exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix URL encoding incorrectly converting input to UTF-8 (#2340)

Browse Source
This commit is contained in:
GCHQ Developer 85297 2026-06-19 14:01:19 +01:00 committed by GitHub
parent 33c2207427
commit 4a70dff3f2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 48 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
src/core/operations/URLEncode.mjs
View File

@ -21,7 +21,7 @@ class URLEncode extends Operation {
this.module = "URL"; this.module = "URL";
this.description = "Encodes problematic characters into percent-encoding, a format supported by URIs/URLs.<br><br>e.g. <code>=</code> becomes <code>%3d</code>"; this.description = "Encodes problematic characters into percent-encoding, a format supported by URIs/URLs.<br><br>e.g. <code>=</code> becomes <code>%3d</code>";
this.infoURL = "https://wikipedia.org/wiki/Percent-encoding"; this.infoURL = "https://wikipedia.org/wiki/Percent-encoding";
this.inputType = "string"; this.inputType = "byteArray";
this.outputType = "string"; this.outputType = "string";
this.args = [ this.args = [
{ {
@ -33,34 +33,38 @@ class URLEncode extends Operation {
} }
/** /**
* @param {string} input * @param {byteArray} input
* @param {Object[]} args * @param {Object[]} args
* @returns {string} * @returns {string}
*/ */
run(input, args) { run(input, args) {
const encodeAll = args[0]; const encodeAll = args[0];
return encodeAll ? this.encodeAllChars(input) : encodeURI(input); return this.encodeBytes(input, encodeAll);
} }
/** /**
* Encode characters in URL outside of encodeURI() function spec * Encode bytes in URL using percent encoding.
* *
* @param {string} str * @param {byteArray} bytes
* @param {boolean} encodeAll
* @returns {string} * @returns {string}
*/ */
encodeAllChars (str) { encodeBytes(bytes, encodeAll) {
// TODO Do this programmatically const safeChars = encodeAll ?
return encodeURIComponent(str) /^[A-Za-z0-9]$/ :
.replace(/!/g, "%21") /^[A-Za-z0-9:/?#[\]@!$&'()*+,;=%]$/;
.replace(/#/g, "%23")
.replace(/'/g, "%27") let output = "";
.replace(/\(/g, "%28")
.replace(/\)/g, "%29") for (const byte of bytes) {
.replace(/\*/g, "%2A") const char = String.fromCharCode(byte);
.replace(/-/g, "%2D")
.replace(/\./g, "%2E") output += safeChars.test(char) ?
.replace(/_/g, "%5F") char :
.replace(/~/g, "%7E"); "%" + byte.toString(16).toUpperCase().padStart(2, "0");
}
return output;
} }
} }

26
tests/operations/tests/URLEncodeDecode.mjs
View File

@ -89,4 +89,30 @@ TestRegister.addTests([
}, },
], ],
}, },
{
name: "URLEncode: encodes UTF-8 text as UTF-8 bytes",
input: "你好",
expectedOutput: "%E4%BD%A0%E5%A5%BD",
recipeConfig: [
{
op: "URL Encode",
args: [false],
},
],
},
{
name: "URLEncode: preserves raw bytes from From Hex",
input: "6c6567697466696c6580000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090746869737761737375706f736564746f6265616e6578706c6f6974",
expectedOutput: "legitfile%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%90thiswassuposedtobeanexploit",
recipeConfig: [
{
op: "From Hex",
args: ["None"],
},
{
op: "URL Encode",
args: [false],
},
],
},
]); ]);