Bump dependencies

.github/workflows/master.yml

@@ -10,12 +10,12 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
 
     - name: Set node version
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v6
       with:
-        node-version: '18.x'
+        node-version: 18
 
     - name: Install
       run: |

package.json

@@ -39,23 +39,23 @@
     "node >= 16"
   ],
   "devDependencies": {
-    "@babel/core": "^7.24.7",
+    "@babel/core": "^7.28.6",
-    "@babel/eslint-parser": "^7.24.7",
+    "@babel/eslint-parser": "^7.27.1",
-    "@babel/plugin-syntax-import-assertions": "^7.24.7",
+    "@babel/plugin-syntax-import-assertions": "^7.28.6",
-    "@babel/plugin-transform-runtime": "^7.24.7",
+    "@babel/plugin-transform-runtime": "^7.28.5",
-    "@babel/preset-env": "^7.24.7",
+    "@babel/preset-env": "^7.28.6",
-    "@babel/runtime": "^7.24.7",
+    "@babel/runtime": "^7.28.6",
     "@codemirror/commands": "^6.6.0",
     "@codemirror/language": "^6.10.2",
     "@codemirror/search": "^6.5.6",
     "@codemirror/state": "^6.4.1",
     "@codemirror/view": "^6.28.0",
     "autoprefixer": "^10.4.19",
-    "babel-loader": "^9.1.3",
+    "babel-loader": "^10.0.0",
     "babel-plugin-dynamic-import-node": "^2.3.3",
-    "babel-plugin-transform-builtin-extend": "1.1.2",
+    "babel-plugin-transform-builtin-extend": "^1.1.2",
     "base64-loader": "^1.0.0",
-    "chromedriver": "^130.0.0",
+    "chromedriver": "^137.0.0",
     "cli-progress": "^3.12.0",
     "colors": "^1.4.0",
     "compression-webpack-plugin": "^11.1.0",
@@ -70,18 +70,18 @@
     "grunt-chmod": "~1.1.1",
     "grunt-concurrent": "^3.0.0",
     "grunt-contrib-clean": "~2.0.1",
-    "grunt-contrib-connect": "^4.0.0",
+    "grunt-contrib-connect": "^5.0.1",
     "grunt-contrib-copy": "~1.0.0",
     "grunt-contrib-watch": "^1.1.0",
     "grunt-eslint": "^25.0.0",
     "grunt-exec": "~3.0.0",
-    "grunt-webpack": "^6.0.0",
+    "grunt-webpack": "^7.0.1",
     "grunt-zip": "^1.0.0",
     "html-webpack-plugin": "^5.6.0",
     "imports-loader": "^5.0.0",
     "mini-css-extract-plugin": "2.9.0",
     "modify-source-webpack-plugin": "^4.1.0",
-    "nightwatch": "^3.6.3",
+    "nightwatch": "^3.15.0",
     "postcss": "^8.4.38",
     "postcss-css-variables": "^0.19.0",
     "postcss-import": "^16.1.0",
@@ -91,7 +91,7 @@
     "terser": "^5.31.1",
     "webpack": "^5.91.0",
     "webpack-bundle-analyzer": "^4.10.2",
-    "webpack-dev-server": "5.0.4",
+    "webpack-dev-server": "^5.2.3",
     "webpack-node-externals": "^3.0.0",
     "worker-loader": "^3.0.8"
   },
@@ -117,7 +117,7 @@
     "chi-squared": "^1.1.0",
     "codepage": "^1.15.0",
     "crypto-api": "^0.8.5",
-    "crypto-browserify": "^3.12.0",
+    "crypto-browserify": "^3.12.1",
     "crypto-js": "^4.2.0",
     "ctph.js": "0.0.5",
     "d3": "7.9.0",
@@ -128,7 +128,7 @@
     "escodegen": "^2.1.0",
     "esprima": "^4.0.1",
     "exif-parser": "^0.1.12",
-    "fernet": "^0.4.0",
+    "fernet": "^0.3.3",
     "file-saver": "^2.0.5",
     "flat": "^6.0.1",
     "geodesy": "1.1.3",
@@ -136,15 +136,15 @@
     "hash-wasm": "^4.12.0",
     "highlight.js": "^11.9.0",
     "ieee754": "^1.2.1",
-    "jimp": "^0.22.12",
+    "jimp": "^1.6.0",
     "jq-web": "^0.5.1",
     "jquery": "3.7.1",
     "js-sha3": "^0.9.3",
     "jsesc": "^3.0.2",
     "json5": "^2.2.3",
     "jsonata": "^2.0.3",
-    "jsonpath-plus": "^9.0.0",
+    "jsonpath-plus": "^10.3.0",
-    "jsonwebtoken": "8.5.1",
+    "jsonwebtoken": "9.0.3",
     "jsqr": "^1.4.0",
     "jsrsasign": "^11.1.0",
     "kbpgp": "2.1.15",
@@ -186,7 +186,7 @@
     "uuid": "^11.1.0",
     "vkbeautify": "^0.99.3",
     "xpath": "0.0.34",
-    "xregexp": "^5.1.1",
+    "xregexp": "^5.1.2",
     "zlibjs": "^0.3.1"
   },
   "scripts": {

src/core/operations/JWTSign.mjs

@@ -8,12 +8,10 @@ import jwt from "jsonwebtoken";
 import OperationError from "../errors/OperationError.mjs";
 import { JWT_ALGORITHMS } from "../lib/JWT.mjs";
 
-
 /**
  * JWT Sign operation
  */
 class JWTSign extends Operation {
-
     /**
      * JWTSign constructor
      */
@@ -22,7 +20,8 @@ class JWTSign extends Operation {
 
         this.name = "JWT Sign";
         this.module = "Crypto";
-        this.description = "Signs a JSON object as a JSON Web Token using a provided secret / private key.<br><br>The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.";
+        this.description =
+            "Signs a JSON object as a JSON Web Token using a provided secret / private key.<br><br>The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.";
         this.infoURL = "https://wikipedia.org/wiki/JSON_Web_Token";
         this.inputType = "JSON";
         this.outputType = "string";
@@ -30,18 +29,18 @@ class JWTSign extends Operation {
             {
                 name: "Private/Secret Key",
                 type: "text",
-                value: "secret"
+                value: "secret",
             },
             {
                 name: "Signing algorithm",
                 type: "option",
-                value: JWT_ALGORITHMS
+                value: JWT_ALGORITHMS,
             },
             {
                 name: "Header",
                 type: "text",
-                value: "{}"
+                value: "{}",
-            }
+            },
         ];
     }
 
@@ -56,7 +55,11 @@ class JWTSign extends Operation {
         try {
             return jwt.sign(input, key, {
                 algorithm: algorithm === "None" ? "none" : algorithm,
-                header: JSON.parse(header || "{}")
+                header: JSON.parse(header || "{}"),
+                // Allow keys of less than 2048 bits
+                allowInsecureKeySizes: true,
+                // Allow HMAC with SHA-256 algorithms (for symmetric encryption)
+                allowInvalidAsymmetricKeyTypes: true,
             });
         } catch (err) {
             throw new OperationError(`Error: Have you entered the key correctly? The key should be either the secret for HMAC algorithms or the PEM-encoded private key for RSA and ECDSA.
@@ -64,7 +67,6 @@ class JWTSign extends Operation {
 ${err}`);
         }
     }
-
 }
 
 export default JWTSign;

src/core/operations/JWTVerify.mjs

@@ -8,12 +8,10 @@ import jwt from "jsonwebtoken";
 import OperationError from "../errors/OperationError.mjs";
 import { JWT_ALGORITHMS } from "../lib/JWT.mjs";
 
-
 /**
  * JWT Verify operation
  */
 class JWTVerify extends Operation {
-
     /**
      * JWTVerify constructor
      */
@@ -22,7 +20,8 @@ class JWTVerify extends Operation {
 
         this.name = "JWT Verify";
         this.module = "Crypto";
-        this.description = "Verifies that a JSON Web Token is valid and has been signed with the provided secret / private key.<br><br>The key should be either the secret for HMAC algorithms or the PEM-encoded public key for RSA and ECDSA.";
+        this.description =
+            "Verifies that a JSON Web Token is valid and has been signed with the provided secret / private key.<br><br>The key should be either the secret for HMAC algorithms or the PEM-encoded public key for RSA and ECDSA.";
         this.infoURL = "https://wikipedia.org/wiki/JSON_Web_Token";
         this.inputType = "string";
         this.outputType = "JSON";
@@ -30,7 +29,7 @@ class JWTVerify extends Operation {
             {
                 name: "Public/Secret Key",
                 type: "text",
-                value: "secret"
+                value: "secret",
             },
         ];
     }
@@ -46,9 +45,16 @@ class JWTVerify extends Operation {
         algos[algos.indexOf("None")] = "none";
 
         try {
-            const verified = jwt.verify(input, key, { algorithms: algos });
+            const verified = jwt.verify(input, key, {
+                algorithms: algos,
+                // Allow HMAC with SHA-256 algorithms (for symmetric encryption)
+                allowInvalidAsymmetricKeyTypes: true,
+            });
 
-            if (Object.prototype.hasOwnProperty.call(verified, "name") && verified.name === "JsonWebTokenError") {
+            if (
+                Object.prototype.hasOwnProperty.call(verified, "name") &&
+                verified.name === "JsonWebTokenError"
+            ) {
                 throw new OperationError(verified.message);
             }
 
@@ -57,7 +63,6 @@ class JWTVerify extends Operation {
             throw new OperationError(err);
         }
     }
-
 }
 
 export default JWTVerify;

tests/operations/tests/Code.mjs

@@ -322,7 +322,21 @@ TestRegister.addTests([
                 ]
             }
         ],
-        expectedMatch: /^Invalid JPath expression: jsonPath: self is not defined:/
+        expectedMatch: /^Invalid JPath expression: Unexpected "{" at character 1/
+    },
+    {
+        name: "JPath Expression: Script-based RCE",
+        input: "[{}]",
+        recipeConfig: [
+            {
+                "op": "JPath expression",
+                "args": [
+                    "$..[?(p=\"console.log(this.process.mainModule.require('child_process').execSync('id').toString())\";a=''[['constructor']][['constructor']](p);a())]",
+                    "\n"
+                ]
+            }
+        ],
+        expectedMatch: /^Invalid JPath expression: jsonPath: Cannot read properties of {2}\(reading 'constructor'\): /
     },
     {
         name: "CSS selector",

webpack.config.js

@@ -120,17 +120,20 @@ module.exports = {
             jquery: "jquery/src/jquery",
         },
         fallback: {
-            "fs": false,
+            "assert": require.resolve("assert"),
-            "child_process": false,
-            "net": false,
-            "tls": false,
-            "path": require.resolve("path/"),
             "buffer": require.resolve("buffer/"),
+            "child_process": false,
             "crypto": require.resolve("crypto-browserify"),
-            "stream": require.resolve("stream-browserify"),
+            "events": require.resolve("events"),
-            "zlib": require.resolve("browserify-zlib"),
+            "fs": false,
+            "net": false,
+            "path": require.resolve("path/"),
             "process": false,
-            "vm": false
+            "stream": require.resolve("stream-browserify"),
+            "tls": false,
+            "url": require.resolve("url"),
+            "vm": false,
+            "zlib": require.resolve("browserify-zlib"),
         }
     },
     module: {