exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix Dechunk HTTP Response leaks terminating chunk and trailers into output (#2290)

Browse Source
This commit is contained in:
Willi Ballenthin 2026-06-20 11:49:47 +02:00 committed by GitHub
parent 64fc664479
commit 08e5c13da4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 70 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/operations/DechunkHTTPResponse.mjs
View File

@ -45,12 +45,15 @@ class DechunkHTTPResponse extends Operation {
const lineEndingsLength = lineEndings.length;
let chunkSize = parseInt(input.slice(0, chunkSizeEnd), 16);
while (!isNaN(chunkSize)) {
if (chunkSize === 0) {
break;
}
chunks.push(input.slice(chunkSizeEnd, chunkSize + chunkSizeEnd));
input = input.slice(chunkSizeEnd + chunkSize + lineEndingsLength);
chunkSizeEnd = input.indexOf(lineEndings) + lineEndingsLength;
chunkSize = parseInt(input.slice(0, chunkSizeEnd), 16);
}
return chunks.join("") + input;
return chunks.join("");
}
}

66
tests/operations/tests/DechunkHTTPResponse.mjs Normal file
View File

@ -0,0 +1,66 @@
/**
* DechunkHTTPResponse operation tests.
*
* @author Willi Ballenthin
* @copyright Crown Copyright 2026
* @license Apache-2.0
*/
import TestRegister from "../../lib/TestRegister.mjs";
TestRegister.addTests([
{
name: "Dechunk HTTP response: CRLF line endings",
input: "7\r\nMozilla\r\n9\r\nDeveloper\r\n7\r\nNetwork\r\n0\r\n\r\n",
expectedOutput: "MozillaDeveloperNetwork",
recipeConfig: [
{
op: "Dechunk HTTP response",
args: [],
},
],
},
{
name: "Dechunk HTTP response: LF line endings",
input: "7\nMozilla\n9\nDeveloper\n7\nNetwork\n0\n\n",
expectedOutput: "MozillaDeveloperNetwork",
recipeConfig: [
{
op: "Dechunk HTTP response",
args: [],
},
],
},
{
name: "Dechunk HTTP response: single chunk",
input: "5\r\nHello\r\n0\r\n\r\n",
expectedOutput: "Hello",
recipeConfig: [
{
op: "Dechunk HTTP response",
args: [],
},
],
},
{
name: "Dechunk HTTP response: trailing headers discarded",
input: "7\nMozilla\n9\nDeveloper\n7\nNetwork\n0\nExpires: Wed, 21 Oct 2015 07:28:00 GMT\n",
expectedOutput: "MozillaDeveloperNetwork",
recipeConfig: [
{
op: "Dechunk HTTP response",
args: [],
},
],
},
{
name: "Dechunk HTTP response: hex chunk sizes",
input: "a\r\n0123456789\r\n0\r\n\r\n",
expectedOutput: "0123456789",
recipeConfig: [
{
op: "Dechunk HTTP response",
args: [],
},
],
},
]);