parseURI]);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = that's a complicated question\n");
     }),
 
-    it("should complain if an invalid operation is inputted as part of array", () => {
-        assert.throws(() => chef.bake("something", [() => {}]), {
+    it("should complain if an invalid operation is inputted as part of array", async () => {
+        await assert.rejects(() => chef.bake("something", [() => {}]), {
             name: "TypeError",
             message: "Inputted function not a Chef operation."
         });
     }),
 
-    it("chef.bake: should take single JSON object describing op and args OBJ", () => {
-        const result = chef.bake("some input", {
+    it("chef.bake: should take single JSON object describing op and args OBJ", async () => {
+        const result = await chef.bake("some input", {
             op: chef.toHex,
             args: {
                 Delimiter: "Colon"
@@ -249,23 +249,23 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "73:6f:6d:65:20:69:6e:70:75:74");
     }),
 
-    it("chef.bake: should take single JSON object desribing op with optional args", () => {
-        const result = chef.bake("some input", {
+    it("chef.bake: should take single JSON object desribing op with optional args", async () => {
+        const result = await chef.bake("some input", {
             op: chef.toHex,
         });
         assert.strictEqual(result.toString(), "73 6f 6d 65 20 69 6e 70 75 74");
     }),
 
-    it("chef.bake: should take single JSON object describing op and args ARRAY", () => {
-        const result = chef.bake("some input", {
+    it("chef.bake: should take single JSON object describing op and args ARRAY", async () => {
+        const result = await chef.bake("some input", {
             op: chef.toHex,
             args: ["Colon"]
         });
         assert.strictEqual(result.toString(), "73:6f:6d:65:20:69:6e:70:75:74");
     }),
 
-    it("chef.bake: should error if op in JSON is not chef op", () => {
-        assert.throws(() => chef.bake("some input", {
+    it("chef.bake: should error if op in JSON is not chef op", async () => {
+        await assert.rejects(() => chef.bake("some input", {
             op: () => {},
             args: ["Colon"],
         }), {
@@ -274,8 +274,8 @@ TestRegister.addApiTests([
         });
     }),
 
-    it("chef.bake: should take multiple ops in JSON object form, some ops by string", () => {
-        const result = chef.bake("some input", [
+    it("chef.bake: should take multiple ops in JSON object form, some ops by string", async () => {
+        const result = await chef.bake("some input", [
             {
                 op: chef.toHex,
                 args: ["Colon"]
@@ -290,8 +290,8 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "67;63;72;66;146;72;66;144;72;66;65;72;62;60;72;66;71;72;66;145;72;67;60;72;67;65;72;67;64");
     }),
 
-    it("chef.bake: should take multiple ops in JSON object form, some without args", () => {
-        const result = chef.bake("some input", [
+    it("chef.bake: should take multiple ops in JSON object form, some without args", async () => {
+        const result = await chef.bake("some input", [
             {
                 op: chef.toHex,
             },
@@ -305,8 +305,8 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "67;63;40;66;146;40;66;144;40;66;65;40;62;60;40;66;71;40;66;145;40;67;60;40;67;65;40;67;64");
     }),
 
-    it("chef.bake: should handle op with multiple args", () => {
-        const result = chef.bake("some input", {
+    it("chef.bake: should handle op with multiple args", async () => {
+        const result = await chef.bake("some input", {
             op: "to morse code",
             args: {
                 formatOptions: "Dash/Dot",
@@ -317,13 +317,13 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "DotDotDot\\DashDashDash\\DashDash\\Dot,DotDot\\DashDot\\DotDashDashDot\\DotDotDash\\Dash");
     }),
 
-    it("chef.bake: should take compact JSON format from Chef Website as recipe", () => {
-        const result = chef.bake("some input", [{"op": "To Morse Code", "args": ["Dash/Dot", "Backslash", "Comma"]}, {"op": "Hex to PEM", "args": ["SOMETHING"]}, {"op": "To Snake case", "args": [false]}]);
+    it("chef.bake: should take compact JSON format from Chef Website as recipe", async () => {
+        const result = await chef.bake("some input", [{"op": "To Morse Code", "args": ["Dash/Dot", "Backslash", "Comma"]}, {"op": "Hex to PEM", "args": ["SOMETHING"]}, {"op": "To Snake case", "args": [false]}]);
         assert.strictEqual(result.toString(), "begin_something_anananaaaaak_da_aaak_da_aaaaananaaaaaaan_da_aaaaaaanan_da_aaak_end_something");
     }),
 
-    it("chef.bake: should accept Clean JSON format from Chef website as recipe", () => {
-        const result = chef.bake("some input", [
+    it("chef.bake: should accept Clean JSON format from Chef website as recipe", async () => {
+        const result = await chef.bake("some input", [
             { "op": "To Morse Code",
                 "args": ["Dash/Dot", "Backslash", "Comma"] },
             { "op": "Hex to PEM",
@@ -334,8 +334,8 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "begin_something_anananaaaaak_da_aaak_da_aaaaananaaaaaaan_da_aaaaaaanan_da_aaak_end_something");
     }),
 
-    it("chef.bake: should accept Clean JSON format from Chef website - args optional", () => {
-        const result = chef.bake("some input", [
+    it("chef.bake: should accept Clean JSON format from Chef website - args optional", async () => {
+        const result = await chef.bake("some input", [
             { "op": "To Morse Code" },
             { "op": "Hex to PEM",
                 "args": ["SOMETHING"] },
@@ -345,31 +345,28 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "begin_something_aaaaaaaaaaaaaa_end_something");
     }),
 
-    it("chef.bake: should accept operation names from Chef Website which contain forward slash", () => {
-        const result = chef.bake("I'll have the test salmon", [
+    it("chef.bake: should accept operation names from Chef Website which contain forward slash", async () => {
+        const result = await chef.bake("I'll have the test salmon", [
             { "op": "Find / Replace",
                 "args": [{ "option": "Regex", "string": "test" }, "good", true, false, true, false]}
         ]);
         assert.strictEqual(result.toString(), "I'll have the good salmon");
     }),
 
-    it("chef.bake: should accept operation names from Chef Website which contain a hyphen", () => {
-        const result = chef.bake("I'll have the test salmon", [
+    it("chef.bake: should accept operation names from Chef Website which contain a hyphen", async () => {
+        const result = await chef.bake("I'll have the test salmon", [
             { "op": "Adler-32 Checksum",
                 "args": [] }
         ]);
         assert.strictEqual(result.toString(), "6e4208f8");
     }),
 
-    it("chef.bake: should accept operation names from Chef Website which contain a period", () => {
-        const result = chef.bake("30 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 65 3f", [
+    it("chef.bake: should accept operation names from Chef Website which contain a period", async () => {
+        const result = await chef.bake("30 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 65 3f", [
             { "op": "Parse ASN.1 hex string",
                 "args": [0, 32] }
         ]);
-        assert.strictEqual(result.toString(), `SEQUENCE
-  INTEGER 05
-  IA5String 'Anybody there?'
-`);
+        assert.strictEqual(result.toString(), `SEQUENCE\n  INTEGER 05\n  IA5String 'Anybody there?'\n`);
     }),
 
     it("Excluded operations: throw a sensible error when you try and call one", () => {
@@ -381,16 +378,16 @@ TestRegister.addApiTests([
         }
     }),
 
-    it("chef.bake: cannot accept flowControl operations in recipe", () => {
-        assert.throws(() => chef.bake("some input", "magic"), {
+    it("chef.bake: cannot accept flowControl operations in recipe", async () => {
+        await assert.rejects(() => chef.bake("some input", "magic"), {
             name: "TypeError",
             message: "flowControl operations like Magic are not currently allowed in recipes for chef.bake in the Node API"
         });
-        assert.throws(() => chef.bake("some input", magic), {
+        await assert.rejects(() => chef.bake("some input", magic), {
             name: "TypeError",
             message: "flowControl operations like Magic are not currently allowed in recipes for chef.bake in the Node API"
         });
-        assert.throws(() => chef.bake("some input", ["to base 64", "magic"]), {
+        await assert.rejects(() => chef.bake("some input", ["to base 64", "magic"]), {
             name: "TypeError",
             message: "flowControl operations like Magic are not currently allowed in recipes for chef.bake in the Node API"
         });

package/tests/operations/index.mjs

@@ -11,6 +11,7 @@
  * @license Apache-2.0
  */
 
+import "../lib/wasmFetchPolyfill.mjs";
 import { setLongTestFailure, logTestReport } from "../lib/utils.mjs";
 
 import TestRegister from "../lib/TestRegister.mjs";

package/tests/operations/tests/Base64.mjs

@@ -116,4 +116,15 @@ TestRegister.addTests([
             },
         ],
     },
+    {
+        name: "Show Base64 offsets: escapes static output",
+        input: "\x00\x10\x83\x10\x51\x87",
+        expectedOutput: "<script>\n<AQmsBRk66\n<ia1AEIM6",
+        recipeConfig: [
+            {
+                op: "Show Base64 offsets",
+                args: ["<script>ale(1)/.ABCDEFGHIJKLMNOPQRSTUVWXYZbdfghjkmnoquvwxyz023456", false, "Raw"],
+            },
+        ],
+    },
 ]);