cyberchef 11.2.0 → 11.3.0

package/tests/node/index.mjs

@@ -24,6 +24,7 @@ import "./tests/Dish.mjs";
 import "./tests/NodeDish.mjs";
 import "./tests/Utils.mjs";
 import "./tests/Categories.mjs";
+import "./tests/ToHTMLEntity.mjs";
 import "./tests/lib/BigIntUtils.mjs";
 import "./tests/lib/ChartsProtocolPrototypePollution.mjs";
 

package/tests/node/tests/Dish.mjs

@@ -9,4 +9,23 @@ TestRegister.addApiTests([
         assert(dish.presentAs);
     }),
 
+    it("Disk - should not error on serialized BigNumber (0)", () => {
+        const dish = new Dish({ s: 1, e: 0, c: [0] }, Dish.BIG_NUMBER);
+        assert.strictEqual(dish.value.toString(), "0");
+    }),
+
+    it("Dish - should not error on serialized BigNumber (1)", () => {
+        const dish = new Dish({ c: [1], e: 0, s: 1 }, Dish.BIG_NUMBER);
+        assert.strictEqual(dish.value.toString(), "1");
+    }),
+
+    it("Dish - should not error on serialized BigNumber (-100)", () => {
+        const dish = new Dish({ s: -1, e: 2, c: [100] }, Dish.BIG_NUMBER);
+        assert.strictEqual(dish.value.toString(), "-100");
+    }),
+
+    it("Dish - should not error on serialized BigNumber (NaN)", () => {
+        const dish = new Dish({ s: null, e: null, c: null }, Dish.BIG_NUMBER);
+        assert.strictEqual(dish.value.toString(), "NaN");
+    }),
 ]);

package/tests/node/tests/NodeDish.mjs

@@ -65,6 +65,42 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "493e8136b759370a415ef2cf2f7a69690441ff86592aba082bc2e2e0");
     }),
 
+    it("Composable Dish: toBase32 should support non-BMP Unicode alphabets", () => {
+        const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅";
+
+        const result = new Dish("hello")
+            .apply(toBase32, {alphabet})
+            .toString();
+
+        // Should not contain replacement characters
+        assert.equal(result.includes("�"), false);
+
+        // Should contain only symbols from the alphabet
+        for (const ch of Array.from(result)) {
+            assert.ok(Array.from(alphabet).includes(ch));
+        }
+
+        // "hello" => 8 Base32 symbols
+        assert.equal(Array.from(result).length, 8);
+    }),
+
+    it("Composable Dish: toBase32 should omit padding for 32-character Unicode alphabets", () => {
+        const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅";
+
+        const result = new Dish("hell")
+            .apply(toBase32, {alphabet})
+            .toString();
+
+        // Should not leak undefined from array indexing
+        assert.equal(result.includes("undefined"), false);
+
+        // Should not contain replacement characters
+        assert.equal(result.includes("�"), false);
+
+        // Unpadded Base32 output for 4-byte input should be 7 symbols
+        assert.equal(Array.from(result).length, 7);
+    }),
+
     it("Dish translation: ArrayBuffer to ArrayBuffer", () => {
         const dish = new Dish(new ArrayBuffer(10), 4);
         dish.get("array buffer");

package/tests/node/tests/ToHTMLEntity.mjs

@@ -0,0 +1,82 @@
+import TestRegister from "../../lib/TestRegister.mjs";
+import ToHTMLEntity from "../../../src/core/operations/ToHTMLEntity.mjs";
+import FromHTMLEntity from "../../../src/core/operations/FromHTMLEntity.mjs";
+import { HTML_ENTITY_LOOKUP, HTML_ENTITY_REVERSE_LOOKUP } from "../../../src/core/lib/HTMLEntities.mjs";
+import it from "../assertionHandler.mjs";
+import assert from "assert";
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import path from "path";
+
+// Vendored WHATWG named character reference set (https://html.spec.whatwg.org/entities.json).
+const SPEC = JSON.parse(readFileSync(path.join(
+    path.dirname(fileURLToPath(import.meta.url)),
+    "../../../src/core/vendor/htmlEntities/entity.json"), "utf8"));
+const specByName = {};
+for (const [key, val] of Object.entries(SPEC))
+    if (key.endsWith(";")) specByName[key.slice(1, -1)] = val.codepoints;
+
+TestRegister.addApiTests([
+    it("To HTML Entity: every named entity in the table is well-formed", () => {
+        // "Convert all characters" emits an entity for every code point, so a
+        // correct table yields an unbroken stream of entity tokens. A malformed
+        // value such as "≱;" or "ε," leaves stray characters between
+        // tokens, which the walk below flags and reports with surrounding context.
+        let input = "";
+        for (let cp = 0; cp <= 0xFFFF; cp++) {
+            if (cp >= 0xD800 && cp <= 0xDFFF) continue; // skip surrogate range
+            input += String.fromCodePoint(cp);
+        }
+        const output = new ToHTMLEntity().run(input, [true, "Named entities"]);
+
+        const tokenRe = /&#[0-9]+;|&#x[0-9a-fA-F]+;|&[A-Za-z][A-Za-z0-9]*;/y;
+        const malformed = [];
+        let pos = 0;
+        while (pos < output.length) {
+            tokenRe.lastIndex = pos;
+            if (tokenRe.exec(output)) {
+                pos = tokenRe.lastIndex;
+            } else {
+                malformed.push(output.slice(Math.max(0, pos - 12), pos + 12));
+                pos++;
+            }
+        }
+        assert.deepStrictEqual(malformed, [], `Malformed entity value(s) near: ${JSON.stringify(malformed)}`);
+    }),
+
+    it("HTML Entity: named encoding round-trips through From HTML Entity", () => {
+        // Because both operations share one lookup table, encoding a character to
+        // a named entity and decoding it must return the original character for
+        // every BMP code point: FromHTMLEntity(ToHTMLEntity(x)) === x.
+        const toOp = new ToHTMLEntity(),
+            fromOp = new FromHTMLEntity();
+        const mismatches = [];
+        for (let cp = 0; cp <= 0xFFFF; cp++) {
+            if (cp >= 0xD800 && cp <= 0xDFFF) continue; // skip surrogate range
+            const char = String.fromCodePoint(cp);
+            const encoded = toOp.run(char, [true, "Named entities"]);
+            const decoded = fromOp.run(encoded, []);
+            if (decoded !== char)
+                mismatches.push(`U+${cp.toString(16).toUpperCase().padStart(4, "0")} -> ${encoded} -> U+${decoded.codePointAt(0).toString(16).toUpperCase()}`);
+        }
+        assert.deepStrictEqual(mismatches, [], `Round-trip failed for: ${JSON.stringify(mismatches.slice(0, 20))}`);
+    }),
+
+    it("HTML Entity: every table entry is conformant with the WHATWG spec", () => {
+        // Both lookup tables must agree with entities.json: every encode name is a
+        // real spec name mapping to exactly that code point, and every decode name
+        // maps to the spec code point.
+        const violations = [];
+        for (const [cp, name] of Object.entries(HTML_ENTITY_LOOKUP)) {
+            const spec = specByName[name];
+            if (!spec || spec.length !== 1 || spec[0] !== Number(cp))
+                violations.push(`encode ${cp} -> &${name}; (spec: ${spec ? JSON.stringify(spec) : "none"})`);
+        }
+        for (const [name, cp] of Object.entries(HTML_ENTITY_REVERSE_LOOKUP)) {
+            const spec = specByName[name];
+            if (!spec || spec.length !== 1 || spec[0] !== cp)
+                violations.push(`decode &${name}; -> ${cp} (spec: ${spec ? JSON.stringify(spec) : "none"})`);
+        }
+        assert.deepStrictEqual(violations, [], `Spec violations: ${JSON.stringify(violations.slice(0, 20))}`);
+    }),
+]);

package/tests/node/tests/Utils.mjs

@@ -26,4 +26,81 @@ TestRegister.addApiTests([
             "\x7e...",
         );
     }),
+
+    it("Utils: should parse normal pretty recipes", () => {
+        assert.deepStrictEqual(
+            Utils.parseRecipeConfig("From_Base64('A-Za-z0-9+/=',true)To_Hex('Space')"),
+            [
+                {
+                    op: "From Base64",
+                    args: ["A-Za-z0-9+/=", true],
+                },
+                {
+                    op: "To Hex",
+                    args: ["Space"],
+                },
+            ],
+        );
+    }),
+
+    it("Utils: should parse pretty recipe options", () => {
+        assert.deepStrictEqual(
+            Utils.parseRecipeConfig("A(/disabled/breakpoint)"),
+            [
+                {
+                    op: "A",
+                    args: [],
+                    disabled: true,
+                    breakpoint: true,
+                },
+            ],
+        );
+    }),
+
+    it("Utils: should parse escaped quotes and backslashes in pretty recipes", () => {
+        assert.deepStrictEqual(
+            Utils.parseRecipeConfig("A('\\'\\\\')"),
+            [
+                {
+                    op: "A",
+                    args: ["'\\"],
+                },
+            ],
+        );
+    }),
+
+    it("Utils: should parse large valid quoted pretty recipe arguments", () => {
+        const value = "x".repeat(10000);
+
+        assert.deepStrictEqual(
+            Utils.parseRecipeConfig(`A('${value}')`),
+            [
+                {
+                    op: "A",
+                    args: [value],
+                },
+            ],
+        );
+    }),
+
+    it("Utils: should reject malformed pretty recipes with unmatched quotes", () => {
+        assert.throws(
+            () => Utils.parseRecipeConfig("A(" + "'".repeat(10000)),
+            /Invalid recipe/,
+        );
+    }),
+
+    it("Utils: should reject malformed pretty recipes with malformed parentheses", () => {
+        assert.throws(
+            () => Utils.parseRecipeConfig("A("),
+            /Invalid recipe/,
+        );
+    }),
+
+    it("Utils: should reject malformed pretty recipes with malformed escapes", () => {
+        assert.throws(
+            () => Utils.parseRecipeConfig("A('" + "\\".repeat(10000)),
+            /Invalid recipe/,
+        );
+    }),
 ]);

package/tests/node/tests/nodeApi.mjs

@@ -109,6 +109,38 @@ TestRegister.addApiTests([
         assert.equal(3 + result, 35);
     }),
 
+    it("toBase32: should support non-BMP Unicode alphabets", () => {
+        const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅";
+
+        const result = chef.toBase32("hello", {alphabet}).toString();
+
+        // Should not contain replacement characters
+        assert.equal(result.includes("�"), false);
+
+        // Should contain only symbols from the alphabet
+        for (const ch of Array.from(result)) {
+            assert.ok(Array.from(alphabet).includes(ch));
+        }
+
+        // "hello" => 8 Base32 symbols
+        assert.equal(Array.from(result).length, 8);
+    }),
+
+    it("toBase32: should omit padding for 32-character Unicode alphabets", () => {
+        const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅";
+
+        const result = chef.toBase32("hell", {alphabet}).toString();
+
+        // Should not leak undefined from array indexing
+        assert.equal(result.includes("undefined"), false);
+
+        // Should not contain replacement characters
+        assert.equal(result.includes("�"), false);
+
+        // Unpadded Base32 output for 4-byte input should be 7 symbols
+        assert.equal(Array.from(result).length, 7);
+    }),
+
     it("chef.help: should exist", () => {
         assert(chef.help);
     }),
@@ -136,7 +168,7 @@ TestRegister.addApiTests([
 
     it("chef.help: returns multiple results", () => {
         const result = chef.help("base 64");
-        assert.strictEqual(result.length, 13);
+        assert.strictEqual(result.length, 14);
     }),
 
     it("chef.help: looks in description for matches too", () => {

package/tests/node/tests/operations.mjs

@@ -264,6 +264,18 @@ Full hash: $2a$10$ODeP1.6fMsb.ENk2ngPUCO7qTGVPyHA9TqDVcyupyed8FjsiF65L6`;
         assert.strictEqual(result.toString(), "Fit as a Fiddle");
     }),
 
+    it("Bzip2 Compress: round-trips through the Node API", async () => {
+        const compressed = await chef.bzip2Compress("The quick brown fox.");
+        const result = await chef.bzip2Decompress(compressed);
+        assert.strictEqual(result.toString(), "The quick brown fox.");
+    }),
+
+    it("Avro to JSON: decodes an object container file through the Node API", async () => {
+        const avro = chef.fromHex("4f626a0104166176726f2e736368656d6196017b2274797065223a227265636f7264222c226e616d65223a22736d616c6c222c226669656c6473223a5b7b226e616d65223a226e616d65222c2274797065223a22737472696e67227d5d7d146176726f2e636f646563086e756c6c004e0247632e3702e5b75cdab9a62f1541020e0c6d796e616d654e0247632e3702e5b75cdab9a62f1541");
+        const result = await chef.avroToJSON(avro);
+        assert.strictEqual(result.toString(), "{\n    \"name\": \"myname\"\n}");
+    }),
+
     it("cartesianProduct: binary string", () => {
         const result = cartesianProduct("1:2\\n\\n3:4", {
             itemDelimiter: ":",
@@ -605,8 +617,9 @@ Top Drawer`, {
 
     it("Generate HOTP", () => {
         const result = chef.generateHOTP("JBSWY3DPEHPK3PXP", {
+            name: "Account",
         });
-        const expected = `URI: otpauth://hotp/?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0
+        const expected = `URI: otpauth://hotp/Account?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0
 
 Password: 282760`;
         assert.strictEqual(result.toString(), expected);
@@ -728,6 +741,18 @@ Arguments:
         assert.strictEqual(result.toString(), expected);
     }),
 
+    it("Parse URI with constructor and __proto__ arguments", () => {
+        const result = chef.parseURI("https://example.com/?constructor=ok&__proto__=hello");
+        const expected = `Protocol:	https:
+Hostname:	example.com
+Path name:	/
+Arguments:
+\tconstructor = ok
+\t__proto__   = hello
+`;
+        assert.strictEqual(result.toString(), expected);
+    }),
+
     it("Parse user agent", () => {
         const result = chef.parseUserAgent("Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0 ");
         const expected = `Browser

package/tests/operations/index.mjs

@@ -20,6 +20,9 @@ import "./tests/A1Z26CipherDecode.mjs";
 import "./tests/AESKeyWrap.mjs";
 import "./tests/AlternatingCaps.mjs";
 import "./tests/AnalyseUUID.mjs";
+import "./tests/Arithmetic.mjs";
+import "./tests/Ascon.mjs";
+import "./tests/AutomatedValidation.mjs";
 import "./tests/AvroToJSON.mjs";
 import "./tests/BCD.mjs";
 import "./tests/BLAKE2b.mjs";
@@ -41,6 +44,7 @@ import "./tests/ByteRepr.mjs";
 import "./tests/CBORDecode.mjs";
 import "./tests/CBOREncode.mjs";
 import "./tests/CMAC.mjs";
+import "./tests/COBS.mjs";
 import "./tests/CRCChecksum.mjs";
 import "./tests/CSV.mjs";
 import "./tests/CaesarBoxCipher.mjs";
@@ -64,6 +68,7 @@ import "./tests/ConvertLeetSpeak.mjs";
 import "./tests/ConvertToNATOAlphabet.mjs";
 import "./tests/Crypt.mjs";
 import "./tests/DateTime.mjs";
+import "./tests/DechunkHTTPResponse.mjs";
 import "./tests/DefangIP.mjs";
 import "./tests/DisassembleARM.mjs";
 import "./tests/DropNthBytes.mjs";
@@ -71,6 +76,7 @@ import "./tests/ECDSA.mjs";
 import "./tests/ELFInfo.mjs";
 import "./tests/Enigma.mjs";
 import "./tests/EscapeSmartCharacters.mjs";
+import "./tests/ExtendedGCD.mjs";
 import "./tests/ExtractAudioMetadata.mjs";
 import "./tests/ExtractEmailAddresses.mjs";
 import "./tests/ExtractHashes.mjs";
@@ -81,6 +87,7 @@ import "./tests/FlaskSession.mjs";
 import "./tests/FletcherChecksum.mjs";
 import "./tests/Float.mjs";
 import "./tests/Fork.mjs";
+import "./tests/FromBase.mjs";
 import "./tests/FromDecimal.mjs";
 import "./tests/GOST.mjs";
 import "./tests/GenerateAllChecksums.mjs";
@@ -93,6 +100,7 @@ import "./tests/Gunzip.mjs";
 import "./tests/Gzip.mjs";
 import "./tests/HASSH.mjs";
 import "./tests/HKDF.mjs";
+import "./tests/HTMLEntity.mjs";
 import "./tests/Hash.mjs";
 import "./tests/HaversineDistance.mjs";
 import "./tests/Hex.mjs";
@@ -121,10 +129,13 @@ import "./tests/LevenshteinDistance.mjs";
 import "./tests/Lorenz.mjs";
 import "./tests/LuhnChecksum.mjs";
 import "./tests/MIMEDecoding.mjs";
+import "./tests/MOD.mjs";
 import "./tests/MS.mjs";
 import "./tests/Magic.mjs";
 import "./tests/Media.mjs";
+import "./tests/Median.mjs";
 import "./tests/Modhex.mjs";
+import "./tests/ModularInverse.mjs";
 import "./tests/MorseCode.mjs";
 import "./tests/MultipleBombe.mjs";
 import "./tests/MurmurHash3.mjs";
@@ -136,6 +147,7 @@ import "./tests/PEMtoHex.mjs";
 import "./tests/PGP.mjs";
 import "./tests/PHP.mjs";
 import "./tests/PHPSerialize.mjs";
+import "./tests/PRESENT.mjs";
 import "./tests/ParityBit.mjs";
 import "./tests/ParseCSR.mjs";
 import "./tests/ParseEthernetFrame.mjs";
@@ -163,6 +175,7 @@ import "./tests/Register.mjs";
 import "./tests/RegularExpression.mjs";
 import "./tests/RemoveANSIEscapeCodes.mjs";
 import "./tests/RenderMarkdown.mjs";
+import "./tests/RenderPDF.mjs";
 import "./tests/RisonEncodeDecode.mjs";
 import "./tests/Rotate.mjs";
 import "./tests/SIGABA.mjs";
@@ -174,6 +187,7 @@ import "./tests/SeqUtils.mjs";
 import "./tests/SetDifference.mjs";
 import "./tests/SetIntersection.mjs";
 import "./tests/SetUnion.mjs";
+import "./tests/ShowOnMap.mjs";
 import "./tests/Shuffle.mjs";
 // Cannot test operations that use the File type yet
 // import "./tests/SplitColourChannels.mjs";
@@ -184,15 +198,18 @@ import "./tests/StripUDPHeader.mjs";
 import "./tests/Subsection.mjs";
 import "./tests/SwapCase.mjs";
 import "./tests/SymmetricDifference.mjs";
+import "./tests/TEA.mjs";
 import "./tests/TakeNthBytes.mjs";
 import "./tests/Template.mjs";
 import "./tests/TextEncodingBruteForce.mjs";
 import "./tests/TextIntegerConverter.mjs";
 import "./tests/ToFromInsensitiveRegex.mjs";
 import "./tests/TranslateDateTimeFormat.mjs";
+import "./tests/Twofish.mjs";
 import "./tests/Typex.mjs";
 import "./tests/URLEncodeDecode.mjs";
 import "./tests/UnescapeString.mjs";
+import "./tests/UnescapeUnicodeCharacters.mjs";
 import "./tests/Unicode.mjs";
 import "./tests/Wrap.mjs";
 import "./tests/XORChecksum.mjs";

package/tests/operations/tests/Arithmetic.mjs

@@ -0,0 +1,33 @@
+/**
+ * Tests for arithmetical operations
+ *
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Subtract",
+        input: "321,123,test",
+        expectedOutput: "198",
+        recipeConfig: [
+            {
+                "op": "Subtract",
+                "args": ["Comma"]
+            },
+        ],
+    },
+    {
+        name: "Subtract - no valid input",
+        input: "test",
+        expectedOutput: "NaN",
+        recipeConfig: [
+            {
+                "op": "Subtract",
+                "args": ["Comma"]
+            },
+        ],
+    },
+]);