cyberchef 11.0.0 → 11.2.0

package/src/core/operations/ParityBit.mjs

@@ -20,7 +20,7 @@ class ParityBit extends Operation {
 
         this.name = "Parity Bit";
         this.module = "Default";
-        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurence of the delimiter character";
+        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurrence of the delimiter character";
         this.infoURL = "https://wikipedia.org/wiki/Parity_bit";
         this.inputType = "string";
         this.outputType = "string";

package/src/core/operations/ParseEthernetFrame.mjs

@@ -92,7 +92,7 @@ class ParseEthernetFrame extends Operation {
         const packetData = input.slice(offset);
 
         if (outputFormat === "Packet data") {
-            return Utils.byteArrayToChars(packetData);
+            return Utils.escapeHtml(Utils.byteArrayToChars(packetData));
         } else if (outputFormat === "Packet data (hex)") {
             return toHex(packetData);
         } else if (outputFormat === "Text output") {

package/src/core/operations/ParseIPv4Header.mjs

@@ -74,7 +74,7 @@ class ParseIPv4Header extends Operation {
             checksum = input[10] << 8 | input[11],
             srcIP = input[12] << 24 | input[13] << 16 | input[14] << 8 | input[15],
             dstIP = input[16] << 24 | input[17] << 16 | input[18] << 8 | input[19],
-            checksumHeader = input.slice(0, 10).concat([0, 0]).concat(input.slice(12, 20));
+            checksumHeader = [...input.slice(0, 10), 0, 0, ...input.slice(12, 20)];
         let version = (input[0] >>> 4) & 0x0f,
             options = [];
 
@@ -138,7 +138,7 @@ class ParseIPv4Header extends Operation {
         } else if (outputFormat === "Data (hex)") {
             return toHex(data);
         } else if (outputFormat === "Data (raw)") {
-            return Utils.byteArrayToChars(data);
+            return Utils.escapeHtml(Utils.byteArrayToChars(data));
         }
     }
 

package/src/core/operations/ParseObjectIDTimestamp.mjs

@@ -6,7 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
-import BSON from "bson";
+import { ObjectId } from "bson";
 
 /**
  * Parse ObjectID timestamp operation
@@ -35,7 +35,7 @@ class ParseObjectIDTimestamp extends Operation {
      */
     run(input, args) {
         try {
-            const objectId = new BSON.ObjectID(input);
+            const objectId = new ObjectId(input);
             return objectId.getTimestamp().toISOString();
         } catch (err) {
             throw new OperationError(err);

package/src/core/operations/ParseUserAgent.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import UAParser from "ua-parser-js";
+import { UAParser } from "ua-parser-js";
 
 /**
  * Parse User Agent operation

package/src/core/operations/ROR13.mjs

@@ -0,0 +1,83 @@
+/**
+ * ROR13 Hash operation (Windows API hashing convention)
+ * @author fufu_btw
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Implements a ROR13 hash used for API name hashing techniques.
+ */
+class ROR13 extends Operation {
+
+    /**
+     * Constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "ROR13";
+        this.module = "Default";
+        this.description = "Computes a ROR13 hash used in API hashing techniques.";
+        this.infoURL = "";
+        this.inputType = "byteArray";
+        this.outputType = "string";
+
+        this.args = [];
+    }
+
+    /**
+     * Rotate right (32-bit)
+     *
+     * @param {number} value - input value
+     * @param {number} bits - rotation bits
+     * @returns {number} rotated value
+     */
+    ror(value, bits) {
+        return ((value >>> bits) | (value << (32 - bits))) >>> 0;
+    }
+
+    /**
+     * Execute ROR13 hash
+     *
+     * @param {byteArray} input - input bytes
+     * @param {Object[]} args - operation arguments
+     * @returns {string} hex hash
+     */
+    run(input, args) {
+        let hash = 0;
+
+        for (let i = 0; i < input.length; i++) {
+            const chr = input[i] & 0xFF;
+            hash = this.ror(hash, 13);
+            hash = (hash + chr) >>> 0;
+        }
+
+        return "0x" + hash.toString(16).padStart(8, "0").toUpperCase();
+    }
+
+    /**
+     * Highlight input
+     *
+     * @param {Object[]} pos
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    highlight(pos, args) {
+        return pos;
+    }
+
+    /**
+     * Reverse highlight
+     *
+     * @param {Object[]} pos
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    highlightReverse(pos, args) {
+        return pos;
+    }
+}
+
+export default ROR13;

package/src/core/operations/RemoveANSIEscapeCodes.mjs

@@ -0,0 +1,41 @@
+/**
+ * @author Louis-Ladd [lewisharshman1@gmail.com]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Remove ANSI Escape Codes operation
+ */
+class RemoveANSIEscapeCodes extends Operation {
+
+    /**
+     * RemoveANSIEscapeCodes constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Remove ANSI Escape Codes";
+        this.module = "Default";
+        this.description = "Removes ANSI Escape Codes.";
+        this.infoURL = "https://wikipedia.org/wiki/ANSI_escape_code";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const ansiRegex = /\x1B\[[0-?]*[ -/]*[@-~]/g;
+        return input.replace(ansiRegex, "");
+    }
+
+}
+
+export default RemoveANSIEscapeCodes;

package/src/core/operations/SHA2.mjs

@@ -20,7 +20,7 @@ class SHA2 extends Operation {
 
         this.name = "SHA2";
         this.module = "Crypto";
-        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bytes.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bytes.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
+        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bits.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bits.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
         this.infoURL = "https://wikipedia.org/wiki/SHA-2";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";

package/src/core/operations/SeriesChart.mjs

@@ -15,6 +15,20 @@ import Utils from "../Utils.mjs";
 const d3 = d3temp.default ? d3temp.default : d3temp;
 const nodom = nodomtemp.default ? nodomtemp.default: nodomtemp;
 
+/**
+ * Removes D3's internal bound data from a nodom tree before serialization.
+ * nodom serializes enumerable expando properties such as __data__ as attributes,
+ * so leaving them on attacker-controlled values can create executable markup.
+ *
+ * @param {Object} node
+ */
+function clearD3BoundData(node) {
+    delete node.__data__;
+
+    if (!node.childNodes) return;
+    node.childNodes.forEach(clearD3BoundData);
+}
+
 /**
  * Series chart operation
  */
@@ -222,6 +236,8 @@ class SeriesChart extends Operation {
                 .text(serie.name);
         });
 
+        clearD3BoundData(svg.node());
+
         return svg._groups[0][0].outerHTML;
     }
 

package/src/core/operations/ToHexdump.mjs

@@ -8,6 +8,8 @@ import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import OperationError from "../errors/OperationError.mjs";
 
+const MAX_WIDTH = 65536;
+
 /**
  * To Hexdump operation
  */
@@ -30,7 +32,8 @@ class ToHexdump extends Operation {
                 "name": "Width",
                 "type": "number",
                 "value": 16,
-                "min": 1
+                "min": 1,
+                "max": MAX_WIDTH
             },
             {
                 "name": "Upper case hex",
@@ -63,6 +66,9 @@ class ToHexdump extends Operation {
         if (length < 1 || Math.round(length) !== length)
             throw new OperationError("Width must be a positive integer");
 
+        if (length > MAX_WIDTH)
+            throw new OperationError(`Width must be no more than ${MAX_WIDTH}`);
+
         const lines = [];
         for (let i = 0; i < data.length; i += length) {
             let lineNo = Utils.hex(i, 8);

package/src/core/operations/Wrap.mjs

@@ -0,0 +1,47 @@
+/**
+ * @author 0xff1ce [github.com/0xff1ce]
+ * @copyright Crown Copyright 2024
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Wrap operation
+ */
+class Wrap extends Operation {
+
+    /**
+     * Wrap constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Wrap";
+        this.module = "Default";
+        this.description = "Wraps the input text at a specified number of characters per line.";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Line Width",
+                "type": "number",
+                "value": 64,
+            },
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        if (!input) return "";  // Handle empty input
+        const lineWidth = args[0];
+        const regex = new RegExp(`.{1,${lineWidth}}`, "g");
+        return input.match(regex).join("\n");
+    }
+}
+
+export default Wrap;

package/src/core/operations/XORChecksum.mjs

@@ -7,12 +7,12 @@
 import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import { toHex } from "../lib/Hex.mjs";
+import OperationError from "../errors/OperationError.mjs"; 
 
 /**
  * XOR Checksum operation
  */
 class XORChecksum extends Operation {
-
     /**
      * XORChecksum constructor
      */
@@ -21,7 +21,8 @@ class XORChecksum extends Operation {
 
         this.name = "XOR Checksum";
         this.module = "Crypto";
-        this.description = "XOR Checksum splits the input into blocks of a configurable size and performs the XOR operation on these blocks.";
+        this.description =
+            "XOR Checksum splits the input into blocks of a configurable size and performs the XOR operation on these blocks.";
         this.infoURL = "https://wikipedia.org/wiki/XOR";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -29,7 +30,7 @@ class XORChecksum extends Operation {
             {
                 name: "Blocksize",
                 type: "number",
-                value: 4
+                value: 4,
             },
         ];
     }
@@ -41,6 +42,12 @@ class XORChecksum extends Operation {
      */
     run(input, args) {
         const blocksize = args[0];
+
+    
+        if (!Number.isInteger(blocksize) || blocksize <= 0) {
+            throw new OperationError("Blocksize must be a positive integer.");
+        }
+
         input = new Uint8Array(input);
 
         const res = Array(blocksize);

package/src/core/operations/index.mjs

@@ -114,6 +114,7 @@ import EncodeNetBIOSName from "./EncodeNetBIOSName.mjs";
 import EncodeText from "./EncodeText.mjs";
 import Enigma from "./Enigma.mjs";
 import Entropy from "./Entropy.mjs";
+import EscapeSmartCharacters from "./EscapeSmartCharacters.mjs";
 import EscapeString from "./EscapeString.mjs";
 import EscapeUnicodeCharacters from "./EscapeUnicodeCharacters.mjs";
 import ExpandAlphabetRange from "./ExpandAlphabetRange.mjs";
@@ -283,6 +284,7 @@ import PGPDecrypt from "./PGPDecrypt.mjs";
 import PGPDecryptAndVerify from "./PGPDecryptAndVerify.mjs";
 import PGPEncrypt from "./PGPEncrypt.mjs";
 import PGPEncryptAndSign from "./PGPEncryptAndSign.mjs";
+import PGPSign from "./PGPSign.mjs";
 import PGPVerify from "./PGPVerify.mjs";
 import PHPDeserialize from "./PHPDeserialize.mjs";
 import PHPSerialize from "./PHPSerialize.mjs";
@@ -325,6 +327,7 @@ import RC4Drop from "./RC4Drop.mjs";
 import RC6Decrypt from "./RC6Decrypt.mjs";
 import RC6Encrypt from "./RC6Encrypt.mjs";
 import RIPEMD from "./RIPEMD.mjs";
+import ROR13 from "./ROR13.mjs";
 import ROT13 from "./ROT13.mjs";
 import ROT13BruteForce from "./ROT13BruteForce.mjs";
 import ROT47 from "./ROT47.mjs";
@@ -342,6 +345,7 @@ import RawDeflate from "./RawDeflate.mjs";
 import RawInflate from "./RawInflate.mjs";
 import Register from "./Register.mjs";
 import RegularExpression from "./RegularExpression.mjs";
+import RemoveANSIEscapeCodes from "./RemoveANSIEscapeCodes.mjs";
 import RemoveDiacritics from "./RemoveDiacritics.mjs";
 import RemoveEXIF from "./RemoveEXIF.mjs";
 import RemoveLineNumbers from "./RemoveLineNumbers.mjs";
@@ -466,6 +470,7 @@ import VigenèreDecode from "./VigenèreDecode.mjs";
 import VigenèreEncode from "./VigenèreEncode.mjs";
 import Whirlpool from "./Whirlpool.mjs";
 import WindowsFiletimeToUNIXTimestamp from "./WindowsFiletimeToUNIXTimestamp.mjs";
+import Wrap from "./Wrap.mjs";
 import XKCDRandomNumber from "./XKCDRandomNumber.mjs";
 import XMLBeautify from "./XMLBeautify.mjs";
 import XMLMinify from "./XMLMinify.mjs";
@@ -592,6 +597,7 @@ export {
     EncodeText,
     Enigma,
     Entropy,
+    EscapeSmartCharacters,
     EscapeString,
     EscapeUnicodeCharacters,
     ExpandAlphabetRange,
@@ -761,6 +767,7 @@ export {
     PGPDecryptAndVerify,
     PGPEncrypt,
     PGPEncryptAndSign,
+    PGPSign,
     PGPVerify,
     PHPDeserialize,
     PHPSerialize,
@@ -803,6 +810,7 @@ export {
     RC6Decrypt,
     RC6Encrypt,
     RIPEMD,
+    ROR13,
     ROT13,
     ROT13BruteForce,
     ROT47,
@@ -820,6 +828,7 @@ export {
     RawInflate,
     Register,
     RegularExpression,
+    RemoveANSIEscapeCodes,
     RemoveDiacritics,
     RemoveEXIF,
     RemoveLineNumbers,
@@ -944,6 +953,7 @@ export {
     VigenèreEncode,
     Whirlpool,
     WindowsFiletimeToUNIXTimestamp,
+    Wrap,
     XKCDRandomNumber,
     XMLBeautify,
     XMLMinify,

package/src/node/index.mjs

@@ -122,6 +122,7 @@ import {
     EncodeText as core_EncodeText,
     Enigma as core_Enigma,
     Entropy as core_Entropy,
+    EscapeSmartCharacters as core_EscapeSmartCharacters,
     EscapeString as core_EscapeString,
     EscapeUnicodeCharacters as core_EscapeUnicodeCharacters,
     ExpandAlphabetRange as core_ExpandAlphabetRange,
@@ -284,6 +285,7 @@ import {
     PGPDecryptAndVerify as core_PGPDecryptAndVerify,
     PGPEncrypt as core_PGPEncrypt,
     PGPEncryptAndSign as core_PGPEncryptAndSign,
+    PGPSign as core_PGPSign,
     PGPVerify as core_PGPVerify,
     PHPDeserialize as core_PHPDeserialize,
     PHPSerialize as core_PHPSerialize,
@@ -326,6 +328,7 @@ import {
     RC6Decrypt as core_RC6Decrypt,
     RC6Encrypt as core_RC6Encrypt,
     RIPEMD as core_RIPEMD,
+    ROR13 as core_ROR13,
     ROT13 as core_ROT13,
     ROT13BruteForce as core_ROT13BruteForce,
     ROT47 as core_ROT47,
@@ -343,6 +346,7 @@ import {
     RawInflate as core_RawInflate,
     Register as core_Register,
     RegularExpression as core_RegularExpression,
+    RemoveANSIEscapeCodes as core_RemoveANSIEscapeCodes,
     RemoveDiacritics as core_RemoveDiacritics,
     RemoveEXIF as core_RemoveEXIF,
     RemoveLineNumbers as core_RemoveLineNumbers,
@@ -466,6 +470,7 @@ import {
     VigenèreEncode as core_VigenèreEncode,
     Whirlpool as core_Whirlpool,
     WindowsFiletimeToUNIXTimestamp as core_WindowsFiletimeToUNIXTimestamp,
+    Wrap as core_Wrap,
     XKCDRandomNumber as core_XKCDRandomNumber,
     XMLBeautify as core_XMLBeautify,
     XMLMinify as core_XMLMinify,
@@ -600,6 +605,7 @@ function generateChef() {
         "encodeText": _wrap(core_EncodeText),
         "enigma": _wrap(core_Enigma),
         "entropy": _wrap(core_Entropy),
+        "escapeSmartCharacters": _wrap(core_EscapeSmartCharacters),
         "escapeString": _wrap(core_EscapeString),
         "escapeUnicodeCharacters": _wrap(core_EscapeUnicodeCharacters),
         "expandAlphabetRange": _wrap(core_ExpandAlphabetRange),
@@ -762,6 +768,7 @@ function generateChef() {
         "PGPDecryptAndVerify": _wrap(core_PGPDecryptAndVerify),
         "PGPEncrypt": _wrap(core_PGPEncrypt),
         "PGPEncryptAndSign": _wrap(core_PGPEncryptAndSign),
+        "PGPSign": _wrap(core_PGPSign),
         "PGPVerify": _wrap(core_PGPVerify),
         "PHPDeserialize": _wrap(core_PHPDeserialize),
         "PHPSerialize": _wrap(core_PHPSerialize),
@@ -804,6 +811,7 @@ function generateChef() {
         "RC6Decrypt": _wrap(core_RC6Decrypt),
         "RC6Encrypt": _wrap(core_RC6Encrypt),
         "RIPEMD": _wrap(core_RIPEMD),
+        "ROR13": _wrap(core_ROR13),
         "ROT13": _wrap(core_ROT13),
         "ROT13BruteForce": _wrap(core_ROT13BruteForce),
         "ROT47": _wrap(core_ROT47),
@@ -821,6 +829,7 @@ function generateChef() {
         "rawInflate": _wrap(core_RawInflate),
         "register": _wrap(core_Register),
         "regularExpression": _wrap(core_RegularExpression),
+        "removeANSIEscapeCodes": _wrap(core_RemoveANSIEscapeCodes),
         "removeDiacritics": _wrap(core_RemoveDiacritics),
         "removeEXIF": _wrap(core_RemoveEXIF),
         "removeLineNumbers": _wrap(core_RemoveLineNumbers),
@@ -944,6 +953,7 @@ function generateChef() {
         "vigenèreEncode": _wrap(core_VigenèreEncode),
         "whirlpool": _wrap(core_Whirlpool),
         "windowsFiletimeToUNIXTimestamp": _wrap(core_WindowsFiletimeToUNIXTimestamp),
+        "wrap": _wrap(core_Wrap),
         "XKCDRandomNumber": _wrap(core_XKCDRandomNumber),
         "XMLBeautify": _wrap(core_XMLBeautify),
         "XMLMinify": _wrap(core_XMLMinify),
@@ -1088,6 +1098,7 @@ const encodeNetBIOSName = chef.encodeNetBIOSName;
 const encodeText = chef.encodeText;
 const enigma = chef.enigma;
 const entropy = chef.entropy;
+const escapeSmartCharacters = chef.escapeSmartCharacters;
 const escapeString = chef.escapeString;
 const escapeUnicodeCharacters = chef.escapeUnicodeCharacters;
 const expandAlphabetRange = chef.expandAlphabetRange;
@@ -1257,6 +1268,7 @@ const PGPDecrypt = chef.PGPDecrypt;
 const PGPDecryptAndVerify = chef.PGPDecryptAndVerify;
 const PGPEncrypt = chef.PGPEncrypt;
 const PGPEncryptAndSign = chef.PGPEncryptAndSign;
+const PGPSign = chef.PGPSign;
 const PGPVerify = chef.PGPVerify;
 const PHPDeserialize = chef.PHPDeserialize;
 const PHPSerialize = chef.PHPSerialize;
@@ -1299,6 +1311,7 @@ const RC4Drop = chef.RC4Drop;
 const RC6Decrypt = chef.RC6Decrypt;
 const RC6Encrypt = chef.RC6Encrypt;
 const RIPEMD = chef.RIPEMD;
+const ROR13 = chef.ROR13;
 const ROT13 = chef.ROT13;
 const ROT13BruteForce = chef.ROT13BruteForce;
 const ROT47 = chef.ROT47;
@@ -1316,6 +1329,7 @@ const rawDeflate = chef.rawDeflate;
 const rawInflate = chef.rawInflate;
 const register = chef.register;
 const regularExpression = chef.regularExpression;
+const removeANSIEscapeCodes = chef.removeANSIEscapeCodes;
 const removeDiacritics = chef.removeDiacritics;
 const removeEXIF = chef.removeEXIF;
 const removeLineNumbers = chef.removeLineNumbers;
@@ -1440,6 +1454,7 @@ const vigenèreDecode = chef.vigenèreDecode;
 const vigenèreEncode = chef.vigenèreEncode;
 const whirlpool = chef.whirlpool;
 const windowsFiletimeToUNIXTimestamp = chef.windowsFiletimeToUNIXTimestamp;
+const wrap = chef.wrap;
 const XKCDRandomNumber = chef.XKCDRandomNumber;
 const XMLBeautify = chef.XMLBeautify;
 const XMLMinify = chef.XMLMinify;
@@ -1568,6 +1583,7 @@ const operations = [
     encodeText,
     enigma,
     entropy,
+    escapeSmartCharacters,
     escapeString,
     escapeUnicodeCharacters,
     expandAlphabetRange,
@@ -1737,6 +1753,7 @@ const operations = [
     PGPDecryptAndVerify,
     PGPEncrypt,
     PGPEncryptAndSign,
+    PGPSign,
     PGPVerify,
     PHPDeserialize,
     PHPSerialize,
@@ -1779,6 +1796,7 @@ const operations = [
     RC6Decrypt,
     RC6Encrypt,
     RIPEMD,
+    ROR13,
     ROT13,
     ROT13BruteForce,
     ROT47,
@@ -1796,6 +1814,7 @@ const operations = [
     rawInflate,
     register,
     regularExpression,
+    removeANSIEscapeCodes,
     removeDiacritics,
     removeEXIF,
     removeLineNumbers,
@@ -1920,6 +1939,7 @@ const operations = [
     vigenèreEncode,
     whirlpool,
     windowsFiletimeToUNIXTimestamp,
+    wrap,
     XKCDRandomNumber,
     XMLBeautify,
     XMLMinify,
@@ -2052,6 +2072,7 @@ export {
     encodeText,
     enigma,
     entropy,
+    escapeSmartCharacters,
     escapeString,
     escapeUnicodeCharacters,
     expandAlphabetRange,
@@ -2221,6 +2242,7 @@ export {
     PGPDecryptAndVerify,
     PGPEncrypt,
     PGPEncryptAndSign,
+    PGPSign,
     PGPVerify,
     PHPDeserialize,
     PHPSerialize,
@@ -2263,6 +2285,7 @@ export {
     RC6Decrypt,
     RC6Encrypt,
     RIPEMD,
+    ROR13,
     ROT13,
     ROT13BruteForce,
     ROT47,
@@ -2280,6 +2303,7 @@ export {
     rawInflate,
     register,
     regularExpression,
+    removeANSIEscapeCodes,
     removeDiacritics,
     removeEXIF,
     removeLineNumbers,
@@ -2404,6 +2428,7 @@ export {
     vigenèreEncode,
     whirlpool,
     windowsFiletimeToUNIXTimestamp,
+    wrap,
     XKCDRandomNumber,
     XMLBeautify,
     XMLMinify,

package/src/web/App.mjs

@@ -42,6 +42,14 @@ class App {
         this.progress      = 0;
         this.ingId         = 0;
 
+        // stateChangeId increments on every statechange dispatch; bakeStateId records
+        // the stateChangeId captured when the most recent bake started. autoBake uses
+        // these to decide whether the output is genuinely stale, so a debounced
+        // autoBake firing shortly after a manual bake doesn't clobber the bake's
+        // hideStaleIndicator with a redundant showStaleIndicator.
+        this.stateChangeId = 0;
+        this.bakeStateId   = -1;
+
         this.appLoaded     = false;
         this.workerLoaded  = false;
         this.waitersLoaded = false;
@@ -136,6 +144,9 @@ class App {
     bake(step=false) {
         if (this.baking) return;
 
+        // Record which state version this bake is covering.
+        this.bakeStateId = this.stateChangeId;
+
         // Reset attemptHighlight flag
         this.options.attemptHighlight = true;
 
@@ -166,7 +177,10 @@ class App {
                 nums: [this.manager.tabs.getActiveTab("input")],
                 step: false
             });
-        } else {
+        } else if (this.bakeStateId < this.stateChangeId) {
+            // Only show stale-indicator if the most recent bake didn't cover the
+            // current state. Without this guard, a debounced autoBake firing after
+            // a manual bake completed would re-show the indicator on fresh output.
             this.manager.controls.showStaleIndicator();
         }
     }
@@ -768,6 +782,10 @@ class App {
      * @param {event} e
      */
     stateChange(e) {
+        // Bump the state-change counter synchronously so a manual bake invoked between
+        // here and the debounced autoBake firing can record it via bakeStateId.
+        this.stateChangeId++;
+
         debounce(function() {
             this.progress = 0;
             this.autoBake();

package/src/web/HTMLIngredient.mjs

@@ -166,6 +166,7 @@ class HTMLIngredient {
                         id="${this.id}"
                         tabindex="${this.tabIndex}"
                         arg-name="${this.name}"
+                        data-target="${this.target}"
                         ${this.disabled ? "disabled" : ""}>`;
                 for (i = 0; i < this.value.length; i++) {
                     if ((m = this.value[i].name.match(/\[([a-z0-9 -()^]+)\]/i))) {