cyberchef 11.0.0 → 11.2.0

package/src/web/html/index.html

@@ -868,15 +868,15 @@
                             Be aware that the standalone version will never update itself, meaning it will not receive bug fixes or new features until you re-download newer versions manually.
                         </p>
 
-                        <h6>CyberChef v<%= htmlWebpackPlugin.options.version %></h6>
+                        <h6>CyberChef <%= htmlWebpackPlugin.options.version %></h6>
                         <ul>
                             <li>Build time: <%= htmlWebpackPlugin.options.compileTime %></li>
-                            <li>The changelog for this version can be viewed <a href="https://github.com/gchq/CyberChef/blob/v<%= htmlWebpackPlugin.options.version %>/CHANGELOG.md">here</a></li>
+                            <li>The changelog for this version can be viewed <a href="https://github.com/gchq/CyberChef/blob/v<%= htmlWebpackPlugin.options.latestReleaseVersion %>/CHANGELOG.md">here</a></li>
                             <li>&copy; Crown Copyright 2016-<%= htmlWebpackPlugin.options.compileYear %></li>
                             <li>Released under the Apache Licence, Version 2.0</li>
                             <li>SHA256 hash: DOWNLOAD_HASH_PLACEHOLDER</li>
                         </ul>
-                        <a href="CyberChef_v<%= htmlWebpackPlugin.options.version %>.zip" download class="btn btn-outline-primary">Download ZIP file</a>
+                        <a href="<%= htmlWebpackPlugin.options.downloadZipFilename %>" download class="btn btn-outline-primary">Download ZIP file</a>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-primary" data-dismiss="modal">Ok</button>

package/src/web/static/sitemap.mjs

@@ -1,4 +1,4 @@
-import sm from "sitemap";
+import { SitemapStream, streamToPromise } from "sitemap";
 import OperationConfig from "../../core/config/OperationConfig.json" with { type: "json" };
 
 /**
@@ -11,7 +11,7 @@ import OperationConfig from "../../core/config/OperationConfig.json" with { type
 
 const baseUrl = "https://gchq.github.io/CyberChef/";
 
-const smStream = new sm.SitemapStream({});
+const smStream = new SitemapStream({});
 
 smStream.write({
     url: baseUrl,
@@ -28,6 +28,6 @@ for (const op in OperationConfig) {
 }
 smStream.end();
 
-sm.streamToPromise(smStream).then(
+streamToPromise(smStream).then(
     (buffer) => console.log(buffer.toString()), // eslint-disable-line no-console
 );

package/src/web/waiters/RecipeWaiter.mjs

@@ -487,11 +487,19 @@ class RecipeWaiter {
      * @param {HTMLElement} op
      */
     triggerArgEvents(op) {
-        // Trigger populateOption and argSelector events
+        // Trigger argSelector events and populateOption events only where the target is empty.
+        // When loading a saved recipe, arguments are populated before this method is called, so
+        // re-triggering populateOption events would overwrite saved custom values with defaults.
+        const args = op.querySelectorAll(".arg");
         const triggerableOptions = op.querySelectorAll(".populate-option, .arg-selector");
         const evt = new Event("change", {bubbles: true});
+
         if (triggerableOptions.length) {
             for (const el of triggerableOptions) {
+                if (el.classList.contains("populate-option")) {
+                    const target = args[el.getAttribute("data-target")];
+                    if (target && target.value !== "") continue;
+                }
                 el.dispatchEvent(evt);
             }
         }

package/tests/browser/02_ops.js

@@ -30,8 +30,8 @@ module.exports = {
         testOp(browser, "A1Z26 Cipher Decode", "20 5 19 20 15 21 20 16 21 20", "testoutput");
         testOp(browser, "A1Z26 Cipher Encode", "test input", "20 5 19 20 9 14 16 21 20");
         testOp(browser, "ADD", "test input", "Ê»ÉÊv¿ÄÆËÊ", [{ "option": "Hex", "string": "56" }]);
-        testOp(browser, "AES Decrypt", "b443f7f7c16ac5396a34273f6f639caa", "test output", [{ "option": "Hex", "string": "00112233445566778899aabbccddeeff" }, { "option": "Hex", "string": "00000000000000000000000000000000" }, "CBC", "Hex", "Raw", { "option": "Hex", "string": "" }]);
-        testOp(browser, "AES Encrypt", "test input", "e42eb8fbfb7a98fff061cd2c1a794d92", [{"option": "Hex", "string": "00112233445566778899aabbccddeeff"}, {"option": "Hex", "string": "00000000000000000000000000000000"}, "CBC", "Raw", "Hex"]);
+        testOp(browser, "AES Decrypt", "b443f7f7c16ac5396a34273f6f639caa", "test output", [{ "option": "Hex", "string": "00112233445566778899aabbccddeeff" }, { "option": "Hex", "string": "00000000000000000000000000000000" }, 16, "CBC", "Hex", "Raw", { "option": "Hex", "string": "" }, { "option": "Hex", "string": "" }, "Off"]);
+        testOp(browser, "AES Encrypt", "test input", "e42eb8fbfb7a98fff061cd2c1a794d92", [{"option": "Hex", "string": "00112233445566778899aabbccddeeff"}, {"option": "Hex", "string": "00000000000000000000000000000000"}, "CBC", "Raw", "Hex", "Off"]);
         testOp(browser, "AND", "test input", "4$04  $044", [{ "option": "Hex", "string": "34" }]);
         testOp(browser, "Add line numbers", "test input", "1 test input");
         testOp(browser, ["From Hex", "Add Text To Image", "SHA2"], Images.PNG_HEX, "50cdf8ea483c55564a091650c2bccb4586f919b721e5fe9d6a61660505b4346d6ebdb2ef0cf075a7728cd84cb26ea3e477b5bd86a94a49a27d79423994afb60a", [[], ["Chef", "Center", "Middle", 0, 0, 16, "Roboto"], []]);
@@ -64,7 +64,7 @@ module.exports = {
         testOp(browser, "BSON serialise", '{"a":"test"}', "\u0011\u0000\u0000\u0000\u0002a\u0000\u0005\u0000\u0000\u0000test\u0000\u0000");
         // testOp(browser, "Bacon Cipher Decode", "test input", "test_output");
         // testOp(browser, "Bacon Cipher Encode", "test input", "test_output");
-        testOp(browser, "Bcrypt", "test input", /^\$2a\$06\$.{53}$/, [6]);
+        testOp(browser, "Bcrypt", "test input", /^\$2b\$06\$.{53}$/, [6]);
         testOp(browser, "Bcrypt compare", "test input", "Match: test input", ["$2a$05$FCfBSVX7OeRkK.9kQVFCiOYu9XtwtIbePqUiroD1lkASW9q5QClzG"]);
         testOp(browser, "Bcrypt parse", "$2a$05$kXWtAIGB/R8VEzInoM5ocOTBtyc0m2YTIwFiBU/0XoW032f9QrkWW", /Rounds: 5/);
         testOp(browser, "Bifid Cipher Decode", "qblb tfovy", "test input", ["pass"]);
@@ -80,8 +80,8 @@ module.exports = {
         testOpHtml(browser, "Bombe", "XTSYN WAEUG EZALY NRQIM AMLZX MFUOD AWXLY LZCUZ QOQBQ JLCPK NDDRW F", "table tr:last-child td:first-child", "ECG", ["3-rotor", "LEYJVCNIXWPBQMDRTAKZGFUHOS", "BDFHJLCPRTXVZNYEIWGAKMUSQO<W", "AJDKSIRUXBLHWTMCQGZNPYFVOE<F", "ESOVPZJAYQUIRHXLNFTGKDCMWB<K", "AY BR CU DH EQ FS GL IP JX KN MO TZ VW", "HELLO CYBER CHEFU SER", 0, true]);
         testOp(browser, ["Bzip2 Compress", "To Hex"], "test input", "42 5a 68 39 31 41 59 26 53 59 cf 96 82 1d 00 00 03 91 80 40 00 02 21 4e 00 20 00 21 90 c2 10 c0 88 33 92 8e df 17 72 45 38 50 90 cf 96 82 1d");
         testOp(browser, ["From Hex", "Bzip2 Decompress"], "425a68393141592653597b0884b7000003038000008200ce00200021a647a4218013709517c5dc914e14241ec2212dc0", "test_output", [[], [true]]);
-    // testOp(browser, "CBOR Decode", "test input", "test output");
-    // testOp(browser, "CBOR Encode", "test input", "test output");
+        testOp(browser, ["From Hex", "CBOR Decode"], "f9 3e 00", "1.5");
+        testOp(browser, ["CBOR Encode", "To Hex"], "1.5", "f9 3e 00");
         testOp(browser, "CRC Checksum", "test input", "77c7", ["CRC-16"]);
         testOp(browser, "CRC Checksum", "test input", "29822bc8", ["CRC-32"]);
         testOp(browser, "CRC Checksum", "test input", "9d", ["CRC-8"]);
@@ -278,11 +278,11 @@ module.exports = {
         testOpHtml(browser, "Parse UDP", "04 89 00 35 00 2c 01 01", "tr:last-child td:last-child", "0x0101");
         // testOp(browser, "Parse UNIX file permissions", "test input", "test_output");
         // testOp(browser, "Parse URI", "test input", "test_output");
-    // testOp(browser, "Parse User Agent", "test input", "test_output");
+        testOp(browser, "Parse User Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0 ", /Architecture: amd64/);
         // testOp(browser, "Parse X.509 certificate", "test input", "test_output");
         testOpFile(browser, "Play Media", "files/mp3example.mp3", "audio", "");
         // testOp(browser, "Power Set", "test input", "test_output");
-    // testOp(browser, "Protobuf Decode", "test input", "test_output");
+        testOp(browser, ["From Hex", "Protobuf Decode"], "0d1c0000001203596f751a024d65202b2a0a0a066162633132331200", /"1": "abc123"/, [[], ["", false, false]]);
         // testOp(browser, "Pseudo-Random Number Generator", "test input", "test_output");
     // testOp(browser, "RC2 Decrypt", "test input", "test_output");
     // testOp(browser, "RC2 Encrypt", "test input", "test_output");

package/tests/browser/03_recipe_load.js

@@ -0,0 +1,48 @@
+/**
+ * Regression tests for recipe loading behaviour.
+ *
+ * @author C85297 [95289555+C85297@users.noreply.github.com]
+ * @copyright Crown Copyright
+ * @license Apache-2.0
+ */
+
+const utils = require("./browserUtils.js");
+
+module.exports = {
+    before: browser => {
+        browser
+            .resizeWindow(1280, 800)
+            .url(browser.launchUrl)
+            .useCss()
+            .waitForElementNotPresent("#preloader", 10000);
+    },
+
+    "Recipe load preserves populated arguments": browser => {
+        const inputFormat = "HH:mm:ss a MMM DD, YYYY ";
+        const input = "10:20:30 pm Sep 26, 2019 ";
+
+        utils.loadRecipe(
+            browser,
+            "Translate DateTime Format",
+            input,
+            [
+                "Standard date and time",
+                inputFormat,
+                "UTC",
+                "DD/MM/YYYY HH:mm:ss",
+                "UTC"
+            ]
+        );
+
+        browser.execute(() => {
+            return Array.from(document.querySelectorAll("#rec-list li.operation .arg"))
+                .map(arg => arg.value);
+        }, [], function({value}) {
+            browser.expect(value[1]).to.equal(inputFormat);
+        });
+    },
+
+    after: browser => {
+        browser.end();
+    }
+};

package/tests/browser/browserUtils.js

@@ -51,14 +51,17 @@ function setInput(browser, input, type=true) {
  */
 function bake(browser) {
     browser
+        // Let any pending debounced inputChange/stateChange (~20ms each) fire so the
+        // worker has the latest input buffer before we ask it to bake.
+        .pause(50)
         // Ensure we're not currently busy
-        .waitForElementNotVisible("#output-loader", 5000)
+        .waitForElementNotVisible("#output-loader", 10000)
         .expect.element("#bake span").text.to.equal("BAKE!");
 
     browser
         .click("#bake")
-        .waitForElementNotVisible("#stale-indicator", 5000)
-        .waitForElementNotVisible("#output-loader", 5000);
+        .waitForElementNotVisible("#stale-indicator", 10000)
+        .waitForElementNotVisible("#output-loader", 10000);
 }
 
 /** @function

package/tests/node/index.mjs

@@ -18,12 +18,14 @@ import {
 import TestRegister from "../lib/TestRegister.mjs";
 import "./tests/nodeApi.mjs";
 import "./tests/operations.mjs";
+import "./tests/PGP.mjs";
 import "./tests/File.mjs";
 import "./tests/Dish.mjs";
 import "./tests/NodeDish.mjs";
 import "./tests/Utils.mjs";
 import "./tests/Categories.mjs";
 import "./tests/lib/BigIntUtils.mjs";
+import "./tests/lib/ChartsProtocolPrototypePollution.mjs";
 
 const testStatus = {
     allTestsPassing: true,

package/tests/node/tests/PGP.mjs

@@ -0,0 +1,69 @@
+/**
+ * PGP node tests.
+ *
+ * @author C85297 [95289555+C85297@users.noreply.github.com]
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import assert from "assert";
+import kbpgp from "kbpgp";
+import * as es6promisify from "es6-promisify";
+
+import TestRegister from "../../lib/TestRegister.mjs";
+import it from "../assertionHandler.mjs";
+import GeneratePGPKeyPair from "../../../src/core/operations/GeneratePGPKeyPair.mjs";
+
+const promisify = es6promisify.default ? es6promisify.default.promisify : es6promisify.promisify;
+
+const PUBLIC_KEY_BLOCK = /-----BEGIN PGP PUBLIC KEY BLOCK-----[\s\S]*-----END PGP PUBLIC KEY BLOCK-----/;
+
+/**
+ * Generate a PGP key pair and import the generated public key.
+ *
+ * @param {string} keyType
+ * @returns {Promise<Object>}
+ */
+async function generateAndImportPublicKey(keyType) {
+    const operation = new GeneratePGPKeyPair();
+    const generatedKeyPair = await operation.run("", [
+        keyType,
+        "",
+        "User",
+        "akb@notreal.gchq.gov.uk"
+    ]);
+
+    const publicKey = generatedKeyPair.match(PUBLIC_KEY_BLOCK);
+
+    assert(publicKey, "Generated key pair should contain an ASCII-armoured public key");
+
+    return promisify(kbpgp.KeyManager.import_from_armored_pgp)({
+        armored: publicKey[0],
+        opts: {
+            "no_check_keys": true
+        }
+    });
+}
+
+TestRegister.addApiTests([
+    it("Generate PGP Key Pair: ECC keys should include ECDSA signing and ECDH encryption subkeys", async () => {
+        const publicKey = await generateAndImportPublicKey("ECC-256");
+        const subkeyAlgorithms = publicKey.subkeys.map(subkey => subkey.key.type);
+
+        assert.strictEqual(
+            publicKey.primary.key.type,
+            kbpgp.const.openpgp.public_key_algorithms.ECDSA,
+            "Generated ECC PGP primary key should use ECDSA"
+        );
+
+        assert(
+            subkeyAlgorithms.includes(kbpgp.const.openpgp.public_key_algorithms.ECDSA),
+            "Generated ECC PGP key should include an ECDSA signing subkey"
+        );
+
+        assert(
+            subkeyAlgorithms.includes(kbpgp.const.openpgp.public_key_algorithms.ECDH),
+            "Generated ECC PGP key should include an ECDH encryption subkey"
+        );
+    })
+]);

package/tests/node/tests/lib/ChartsProtocolPrototypePollution.mjs

@@ -0,0 +1,90 @@
+import TestRegister from "../../../lib/TestRegister.mjs";
+import {getSeriesValues} from "../../../../src/core/lib/Charts.mjs";
+import {objToTable} from "../../../../src/core/lib/Protocol.mjs";
+import SeriesChart from "../../../../src/core/operations/SeriesChart.mjs";
+import ParseUDP from "../../../../src/core/operations/ParseUDP.mjs";
+import it from "../../assertionHandler.mjs";
+import assert from "assert";
+
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
+TestRegister.addApiTests([
+    it("Charts: should not pollute Object.prototype from a __proto__ series name", () => {
+        const xVal = "<img src=x onerror=alert(1)>";
+        delete Object.prototype[xVal];
+
+        try {
+            const result = getSeriesValues(`__proto__,${xVal},1`, "\n", ",", false);
+
+            assert.equal(Object.prototype[xVal], undefined);
+            assert.deepEqual(result.xValues, [xVal]);
+            assert.equal(result.series.length, 1);
+            assert.equal(result.series[0].name, "__proto__");
+            assert.equal(Object.getPrototypeOf(result.series[0].data), null);
+            assert(hasOwn(result.series[0].data, xVal));
+            assert.equal(result.series[0].data[xVal], 1);
+        } finally {
+            delete Object.prototype[xVal];
+        }
+    }),
+
+    it("Charts: should keep __proto__ x-axis names as own data keys", () => {
+        const result = getSeriesValues("safe,__proto__,1", "\n", ",", false);
+
+        assert.equal(result.series.length, 1);
+        assert.equal(Object.getPrototypeOf(result.series[0].data), null);
+        assert(hasOwn(result.series[0].data, "__proto__"));
+        assert.equal(result.series[0].data.__proto__, 1);
+    }),
+
+    it("Protocol: should ignore inherited properties when rendering tables", () => {
+        const inheritedKey = "<img src=x onerror=alert(1)>";
+        delete Object.prototype[inheritedKey];
+
+        try {
+            Object.prototype[inheritedKey] = "polluted";
+
+            const html = objToTable({safe: "value"});
+
+            assert(!html.includes(inheritedKey));
+            assert(!html.includes("polluted"));
+            assert(html.includes("safe"));
+            assert(html.includes("value"));
+        } finally {
+            delete Object.prototype[inheritedKey];
+        }
+    }),
+
+    it("Protocol: should escape table keys and scalar values", () => {
+        const obj = {
+            "<b>field</b>": "<img src=x onerror=alert(1)>",
+        };
+
+        const html = objToTable(obj);
+
+        assert(!html.includes("<b>field</b>"));
+        assert(!html.includes("<img src=x onerror=alert(1)>"));
+        assert(html.includes("&lt;b&gt;field&lt;/b&gt;"));
+        assert(html.includes("&lt;img src=x onerror=alert(1)&gt;"));
+    }),
+
+    it("Series chart and Parse UDP: should not expose polluted prototype data as HTML", () => {
+        const xVal = "<img src=x onerror=alert(document.domain)>";
+        delete Object.prototype[xVal];
+
+        try {
+            const chartHtml = new SeriesChart().run(
+                `__proto__,${xVal},1`,
+                ["Line feed", "Comma", "", 1, "red"]
+            );
+            assert.equal(Object.prototype[xVal], undefined);
+
+            const parseUDP = new ParseUDP();
+            const tableHtml = parseUDP.present(parseUDP.run(chartHtml, ["Raw"]));
+
+            assert(!/<img|onerror|alert\(/.test(tableHtml));
+        } finally {
+            delete Object.prototype[xVal];
+        }
+    }),
+]);

package/tests/node/tests/operations.mjs

@@ -79,7 +79,46 @@ TestRegister.addApiTests([
                 string: "some iv some iv1",
                 option: "utf8",
             },
+            ivLength: 16,
             mode: "OFB",
+            inputType: "Hex",
+            outputType: "Raw",
+            gcmTag: {
+                option: "Hex",
+                string: ""
+            },
+            aad: {
+                option: "Hex",
+                string: ""
+            },
+            ivFromInput: "Off"
+        });
+        assert.equal(result.toString(), "a slightly longer sampleinput?");
+    }),
+
+    it("AES decrypt: IV from input", () => {
+        const result = AESDecrypt("4a123af235a507bbc9d5871721d61b98504d569a9a5a7847e2d78315fec7736f6d6520697620736f6d6520697631", {
+            key: {
+                string: "some longer key1",
+                option: "utf8",
+            },
+            iv: {
+                string: "",
+                option: "Hex",
+            },
+            ivLength: 16,
+            mode: "OFB",
+            inputType: "Hex",
+            outputType: "Raw",
+            gcmTag: {
+                option: "Hex",
+                string: ""
+            },
+            aad: {
+                option: "Hex",
+                string: ""
+            },
+            ivFromInput: "From end"
         });
         assert.equal(result.toString(), "a slightly longer sampleinput?");
     }),
@@ -136,8 +175,8 @@ Tiger-128`;
     it("Bcrypt", async () => {
         const result = await chef.bcrypt("Put a Sock In It");
         const strResult = result.toString();
-        assert.equal(strResult.length, 60);
-        assert.equal(strResult.slice(0, 7), "$2a$10$");
+        assert.match(strResult, /^\$2b\$10\$[./A-Za-z0-9]{53}$/);
+        assert.equal(strResult.split("$").length, 4);
     }),
 
     it("bcryptCompare", async() => {