From 0e50d32ec5155cbf2b72d10b9b0357b9ddbca956 Mon Sep 17 00:00:00 2001 From: Zain Nadeem Date: Wed, 24 Jun 2026 21:39:01 +0500 Subject: [PATCH 01/25] Fix stale presenter after expected operation errors (#2589) Co-authored-by: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> (tweaked tests) --- src/core/Recipe.mjs | 2 ++ tests/operations/tests/RenderPDF.mjs | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/core/Recipe.mjs b/src/core/Recipe.mjs index 0886e994..0a2e217d 100755 --- a/src/core/Recipe.mjs +++ b/src/core/Recipe.mjs @@ -241,9 +241,11 @@ class Recipe { // Cannot rely on `err instanceof OperationError` here as extending // native types is not fully supported yet. dish.set(err.message, "string"); + this.lastRunOp = null; return i; } else if (err instanceof DishError || err?.type === "DishError") { dish.set(err.message, "string"); + this.lastRunOp = null; return i; } else { const e = typeof err == "string" ? { message: err } : err; diff --git a/tests/operations/tests/RenderPDF.mjs b/tests/operations/tests/RenderPDF.mjs index f359aa20..ff9c3e5a 100644 --- a/tests/operations/tests/RenderPDF.mjs +++ b/tests/operations/tests/RenderPDF.mjs @@ -7,6 +7,9 @@ import TestRegister from "../../lib/TestRegister.mjs"; +const oversizedPdfLikeInput = "%PDF-1.0\n" + "A".repeat(5000); + + TestRegister.addTests([ { name: "RenderPDF", @@ -34,4 +37,19 @@ TestRegister.addTests([ } ], }, + { + name: "RenderPDF followed by Generate QR Code error returns plain text", + input: oversizedPdfLikeInput, + expectedOutput: "Error generating QR code. (Error: Too much data)", + recipeConfig: [ + { + "op": "Render PDF", + "args": ["Raw"] + }, + { + "op": "Generate QR Code", + "args": ["PNG", 1, 0, "High"] + } + ], + }, ]); From bd4c59cf34bfa4b1ae06839db70936786c5702df Mon Sep 17 00:00:00 2001 From: Kirill Date: Thu, 25 Jun 2026 14:59:33 +0300 Subject: [PATCH 02/25] Handle empty Generate Image mode (#2598) --- src/core/operations/GenerateImage.mjs | 4 ++++ tests/operations/tests/Image.mjs | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/src/core/operations/GenerateImage.mjs b/src/core/operations/GenerateImage.mjs index 053e4ba1..c276213d 100644 --- a/src/core/operations/GenerateImage.mjs +++ b/src/core/operations/GenerateImage.mjs @@ -74,6 +74,10 @@ class GenerateImage extends Operation { Bits: 1 / 8, }; + if (!Object.hasOwn(bytePerPixelMap, mode)) { + throw new OperationError(`Unsupported Mode: (${mode})`); + } + const bytesPerPixel = bytePerPixelMap[mode]; if (bytesPerPixel > 0 && input.length % bytesPerPixel !== 0) { diff --git a/tests/operations/tests/Image.mjs b/tests/operations/tests/Image.mjs index 1f450433..fe6cab10 100644 --- a/tests/operations/tests/Image.mjs +++ b/tests/operations/tests/Image.mjs @@ -45,6 +45,17 @@ TestRegister.addTests([ { op: "Render Image", args: ["Base64"] } ] }, + { + name: "Generate Image: empty mode", + input: "", + expectedOutput: "Unsupported Mode: ()", + recipeConfig: [ + { + op: "Generate Image", + args: ["", 8, 64] + } + ] + }, { name: "Extract EXIF: nothing", input: "", From 6717ae1bc32673d006fd37eb8e477b61463652a3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Jun 2026 09:24:51 +0100 Subject: [PATCH 03/25] chore (deps): bump the minor-updates group with 2 updates (#2603) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 16 ++++++++-------- package.json | 4 ++-- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 46d2fa53..edea67ed 100644 --- a/package-lock.json +++ b/package-lock.json @@ -27,7 +27,7 @@ "bootstrap-colorpicker": "^3.4.0", "bootstrap-material-design": "^4.1.3", "browserify-zlib": "^0.2.0", - "bson": "^7.2.0", + "bson": "^7.3.0", "buffer": "^6.0.3", "cbor": "10.0.12", "chi-squared": "^1.1.0", @@ -133,7 +133,7 @@ "css-loader": "^7.1.4", "eslint": "^9.39.4", "eslint-plugin-jsdoc": "^50.8.0", - "globals": "^17.6.0", + "globals": "^17.7.0", "grunt": "^1.6.2", "grunt-chmod": "~1.1.1", "grunt-concurrent": "^3.0.0", @@ -6293,9 +6293,9 @@ } }, "node_modules/bson": { - "version": "7.2.0", - "resolved": "https://registry.npmjs.org/bson/-/bson-7.2.0.tgz", - "integrity": "sha512-YCEo7KjMlbNlyHhz7zAZNDpIpQbd+wOEHJYezv0nMYTn4x31eIUM2yomNNubclAt63dObUzKHWsBLJ9QcZNSnQ==", + "version": "7.3.0", + "resolved": "https://registry.npmjs.org/bson/-/bson-7.3.0.tgz", + "integrity": "sha512-WmjjMEwFwZHmGnAb7wn90MhkiT+mTm4x/rLj7dvAPWfwnVWDXhLun2e+UM88MJoDGW624yzZglVX/zTBy9ZZMw==", "license": "Apache-2.0", "engines": { "node": ">=20.19.0" @@ -10236,9 +10236,9 @@ } }, "node_modules/globals": { - "version": "17.6.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.6.0.tgz", - "integrity": "sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==", + "version": "17.7.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz", + "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index f20fba60..2ac0d47d 100644 --- a/package.json +++ b/package.json @@ -63,7 +63,7 @@ "css-loader": "^7.1.4", "eslint": "^9.39.4", "eslint-plugin-jsdoc": "^50.8.0", - "globals": "^17.6.0", + "globals": "^17.7.0", "grunt": "^1.6.2", "grunt-chmod": "~1.1.1", "grunt-concurrent": "^3.0.0", @@ -111,7 +111,7 @@ "bootstrap-colorpicker": "^3.4.0", "bootstrap-material-design": "^4.1.3", "browserify-zlib": "^0.2.0", - "bson": "^7.2.0", + "bson": "^7.3.0", "buffer": "^6.0.3", "cbor": "10.0.12", "chi-squared": "^1.1.0", From 9672a8f870f170efde39fdf5162f53f8c61fb34f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Jun 2026 09:25:12 +0100 Subject: [PATCH 04/25] chore (deps): bump actions/checkout from 6.0.3 to 7.0.0 in the actions-dependencies group (#2601) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/master.yml | 2 +- .github/workflows/pull_requests.yml | 2 +- .github/workflows/releases.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index c03810a8..e8a120ed 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -16,7 +16,7 @@ jobs: pages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml index fd5ff732..8424e16d 100644 --- a/.github/workflows/pull_requests.yml +++ b/.github/workflows/pull_requests.yml @@ -12,7 +12,7 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index 13f45cb1..ae47bf4f 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -22,7 +22,7 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 @@ -110,7 +110,7 @@ jobs: needs: main runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 From e112da3c12cebd1cf65911916e7df43b0fda8c52 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Jun 2026 11:08:47 +0100 Subject: [PATCH 05/25] chore (deps): bump the patch-updates group with 8 updates (#2602) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 256 ++++++++++++++++++++++++++++++++-------------- package.json | 14 +-- 2 files changed, 185 insertions(+), 85 deletions(-) diff --git a/package-lock.json b/package-lock.json index edea67ed..048e433b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -85,7 +85,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^8.6.4", + "protobufjs": "^8.6.5", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -94,7 +94,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.8.1", + "sql-formatter": "^15.8.2", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^7.0.0", @@ -102,7 +102,7 @@ "unorm": "^1.6.0", "url": "^0.11.4", "utf8": "^3.0.0", - "uuid": "^14.0.0", + "uuid": "^14.0.1", "vkbeautify": "^0.99.3", "xpath": "0.0.34", "xregexp": "^5.1.2", @@ -114,13 +114,13 @@ "@babel/plugin-transform-runtime": "^7.29.7", "@babel/preset-env": "^7.29.7", "@babel/runtime": "^7.29.7", - "@codemirror/commands": "^6.10.3", + "@codemirror/commands": "^6.10.4", "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.7.1", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.43.1", - "@puppeteer/browsers": "3.0.4", - "autoprefixer": "^10.5.0", + "@codemirror/view": "^6.43.2", + "@puppeteer/browsers": "3.0.5", + "autoprefixer": "^10.5.1", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", "chromedriver": "^148.0.4", @@ -1848,14 +1848,14 @@ } }, "node_modules/@codemirror/commands": { - "version": "6.10.3", - "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.10.3.tgz", - "integrity": "sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q==", + "version": "6.10.4", + "resolved": "https://registry.npmjs.org/@codemirror/commands/-/commands-6.10.4.tgz", + "integrity": "sha512-Ryk9y9T0FFVF0cUGhAknveAyUOl/A1qReTFi+qPKtOh2Z9F4AUBz3XOrYD4ZEgZirdugVzHvd/2/Wcwy5OliTg==", "dev": true, "license": "MIT", "dependencies": { "@codemirror/language": "^6.0.0", - "@codemirror/state": "^6.6.0", + "@codemirror/state": "^6.7.0", "@codemirror/view": "^6.27.0", "@lezer/common": "^1.1.0" } @@ -1888,9 +1888,9 @@ } }, "node_modules/@codemirror/state": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.6.0.tgz", - "integrity": "sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ==", + "version": "6.7.0", + "resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.7.0.tgz", + "integrity": "sha512-Zbl9NyscLMZkfXPQnNAIIAFftidrA1UbcJEIMp24C0Bukc2I5T8wJS0wsXYsnDOqCFJUeJ1BITGNs5CqPDSmSg==", "dev": true, "license": "MIT", "dependencies": { @@ -1898,13 +1898,13 @@ } }, "node_modules/@codemirror/view": { - "version": "6.43.1", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.1.tgz", - "integrity": "sha512-+BIjw/AG3tDQ4pJgTLPYdAW25eDE66YsvM4LKyVPgGzVgZ4a9Wj1SRX8kPVKgBDdPt8oHtZ15F0qx7p0oOHdHw==", + "version": "6.43.2", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.2.tgz", + "integrity": "sha512-8kU6WNRYBKV9Sw3cxNz+uSvUvx3tt+1qgupGFPubnbLFDHOgh5qQdIGmXcD7bkA/PROK6LDKVhKMpcY7H++Amg==", "dev": true, "license": "MIT", "dependencies": { - "@codemirror/state": "^6.6.0", + "@codemirror/state": "^6.7.0", "crelt": "^1.0.6", "style-mod": "^4.1.0", "w3c-keyname": "^2.2.4" @@ -4417,14 +4417,14 @@ "license": "MIT" }, "node_modules/@puppeteer/browsers": { - "version": "3.0.4", - "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.0.4.tgz", - "integrity": "sha512-HGM8iAmGTf+Y7t0373szVbTmt3d7vPkYL/1bpOkOFO0YUYLgSeuYBCzESklogNPvOBnZ/MRD5f07OkpqH1trtA==", + "version": "3.0.5", + "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.0.5.tgz", + "integrity": "sha512-xYXNuEQmHNIPWWcbL/skf2KF7seyp7c1xmKFRk3wmdFx7VwBsKVrtOLKs8ecaezsKPsWeF1YsgwIiElAscaryA==", "dev": true, "license": "Apache-2.0", "dependencies": { "modern-tar": "^0.7.6", - "yargs": "^17.7.2" + "yargs": "^18.0.0" }, "bin": { "browsers": "lib/main-cli.js" @@ -4441,48 +4441,132 @@ } } }, + "node_modules/@puppeteer/browsers/node_modules/ansi-regex": { + "version": "6.2.2", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz", + "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-regex?sponsor=1" + } + }, + "node_modules/@puppeteer/browsers/node_modules/ansi-styles": { + "version": "6.2.3", + "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz", + "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/ansi-styles?sponsor=1" + } + }, "node_modules/@puppeteer/browsers/node_modules/cliui": { - "version": "8.0.1", - "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz", - "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==", + "version": "9.0.1", + "resolved": "https://registry.npmjs.org/cliui/-/cliui-9.0.1.tgz", + "integrity": "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w==", "dev": true, "license": "ISC", "dependencies": { - "string-width": "^4.2.0", - "strip-ansi": "^6.0.1", - "wrap-ansi": "^7.0.0" + "string-width": "^7.2.0", + "strip-ansi": "^7.1.0", + "wrap-ansi": "^9.0.0" }, "engines": { - "node": ">=12" + "node": ">=20" } }, - "node_modules/@puppeteer/browsers/node_modules/yargs": { - "version": "17.7.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz", - "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==", + "node_modules/@puppeteer/browsers/node_modules/emoji-regex": { + "version": "10.6.0", + "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz", + "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==", + "dev": true, + "license": "MIT" + }, + "node_modules/@puppeteer/browsers/node_modules/string-width": { + "version": "7.2.0", + "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz", + "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==", "dev": true, "license": "MIT", "dependencies": { - "cliui": "^8.0.1", - "escalade": "^3.1.1", - "get-caller-file": "^2.0.5", - "require-directory": "^2.1.1", - "string-width": "^4.2.3", - "y18n": "^5.0.5", - "yargs-parser": "^21.1.1" + "emoji-regex": "^10.3.0", + "get-east-asian-width": "^1.0.0", + "strip-ansi": "^7.1.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/@puppeteer/browsers/node_modules/strip-ansi": { + "version": "7.2.0", + "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz", + "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-regex": "^6.2.2" }, "engines": { "node": ">=12" + }, + "funding": { + "url": "https://github.com/chalk/strip-ansi?sponsor=1" + } + }, + "node_modules/@puppeteer/browsers/node_modules/wrap-ansi": { + "version": "9.0.2", + "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz", + "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==", + "dev": true, + "license": "MIT", + "dependencies": { + "ansi-styles": "^6.2.1", + "string-width": "^7.0.0", + "strip-ansi": "^7.1.0" + }, + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/chalk/wrap-ansi?sponsor=1" + } + }, + "node_modules/@puppeteer/browsers/node_modules/yargs": { + "version": "18.0.0", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-18.0.0.tgz", + "integrity": "sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg==", + "dev": true, + "license": "MIT", + "dependencies": { + "cliui": "^9.0.1", + "escalade": "^3.1.1", + "get-caller-file": "^2.0.5", + "string-width": "^7.2.0", + "y18n": "^5.0.5", + "yargs-parser": "^22.0.0" + }, + "engines": { + "node": "^20.19.0 || ^22.12.0 || >=23" } }, "node_modules/@puppeteer/browsers/node_modules/yargs-parser": { - "version": "21.1.1", - "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz", - "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==", + "version": "22.0.0", + "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-22.0.0.tgz", + "integrity": "sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw==", "dev": true, "license": "ISC", "engines": { - "node": ">=12" + "node": "^20.19.0 || ^22.12.0 || >=23" } }, "node_modules/@testim/chrome-version": { @@ -5531,9 +5615,9 @@ "license": "MIT" }, "node_modules/autoprefixer": { - "version": "10.5.0", - "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz", - "integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==", + "version": "10.5.1", + "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.1.tgz", + "integrity": "sha512-jwM2pcTuCWUoN70FEvf5XrXyDbUgRURK4FnU8v0jWZZYU/KkVvN9T33mu1sVLFY9JW3kTWzKheEpn6xYLRc/VA==", "dev": true, "funding": [ { @@ -5551,8 +5635,8 @@ ], "license": "MIT", "dependencies": { - "browserslist": "^4.28.2", - "caniuse-lite": "^1.0.30001787", + "browserslist": "^4.28.4", + "caniuse-lite": "^1.0.30001799", "fraction.js": "^5.3.4", "picocolors": "^1.1.1", "postcss-value-parser": "^4.2.0" @@ -5725,9 +5809,9 @@ "license": "MIT" }, "node_modules/baseline-browser-mapping": { - "version": "2.10.19", - "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.19.tgz", - "integrity": "sha512-qCkNLi2sfBOn8XhZQ0FXsT1Ki/Yo5P90hrkRamVFRS7/KV9hpfA4HkoWNU152+8w0zPjnxo5psx5NL3PSGgv5g==", + "version": "2.10.40", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz", + "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==", "dev": true, "license": "Apache-2.0", "bin": { @@ -6259,9 +6343,9 @@ } }, "node_modules/browserslist": { - "version": "4.28.2", - "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz", - "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==", + "version": "4.28.4", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz", + "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==", "dev": true, "funding": [ { @@ -6279,10 +6363,10 @@ ], "license": "MIT", "dependencies": { - "baseline-browser-mapping": "^2.10.12", - "caniuse-lite": "^1.0.30001782", - "electron-to-chromium": "^1.5.328", - "node-releases": "^2.0.36", + "baseline-browser-mapping": "^2.10.38", + "caniuse-lite": "^1.0.30001799", + "electron-to-chromium": "^1.5.376", + "node-releases": "^2.0.48", "update-browserslist-db": "^1.2.3" }, "bin": { @@ -6474,9 +6558,9 @@ } }, "node_modules/caniuse-lite": { - "version": "1.0.30001788", - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001788.tgz", - "integrity": "sha512-6q8HFp+lOQtcf7wBK+uEenxymVWkGKkjFpCvw5W25cmMwEDU45p1xQFBQv8JDlMMry7eNxyBaR+qxgmTUZkIRQ==", + "version": "1.0.30001799", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz", + "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==", "dev": true, "funding": [ { @@ -8692,9 +8776,9 @@ } }, "node_modules/electron-to-chromium": { - "version": "1.5.339", - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.339.tgz", - "integrity": "sha512-Is+0BBHJ4NrdpAYiperrmp53pLywG/yV/6lIMTAnhxvzj/Cmn5Q/ogSHC6AKe7X+8kPLxxFk0cs5oc/3j/fxIg==", + "version": "1.5.379", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.379.tgz", + "integrity": "sha512-v/qV5aV5EUA2pGilzUCq5/eyOloZAqDZBu9UMBIzgPpLlprjSR6zswsWBTv0KpqxLGUAZEwhO95ZCt7srymNVA==", "dev": true, "license": "ISC" }, @@ -10027,6 +10111,19 @@ "node": "6.* || 8.* || >= 10.*" } }, + "node_modules/get-east-asian-width": { + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz", + "integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, "node_modules/get-func-name": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/get-func-name/-/get-func-name-2.0.2.tgz", @@ -13814,11 +13911,14 @@ "license": "CC0-1.0" }, "node_modules/node-releases": { - "version": "2.0.36", - "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.36.tgz", - "integrity": "sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA==", + "version": "2.0.50", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz", + "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==", "dev": true, - "license": "MIT" + "license": "MIT", + "engines": { + "node": ">=18" + } }, "node_modules/nodom": { "version": "2.4.0", @@ -15086,9 +15186,9 @@ "license": "MIT" }, "node_modules/protobufjs": { - "version": "8.6.4", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.4.tgz", - "integrity": "sha512-/+XMv9JalknuncEJSwsyEVlwcxVLKx2iaoSUXFZA86MJkdqyOdfrlB1sB7S6aKyUk9tl20YY+SgQe5J2sJHTcg==", + "version": "8.6.5", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.5.tgz", + "integrity": "sha512-zeE5LPpencAGXvsxyOYmEgJhxzHY8IsmPAFzstZVhDSVT8QH03q6gMZwZRaQGApevZbAL6u28ugs4CC+YKB2jQ==", "license": "BSD-3-Clause", "dependencies": { "long": "^5.3.2" @@ -16774,9 +16874,9 @@ "license": "BSD-3-Clause" }, "node_modules/sql-formatter": { - "version": "15.8.1", - "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.8.1.tgz", - "integrity": "sha512-nT2r90kTEYBuse9fe4r1Rp78v1mOBD35KsGc07Vo9eQSVa1TcTSnCS0zouf6BCmdzvmqBsBW+cYuBoYkHO/OWg==", + "version": "15.8.2", + "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.8.2.tgz", + "integrity": "sha512-kTYRg5FIcvsDtYUG2Qn9pYT6xKwiLJN5TTIvc5Mur6hIg4pSfdpHu8Yyu5bqESLHnVM3mXzD446cb2+uEaKZXg==", "license": "MIT", "dependencies": { "argparse": "^2.0.1", @@ -17858,9 +17958,9 @@ } }, "node_modules/uuid": { - "version": "14.0.0", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz", - "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==", + "version": "14.0.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz", + "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==", "funding": [ "https://github.com/sponsors/broofa", "https://github.com/sponsors/ctavan" diff --git a/package.json b/package.json index 2ac0d47d..ed678f33 100644 --- a/package.json +++ b/package.json @@ -44,13 +44,13 @@ "@babel/plugin-transform-runtime": "^7.29.7", "@babel/preset-env": "^7.29.7", "@babel/runtime": "^7.29.7", - "@codemirror/commands": "^6.10.3", + "@codemirror/commands": "^6.10.4", "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.7.1", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.43.1", - "@puppeteer/browsers": "3.0.4", - "autoprefixer": "^10.5.0", + "@codemirror/view": "^6.43.2", + "@puppeteer/browsers": "3.0.5", + "autoprefixer": "^10.5.1", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", "chromedriver": "^148.0.4", @@ -169,7 +169,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^8.6.4", + "protobufjs": "^8.6.5", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -178,7 +178,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.8.1", + "sql-formatter": "^15.8.2", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^7.0.0", @@ -186,7 +186,7 @@ "unorm": "^1.6.0", "url": "^0.11.4", "utf8": "^3.0.0", - "uuid": "^14.0.0", + "uuid": "^14.0.1", "vkbeautify": "^0.99.3", "xpath": "0.0.34", "xregexp": "^5.1.2", From 2329a0a0e5f1d74f467e23115fae3abbdb918dcc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Jun 2026 11:20:20 +0100 Subject: [PATCH 06/25] chore (deps): bump the docker-dependencies group with 2 updates (#2600) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f70ba966..24eab9fc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds # This is because npm "chromedriver" package is not compatiable with all platforms # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation -FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:156b55f92e98ccd5ef49578a8cea0df4679826564bad1c9d4ef04462b9f0ded6 AS builder +FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS builder WORKDIR /app @@ -27,7 +27,7 @@ RUN npm run build ######################################### # Package static build files into nginx # ######################################### -FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:fafa1102c789119971b3d83f9293f1ef5526bc73583a12e13ff5cd1299ed8b6c AS cyberchef +FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:458ecbec226a23120713b35945bcdf0d6e4ea5bbec60c149ce1deca5d264071b AS cyberchef LABEL maintainer="GCHQ " From 275b594f7c8b0e39880f55e7c1f67dc0a4e73f92 Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Fri, 26 Jun 2026 13:07:33 +0100 Subject: [PATCH 07/25] Fix BigNumber deserialisation in Dish, and add tests (#2607) With ideas from: cyphercodes With ideas from: Sivachandran Paramasivam --- src/core/Dish.mjs | 6 +---- tests/browser/02_ops.js | 4 ++-- tests/node/tests/Dish.mjs | 19 +++++++++++++++ tests/operations/tests/Arithmetic.mjs | 33 +++++++++++++++++++++++++++ 4 files changed, 55 insertions(+), 7 deletions(-) create mode 100644 tests/operations/tests/Arithmetic.mjs diff --git a/src/core/Dish.mjs b/src/core/Dish.mjs index 11b1ff9f..964380fb 100755 --- a/src/core/Dish.mjs +++ b/src/core/Dish.mjs @@ -292,11 +292,7 @@ class Dish { and reinitialise it as a BigNumber object. */ if (Object.keys(this.value).sort().equals(["c", "e", "s"])) { - const temp = new BigNumber(); - temp.c = this.value.c; - temp.e = this.value.e; - temp.s = this.value.s; - this.value = temp; + this.value = new BigNumber({ s: this.value.s, e: this.value.e, c: this.value.c, _isBigNumber: true}); return true; } return false; diff --git a/tests/browser/02_ops.js b/tests/browser/02_ops.js index bb1a5e78..caea3532 100644 --- a/tests/browser/02_ops.js +++ b/tests/browser/02_ops.js @@ -346,8 +346,8 @@ module.exports = { // testOp(browser, "Strip HTTP headers", "test input", "test_output"); // testOp(browser, "Subsection", "test input", "test_output"); // testOp(browser, "Substitute", "test input", "test_output"); - // testOp(browser, "Subtract", "test input", "test_output"); - // testOp(browser, "Sum", "test input", "test_output"); + testOp(browser, "Subtract", "321,123,test", "198", ["Comma"]); + testOp(browser, "Sum", "321,123,test", "444", ["Comma"]); // testOp(browser, "Swap endianness", "test input", "test_output"); // testOp(browser, "Symmetric Difference", "test input", "test_output"); testOpHtml(browser, "Syntax highlighter", "var a = [4,5,6]", ".hljs-selector-attr", "[4,5,6]"); diff --git a/tests/node/tests/Dish.mjs b/tests/node/tests/Dish.mjs index 58da00bf..a1b1dd7d 100644 --- a/tests/node/tests/Dish.mjs +++ b/tests/node/tests/Dish.mjs @@ -9,4 +9,23 @@ TestRegister.addApiTests([ assert(dish.presentAs); }), + it("Disk - should not error on serialized BigNumber (0)", () => { + const dish = new Dish({ s: 1, e: 0, c: [0] }, Dish.BIG_NUMBER); + assert.strictEqual(dish.value.toString(), "0"); + }), + + it("Dish - should not error on serialized BigNumber (1)", () => { + const dish = new Dish({ c: [1], e: 0, s: 1 }, Dish.BIG_NUMBER); + assert.strictEqual(dish.value.toString(), "1"); + }), + + it("Dish - should not error on serialized BigNumber (-100)", () => { + const dish = new Dish({ s: -1, e: 2, c: [100] }, Dish.BIG_NUMBER); + assert.strictEqual(dish.value.toString(), "-100"); + }), + + it("Dish - should not error on serialized BigNumber (NaN)", () => { + const dish = new Dish({ s: null, e: null, c: null }, Dish.BIG_NUMBER); + assert.strictEqual(dish.value.toString(), "NaN"); + }), ]); diff --git a/tests/operations/tests/Arithmetic.mjs b/tests/operations/tests/Arithmetic.mjs new file mode 100644 index 00000000..be62baed --- /dev/null +++ b/tests/operations/tests/Arithmetic.mjs @@ -0,0 +1,33 @@ +/** + * Tests for arithmetical operations + * + * @copyright Crown Copyright 2026 + * @license Apache-2.0 + */ + +import TestRegister from "../../lib/TestRegister.mjs"; + +TestRegister.addTests([ + { + name: "Subtract", + input: "321,123,test", + expectedOutput: "198", + recipeConfig: [ + { + "op": "Subtract", + "args": ["Comma"] + }, + ], + }, + { + name: "Subtract - no valid input", + input: "test", + expectedOutput: "NaN", + recipeConfig: [ + { + "op": "Subtract", + "args": ["Comma"] + }, + ], + }, +]); From 89feb7f9e9771065f01f17e989f0ddcb9116ed4a Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Wed, 1 Jul 2026 10:35:10 +0100 Subject: [PATCH 08/25] Update 4 vulnerable dependencies (#2616) --- package-lock.json | 88 ++++++++++++++++++++++++++--------------------- 1 file changed, 49 insertions(+), 39 deletions(-) diff --git a/package-lock.json b/package-lock.json index 048e433b..e42ae6c4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -247,22 +247,22 @@ } }, "node_modules/@babel/core": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz", - "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz", + "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==", "dev": true, "license": "MIT", "peer": true, "dependencies": { - "@babel/code-frame": "^7.29.0", - "@babel/generator": "^7.29.0", - "@babel/helper-compilation-targets": "^7.28.6", - "@babel/helper-module-transforms": "^7.28.6", - "@babel/helpers": "^7.28.6", - "@babel/parser": "^7.29.0", - "@babel/template": "^7.28.6", - "@babel/traverse": "^7.29.0", - "@babel/types": "^7.29.0", + "@babel/code-frame": "^7.29.7", + "@babel/generator": "^7.29.7", + "@babel/helper-compilation-targets": "^7.29.7", + "@babel/helper-module-transforms": "^7.29.7", + "@babel/helpers": "^7.29.7", + "@babel/parser": "^7.29.7", + "@babel/template": "^7.29.7", + "@babel/traverse": "^7.29.7", + "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", @@ -576,15 +576,15 @@ } }, "node_modules/@babel/helpers": { - "version": "7.29.2", - "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz", - "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz", + "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==", "dev": true, "license": "MIT", "peer": true, "dependencies": { - "@babel/template": "^7.28.6", - "@babel/types": "^7.29.0" + "@babel/template": "^7.29.7", + "@babel/types": "^7.29.7" }, "engines": { "node": ">=6.9.0" @@ -6314,12 +6314,12 @@ } }, "node_modules/browserify-sign": { - "version": "4.2.5", - "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.5.tgz", - "integrity": "sha512-C2AUdAJg6rlM2W5QMp2Q4KGQMVBwR1lIimTsUnutJ8bMpW5B52pGpR2gEnNBNwijumDo5FojQ0L9JrXA8m4YEw==", + "version": "4.2.6", + "resolved": "https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.2.6.tgz", + "integrity": "sha512-sd+Q65fjlWCYWtZKXiKfrUc8d+4jtp/8f0W2NkwzLtoW4bI6UDnWusLWIurHnmurW0XShIRxpwiOX4EoPtXUAg==", "license": "ISC", "dependencies": { - "bn.js": "^5.2.2", + "bn.js": "^5.2.3", "browserify-rsa": "^4.1.1", "create-hash": "^1.2.0", "create-hmac": "^1.1.7", @@ -7046,9 +7046,9 @@ } }, "node_modules/compression-webpack-plugin/node_modules/serialize-javascript": { - "version": "7.0.4", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.4.tgz", - "integrity": "sha512-DuGdB+Po43Q5Jxwpzt1lhyFSYKryqoNjQSA9M92tyw0lyHIOur+XCalOUe0KTJpyqzT8+fQ5A0Jf7vCx/NKmIg==", + "version": "7.0.6", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.6.tgz", + "integrity": "sha512-ATTK5Q4gFVg0YDp1my2vqygyvhcklD/UV5GIlYHooGTn/NogJqIzpetkD6E5kmuVULqz/S9inUL25XcAgDRJQg==", "dev": true, "license": "BSD-3-Clause", "engines": { @@ -7231,9 +7231,9 @@ } }, "node_modules/copy-webpack-plugin/node_modules/serialize-javascript": { - "version": "7.0.4", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.4.tgz", - "integrity": "sha512-DuGdB+Po43Q5Jxwpzt1lhyFSYKryqoNjQSA9M92tyw0lyHIOur+XCalOUe0KTJpyqzT8+fQ5A0Jf7vCx/NKmIg==", + "version": "7.0.6", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.6.tgz", + "integrity": "sha512-ATTK5Q4gFVg0YDp1my2vqygyvhcklD/UV5GIlYHooGTn/NogJqIzpetkD6E5kmuVULqz/S9inUL25XcAgDRJQg==", "dev": true, "license": "BSD-3-Clause", "engines": { @@ -11266,9 +11266,9 @@ } }, "node_modules/http-proxy-middleware": { - "version": "2.0.9", - "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.9.tgz", - "integrity": "sha512-c1IyJYLYppU574+YI7R4QyX2ystMtVXZwIdzazUIPIJsHuWNd+mho2j+bKoHftndicGj9yh+xjd+l0yj7VeT1Q==", + "version": "2.0.10", + "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.10.tgz", + "integrity": "sha512-RKzRWNPxUZqbuk3BC5mGVJbBnWgr+diEnjJexIOytFbBzDy88Fbh/YvBr3DsNrl1jYAfjWfpATEv0NO35FDuPQ==", "dev": true, "license": "MIT", "dependencies": { @@ -12366,10 +12366,20 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -14801,9 +14811,9 @@ } }, "node_modules/piscina": { - "version": "4.9.2", - "resolved": "https://registry.npmjs.org/piscina/-/piscina-4.9.2.tgz", - "integrity": "sha512-Fq0FERJWFEUpB4eSY59wSNwXD4RYqR+nR/WiEVcZW8IWfVBxJJafcgTEZDQo8k3w0sUarJ8RyVbbUF4GQ2LGbQ==", + "version": "4.9.3", + "resolved": "https://registry.npmjs.org/piscina/-/piscina-4.9.3.tgz", + "integrity": "sha512-3e3ka9QCE8RJ5I9uszdAADZnkcYi21cqmF3gxox3u884N72qpFHCsIVhHt8cEQ9t3Auq/NqoiCEuhxlxxQuDWA==", "dev": true, "license": "MIT", "optionalDependencies": { @@ -18688,9 +18698,9 @@ "license": "ISC" }, "node_modules/ws": { - "version": "8.19.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz", - "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==", + "version": "8.21.0", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz", + "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==", "dev": true, "license": "MIT", "engines": { From 766100aad07ab5e1d22829c64f20b28f4ffeffd2 Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Wed, 1 Jul 2026 10:45:40 +0100 Subject: [PATCH 09/25] Set parameter validation Metadata for GenerateImage operations (#2611) --- src/core/operations/GenerateImage.mjs | 28 +++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/src/core/operations/GenerateImage.mjs b/src/core/operations/GenerateImage.mjs index c276213d..31845648 100644 --- a/src/core/operations/GenerateImage.mjs +++ b/src/core/operations/GenerateImage.mjs @@ -12,6 +12,14 @@ import { toBase64 } from "../lib/Base64.mjs"; import { isWorkerEnvironment } from "../Utils.mjs"; import { Jimp, JimpMime, ResizeStrategy, rgbaToInt } from "jimp"; +// arbitrary limits to prevent resource exhaustion +// scale factor of 64 is big enough to likely result in scaling in the display +// window anyway +// pixels per row is harder to come up with a figure that won't inconvenience +// someone. 2048 feels like a reasonable compromise +const MAX_PIXEL_SCALE_FACTOR = 64; +const MAX_PIXELS_PER_ROW = 2048; + /** * Generate Image operation */ @@ -40,11 +48,17 @@ class GenerateImage extends Operation { name: "Pixel Scale Factor", type: "number", value: 8, + integer: true, + min: 1, + max: MAX_PIXEL_SCALE_FACTOR, }, { name: "Pixels per row", type: "number", value: 64, + integer: true, + min: 1, + max: MAX_PIXELS_PER_ROW, }, ]; } @@ -58,14 +72,6 @@ class GenerateImage extends Operation { const [mode, scale, width] = args; input = new Uint8Array(input); - if (scale <= 0) { - throw new OperationError("Pixel Scale Factor needs to be > 0"); - } - - if (width <= 0) { - throw new OperationError("Pixels per Row needs to be > 0"); - } - const bytePerPixelMap = { Greyscale: 1, RG: 2, @@ -167,8 +173,10 @@ class GenerateImage extends Operation { } try { - const imageBuffer = await image.getBuffer(JimpMime.png); - return imageBuffer.buffer; + // see https://nodejs.org/docs/latest-v24.x/api/buffer.html#bufbyteoffset + // for why we can't just return result.buffer + const result = await image.getBuffer(JimpMime.png); + return result.buffer.slice(result.byteOffset, result.byteOffset + result.byteLength); } catch (err) { throw new OperationError(`Error generating image. (${err})`); } From 3c32e3f64de0c5fd60c25cdf7219640c099d04d6 Mon Sep 17 00:00:00 2001 From: GCHQ Developer 85297 <95289555+C85297@users.noreply.github.com> Date: Wed, 1 Jul 2026 14:44:23 +0100 Subject: [PATCH 10/25] Create AGENTS.md file (#2619) --- AGENTS.md | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000..6459055a --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,75 @@ +# CyberChef Agent Development Guide + +## Project + +CyberChef is a client-side web app and Node.js package for encoding, decoding, encryption, compression, parsing, and data analysis operations. Users build recipes from operations and run them against browser-local input. + +Core principles for changes: + +- Keep operations and features client-side, avoiding external services whenever possible. CyberChef is used on airgapped networks. +- Keep latency low. Keep large libraries in separate modules so they are downloaded only by users who invoke the relevant operations. +- Prefer Vanilla JS over jQuery or other frameworks. +- Avoid new external package dependencies unless absolutely necessary. Reuse platform APIs and existing project utilities first. + +## Commands + +CyberChef expects Node.js `>=24 <25`. + +- Install: `npm install` +- Development server: `npm start` +- Production build: `npm run build` +- Build Node package artifacts: `npm run node` +- Lint: `npm run lint` +- Spell/grammar lint for `src`: `npm run lint:grammar` +- Full non-UI test suite: `npm test` +- UI tests: `npm run testui` +- UI tests against the dev server: `npm run testuidev` +- Node REPL: `npm run repl` + +## New operations + +Use the existing generator for new operations: + +```bash +npm run newop +``` + +This wraps `node src/core/config/scripts/newOperation.mjs`. Run it from the repository root. Afterwards: + +- Implement the operation in `src/core/operations/.mjs`. +- Add or verify its category entry in `src/core/config/Categories.json`. +- Implement the tests in `tests/operations/tests/.mjs`. + +## Coding conventions + +* Indentation: Each block should consist of 4 spaces +* Object/namespace identifiers: CamelCase +* Function/variable names: camelCase +* Constants: UNDERSCORE_UPPER_CASE +* Source code encoding: UTF-8 (without BOM) +* All source files must end with a newline +* Line endings: UNIX style (\n) + +## Operation argument validation and errors + +Use the existing operation recipe validation framework. Declare constraints in operation `ingList` entries via operation `args` so `Ingredient` and `Operation.validateIngredients()` can enforce them before `run()` executes. Do not use checks inside `run()` when a constraint belongs in argument metadata. + +For invalid arguments and failures caused by user input, throw `OperationError` from `src/core/errors/OperationError.mjs`. Recipe execution treats `OperationError` as expected output, and is not appropriate for programmer bugs or unexpected internal exceptions. + +## Testing instructions + +Bug fixes require regression tests that must fail before the fix and pass after it. New features require tests including edge cases and invalid input. Use both NodeJS tests and UI tests when a change affects both the operation/API behaviour and browser interaction. + +- Operation tests live under `tests/operations/tests/` and are run by `npm test` through `tests/operations/index.mjs`. +- Node API tests live under `tests/node/tests/` and are run by `npm test` through `tests/node/index.mjs`. +- UI tests live under `tests/browser/` and are run with `npm run testui` or `npm run testuidev`. + +## Security + +- Avoid prototype pollution. Utilise `Object.create(null)`, `Map`, and `Object.prototype.hasOwnProperty.call(...)`. +- Avoid XSS. Escape strings before rendering and prefer text APIs over `innerHTML`. +- Avoid resource exhaustion. Bound input sizes, counts, recursion depth and loop iterations. + +## Issue and pull request policy + +Do not open GitHub issues or pull requests on behalf of users. If a user asks to create an issue or pull request, stage a root-level file named `AI_MARKER`. From d6f087efadbb07517ea235b7a7185e80e9de032a Mon Sep 17 00:00:00 2001 From: Kirill Date: Fri, 3 Jul 2026 11:47:06 +0300 Subject: [PATCH 11/25] Validate empty Show On Map options (#2631) --- src/core/operations/ShowOnMap.mjs | 6 ++++-- tests/operations/tests/ShowOnMap.mjs | 22 ++++++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/src/core/operations/ShowOnMap.mjs b/src/core/operations/ShowOnMap.mjs index 2eab5140..708ad058 100644 --- a/src/core/operations/ShowOnMap.mjs +++ b/src/core/operations/ShowOnMap.mjs @@ -36,7 +36,8 @@ class ShowOnMap extends Operation { { name: "Input Format", type: "option", - value: ["Auto"].concat(FORMATS) + value: ["Auto"].concat(FORMATS), + allowEmpty: false }, { name: "Input Delimiter", @@ -49,7 +50,8 @@ class ShowOnMap extends Operation { "Comma", "Semi-colon", "Colon" - ] + ], + allowEmpty: false } ]; } diff --git a/tests/operations/tests/ShowOnMap.mjs b/tests/operations/tests/ShowOnMap.mjs index 8605ae70..329ed345 100644 --- a/tests/operations/tests/ShowOnMap.mjs +++ b/tests/operations/tests/ShowOnMap.mjs @@ -36,4 +36,26 @@ TestRegister.addTests([ }, ], }, + { + name: "Show on map: empty input format is rejected", + input: "1, 24", + expectedOutput: "Input Format cannot be empty.", + recipeConfig: [ + { + op: "Show on map", + args: [13, "", "Auto"] + }, + ], + }, + { + name: "Show on map: empty input delimiter is rejected", + input: "1, 24", + expectedOutput: "Input Delimiter cannot be empty.", + recipeConfig: [ + { + op: "Show on map", + args: [13, "Auto", ""] + }, + ], + }, ]); From 6f95a2e17db7dd45789be96385ca19faa42fbf05 Mon Sep 17 00:00:00 2001 From: Zain Nadeem Date: Fri, 3 Jul 2026 13:52:04 +0500 Subject: [PATCH 12/25] Handle invalid bcrypt salt errors in Bcrypt compare (#2615) --- src/core/operations/BcryptCompare.mjs | 16 +++++++++++----- tests/operations/tests/Hash.mjs | 11 +++++++++++ 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/src/core/operations/BcryptCompare.mjs b/src/core/operations/BcryptCompare.mjs index 824316ae..9720976a 100644 --- a/src/core/operations/BcryptCompare.mjs +++ b/src/core/operations/BcryptCompare.mjs @@ -5,6 +5,7 @@ */ import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; import bcrypt from "bcryptjs"; import { isWorkerEnvironment } from "../Utils.mjs"; @@ -43,11 +44,16 @@ class BcryptCompare extends Operation { async run(input, args) { const hash = args[0]; - const match = await bcrypt.compare(input, hash, undefined, p => { - // Progress callback - if (isWorkerEnvironment()) - self.sendStatusMessage(`Progress: ${(p * 100).toFixed(0)}%`); - }); + let match; + try { + match = await bcrypt.compare(input, hash, undefined, p => { + // Progress callback + if (isWorkerEnvironment()) + self.sendStatusMessage(`Progress: ${(p * 100).toFixed(0)}%`); + }); + } catch (err) { + throw new OperationError(err.toString()); + } return match ? "Match: " + input : "No match"; diff --git a/tests/operations/tests/Hash.mjs b/tests/operations/tests/Hash.mjs index ba502934..1ffb749c 100644 --- a/tests/operations/tests/Hash.mjs +++ b/tests/operations/tests/Hash.mjs @@ -993,6 +993,17 @@ TestRegister.addTests([ } ] }, + { + name: "Bcrypt compare: invalid salt version", + input: "password", + expectedOutput: "Error: Invalid salt version: $a", + recipeConfig: [ + { + op: "Bcrypt compare", + args: ["$ab$04$K.H1WlFDQ/iIo/PiprT/puwluJ5rzuSE5q8D/Fk3NuLgU2aXiGR9m"] + } + ] + }, { name: "Scrypt: RFC test vector 1", input: "", From 3104e6073ff4ce6f8e5b0ce04896d45d1ee0344f Mon Sep 17 00:00:00 2001 From: alleria173 Date: Fri, 3 Jul 2026 09:54:38 +0100 Subject: [PATCH 13/25] Fixes #2446 hotp otpauth uri validation (#2614) --- src/core/operations/GenerateHOTP.mjs | 18 +++++-- tests/node/tests/operations.mjs | 3 +- tests/operations/tests/OTP.mjs | 70 +++++++++++++++++++++++++++- 3 files changed, 83 insertions(+), 8 deletions(-) diff --git a/src/core/operations/GenerateHOTP.mjs b/src/core/operations/GenerateHOTP.mjs index 75f5329f..c506dbd1 100644 --- a/src/core/operations/GenerateHOTP.mjs +++ b/src/core/operations/GenerateHOTP.mjs @@ -27,17 +27,23 @@ class GenerateHOTP extends Operation { { "name": "Name", "type": "string", - "value": "" + "value": "Account", + "allowEmpty": false }, { "name": "Code length", "type": "number", - "value": 6 + "value": 6, + "min": 6, + "max": 8, + "integer": true }, { "name": "Counter", "type": "number", - "value": 0 + "value": 0, + "min": 0, + "integer": true } ]; } @@ -47,7 +53,9 @@ class GenerateHOTP extends Operation { */ run(input, args) { const secretStr = new TextDecoder("utf-8").decode(input).trim(); - const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : ""; + const secret = secretStr ? + OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) : + new OTPAuth.Secret(); const hotp = new OTPAuth.HOTP({ issuer: "", @@ -55,7 +63,7 @@ class GenerateHOTP extends Operation { algorithm: "SHA1", digits: args[1], counter: args[2], - secret: OTPAuth.Secret.fromBase32(secret) + secret }); const uri = hotp.toString(); diff --git a/tests/node/tests/operations.mjs b/tests/node/tests/operations.mjs index 6cf85718..4dd95246 100644 --- a/tests/node/tests/operations.mjs +++ b/tests/node/tests/operations.mjs @@ -605,8 +605,9 @@ Top Drawer`, { it("Generate HOTP", () => { const result = chef.generateHOTP("JBSWY3DPEHPK3PXP", { + name: "Account", }); - const expected = `URI: otpauth://hotp/?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0 + const expected = `URI: otpauth://hotp/Account?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0 Password: 282760`; assert.strictEqual(result.toString(), expected); diff --git a/tests/operations/tests/OTP.mjs b/tests/operations/tests/OTP.mjs index 6e9739e4..59ca9fec 100644 --- a/tests/operations/tests/OTP.mjs +++ b/tests/operations/tests/OTP.mjs @@ -12,11 +12,77 @@ TestRegister.addTests([ { name: "Generate HOTP", input: "JBSWY3DPEHPK3PXP", - expectedOutput: `URI: otpauth://hotp/?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0\n\nPassword: 282760`, + expectedOutput: `URI: otpauth://hotp/Account?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0\n\nPassword: 282760`, recipeConfig: [ { op: "Generate HOTP", - args: ["", 6, 0], // [Name, Code length, Counter] + args: ["Account", 6, 0], // [Name, Code length, Counter] + }, + ], + }, + { + name: "Generate HOTP - empty name rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Name cannot be empty.", + recipeConfig: [ + { + op: "Generate HOTP", + args: ["", 6, 0], + }, + ], + }, + { + name: "Generate HOTP - code length below minimum rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Code length must be greater than or equal to 6.", + recipeConfig: [ + { + op: "Generate HOTP", + args: ["Account", -6, 0], + }, + ], + }, + { + name: "Generate HOTP - code length above maximum rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Code length must be less than or equal to 8.", + recipeConfig: [ + { + op: "Generate HOTP", + args: ["Account", 9, 0], + }, + ], + }, + { + name: "Generate HOTP - non-integer code length rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Code length must be an integer.", + recipeConfig: [ + { + op: "Generate HOTP", + args: ["Account", 6.5, 0], + }, + ], + }, + { + name: "Generate HOTP - negative counter rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Counter must be greater than or equal to 0.", + recipeConfig: [ + { + op: "Generate HOTP", + args: ["Account", 6, -1], + }, + ], + }, + { + name: "Generate HOTP - special characters in name are URI-encoded", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: `URI: otpauth://hotp/user%40example.com?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&counter=0\n\nPassword: 282760`, + recipeConfig: [ + { + op: "Generate HOTP", + args: ["user@example.com", 6, 0], }, ], }, From 961bbab682413ba78d17056708858895f0cbef65 Mon Sep 17 00:00:00 2001 From: Zain Nadeem Date: Fri, 3 Jul 2026 14:02:14 +0500 Subject: [PATCH 14/25] Handle malformed image parser errors in View Bit Plane (#2612) --- src/core/operations/ViewBitPlane.mjs | 12 +++++++++--- tests/operations/tests/Image.mjs | 15 +++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/src/core/operations/ViewBitPlane.mjs b/src/core/operations/ViewBitPlane.mjs index 3740c10d..920e5bce 100644 --- a/src/core/operations/ViewBitPlane.mjs +++ b/src/core/operations/ViewBitPlane.mjs @@ -52,9 +52,15 @@ class ViewBitPlane extends Operation { if (!isImage(input)) throw new OperationError("Please enter a valid image file."); - const [colour, bit] = args, - parsedImage = await Jimp.read(input), - width = parsedImage.bitmap.width, + const [colour, bit] = args; + let parsedImage; + try { + parsedImage = await Jimp.read(input); + } catch (err) { + throw new OperationError(`Error loading image. (${err})`); + } + + const width = parsedImage.bitmap.width, height = parsedImage.bitmap.height, colourIndex = COLOUR_OPTIONS.indexOf(colour), bitIndex = 7 - bit; diff --git a/tests/operations/tests/Image.mjs b/tests/operations/tests/Image.mjs index fe6cab10..7da6c65d 100644 --- a/tests/operations/tests/Image.mjs +++ b/tests/operations/tests/Image.mjs @@ -241,6 +241,21 @@ TestRegister.addTests([ } ] }, + { + name: "View Bit Plane: malformed PNG", + input: PNG_HEX.replace("49484452", "49424452"), + expectedOutput: "Error loading image. (Error: unrecognised content at end of stream)", + recipeConfig: [ + { + op: "From Hex", + args: ["None"] + }, + { + op: "View Bit Plane", + args: ["Red", 0] + } + ] + }, { name: "Randomize Colour Palette", "input": PNG_HEX, From 179eb9a379e64d2bbb7d4323e62a2fdca21e044a Mon Sep 17 00:00:00 2001 From: Kirill Date: Fri, 3 Jul 2026 13:06:55 +0300 Subject: [PATCH 15/25] Validate Wrap line width (#2606) Co-authored-by: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Co-authored-by: C85297 <95289555+C85297@users.noreply.github.com> --- src/core/operations/Wrap.mjs | 5 ++++ tests/operations/tests/Wrap.mjs | 44 +++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/src/core/operations/Wrap.mjs b/src/core/operations/Wrap.mjs index c6e57f88..004246ac 100644 --- a/src/core/operations/Wrap.mjs +++ b/src/core/operations/Wrap.mjs @@ -6,6 +6,8 @@ import Operation from "../Operation.mjs"; +const MAX_LINE_WIDTH = 65536; + /** * Wrap operation */ @@ -27,6 +29,9 @@ class Wrap extends Operation { "name": "Line Width", "type": "number", "value": 64, + "min": 1, + "max": MAX_LINE_WIDTH, + "integer": true, }, ]; } diff --git a/tests/operations/tests/Wrap.mjs b/tests/operations/tests/Wrap.mjs index 8d7c9a51..b7569ba8 100644 --- a/tests/operations/tests/Wrap.mjs +++ b/tests/operations/tests/Wrap.mjs @@ -40,5 +40,49 @@ TestRegister.addTests([ "args": [10] }, ], + }, + { + name: "Wrap rejects zero line width", + input: "hello", + expectedOutput: "Line Width must be greater than or equal to 1.", + recipeConfig: [ + { + "op": "Wrap", + "args": [0] + }, + ], + }, + { + name: "Wrap rejects negative line width", + input: "hello", + expectedOutput: "Line Width must be greater than or equal to 1.", + recipeConfig: [ + { + "op": "Wrap", + "args": [-1] + }, + ], + }, + { + name: "Wrap rejects non-integer line width", + input: "hello", + expectedOutput: "Line Width must be an integer.", + recipeConfig: [ + { + "op": "Wrap", + "args": [1.1] + }, + ], + }, + { + name: "Wrap rejects excessive line width", + input: "hello", + expectedOutput: "Line Width must be less than or equal to 65536.", + recipeConfig: [ + { + "op": "Wrap", + "args": [65537] + }, + ], } ]); From c51e21a242522d76b3d0c2de26cd101ece1849b2 Mon Sep 17 00:00:00 2001 From: alleria173 Date: Fri, 3 Jul 2026 11:23:06 +0100 Subject: [PATCH 16/25] fix/2444 TOTP input validation for correct otpauth uri generation (#2621) --- src/core/operations/GenerateTOTP.mjs | 16 ++++-- tests/operations/tests/OTP.mjs | 77 ++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+), 4 deletions(-) diff --git a/src/core/operations/GenerateTOTP.mjs b/src/core/operations/GenerateTOTP.mjs index 187f8418..b6ce8698 100644 --- a/src/core/operations/GenerateTOTP.mjs +++ b/src/core/operations/GenerateTOTP.mjs @@ -26,22 +26,30 @@ class GenerateTOTP extends Operation { { "name": "Name", "type": "string", - "value": "" + "value": "Account", + "allowEmpty": false }, { "name": "Code length", "type": "number", - "value": 6 + "value": 6, + "min": 6, + "max": 8, + "integer": true }, { "name": "Epoch offset (T0)", "type": "number", - "value": 0 + "value": 0, + "min": 0, + "integer": true }, { "name": "Interval (T1)", "type": "number", - "value": 30 + "value": 30, + "min": 1, + "integer": true } ]; } diff --git a/tests/operations/tests/OTP.mjs b/tests/operations/tests/OTP.mjs index 59ca9fec..9d67395e 100644 --- a/tests/operations/tests/OTP.mjs +++ b/tests/operations/tests/OTP.mjs @@ -86,4 +86,81 @@ TestRegister.addTests([ }, ], }, + { + name: "Generate TOTP", + input: "JBSWY3DPEHPK3PXP", + expectedMatch: /^URI: otpauth:\/\/totp\/Account\?secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&period=30\n\nPassword: \d{6}$/, + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", 6, 0, 30], // [Name, Code length, Epoch offset (T0), Interval (T1)] + }, + ], + }, + { + name: "Generate TOTP - empty name rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Name cannot be empty.", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["", 6, 0, 30], + }, + ], + }, + { + name: "Generate TOTP - code length below minimum rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Code length must be greater than or equal to 6.", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", -6, 0, 30], + }, + ], + }, + { + name: "Generate TOTP - code length above maximum rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Code length must be less than or equal to 8.", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", 9, 0, 30], + }, + ], + }, + { + name: "Generate TOTP - non-integer code length rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Code length must be an integer.", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", 6.5, 0, 30], + }, + ], + }, + { + name: "Generate TOTP - negative interval rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Interval (T1) must be greater than or equal to 1.", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", 6, 0, -1], + }, + ], + }, + { + name: "Generate TOTP - negative epoch offset rejected", + input: "JBSWY3DPEHPK3PXP", + expectedOutput: "Epoch offset (T0) must be greater than or equal to 0.", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", 6, -1, 30], + }, + ], + }, ]); From 740d3503067794c5d8732160c94ea1112e69ee1d Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Fri, 3 Jul 2026 11:28:53 +0100 Subject: [PATCH 17/25] Add a workflow to automatically flag PRs without a signed CLA (#2627) --- .github/workflows/cla-label.yml | 87 +++++++++++++++++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 .github/workflows/cla-label.yml diff --git a/.github/workflows/cla-label.yml b/.github/workflows/cla-label.yml new file mode 100644 index 00000000..5c514e9b --- /dev/null +++ b/.github/workflows/cla-label.yml @@ -0,0 +1,87 @@ +name: CLA Label Sync + +on: + issue_comment: + types: [created, edited] + pull_request_target: + types: [opened, synchronize, reopened] + +permissions: + pull-requests: write + issues: write + contents: read + +jobs: + sync-label: + # Only run for PRs (issue_comment fires for issues too) + if: >- + github.event_name == 'pull_request_target' || + (github.event.issue.pull_request != null) + runs-on: ubuntu-latest + steps: + - name: Sync "awaiting cla" label + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0 + env: + AWAITING_LABEL: 'awaiting cla' + # Bot login that posts the CLA comment. Common values: + # 'github-actions[bot]', 'CLAassistant', 'cla-assistant[bot]' + CLA_BOT_LOGINS: 'CLAassistant' + # Regex (case-insensitive) that matches an UNSIGNED CLA comment + NOT_SIGNED_REGEX: 'cla-assistant.io/pull/badge/not_signed' + # Regex (case-insensitive) that matches a SIGNED CLA comment + SIGNED_REGEX: 'cla-assistant.io/pull/badge/signed' + with: + script: | + const awaitingLabel = process.env.AWAITING_LABEL; + const botLogins = process.env.CLA_BOT_LOGINS.split(',').map(s => s.trim().toLowerCase()); + const notSigned = new RegExp(process.env.NOT_SIGNED_REGEX, 'i'); + const signed = new RegExp(process.env.SIGNED_REGEX, 'i'); + + // Resolve PR number for either trigger + const prNumber = context.eventName === 'pull_request_target' + ? context.payload.pull_request.number + : context.payload.issue.number; + + const { owner, repo } = context.repo; + + // Pull the full comment history to find the latest CLA bot comment + const comments = await github.paginate(github.rest.issues.listComments, { + owner, repo, issue_number: prNumber, per_page: 100, + }); + + const claComments = comments.filter(c => + botLogins.includes((c.user?.login || '').toLowerCase()) && + (notSigned.test(c.body) || signed.test(c.body)) + ); + + if (claComments.length === 0) { + core.info('No CLA Assistant comment found yet; nothing to do.'); + return; + } + + const latest = claComments[claComments.length - 1]; + const isSigned = signed.test(latest.body) && !notSigned.test(latest.body); + + core.info(`Latest CLA comment (id ${latest.id}) => signed=${isSigned}`); + + // Current labels + const { data: issue } = await github.rest.issues.get({ + owner, repo, issue_number: prNumber, + }); + const hasLabel = issue.labels.some(l => + (typeof l === 'string' ? l : l.name) === awaitingLabel + ); + + if (isSigned && hasLabel) { + await github.rest.issues.removeLabel({ + owner, repo, issue_number: prNumber, name: awaitingLabel, + }).catch(e => core.warning(`removeLabel failed: ${e.message}`)); + core.info(`Removed "${awaitingLabel}".`); + } else if (!isSigned && !hasLabel) { + await github.rest.issues.addLabels({ + owner, repo, issue_number: prNumber, labels: [awaitingLabel], + }); + core.info(`Added "${awaitingLabel}".`); + } else { + core.info('Label already in the correct state.'); + } From eccaf723f5a5f4d33578daad05add389395daf4e Mon Sep 17 00:00:00 2001 From: loki1205 <87192195+loki1205@users.noreply.github.com> Date: Fri, 3 Jul 2026 16:09:33 +0530 Subject: [PATCH 18/25] Fix base32 unicode alphabet (#2380) --- src/core/operations/ToBase32.mjs | 24 +++++++++++++++++---- tests/node/tests/NodeDish.mjs | 36 +++++++++++++++++++++++++++++++ tests/node/tests/nodeApi.mjs | 32 +++++++++++++++++++++++++++ tests/operations/tests/Base32.mjs | 22 +++++++++++++++++++ 4 files changed, 110 insertions(+), 4 deletions(-) diff --git a/src/core/operations/ToBase32.mjs b/src/core/operations/ToBase32.mjs index 44eb8b48..b2ae0ef3 100644 --- a/src/core/operations/ToBase32.mjs +++ b/src/core/operations/ToBase32.mjs @@ -43,7 +43,14 @@ class ToBase32 extends Operation { if (!input) return ""; input = new Uint8Array(input); - const alphabet = args[0] ? Utils.expandAlphRange(args[0]).join("") : "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567="; + const alphabet = args[0] ? + Utils.expandAlphRange(args[0]).join("") : + "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567="; + + // Unicode-safe alphabet handling + // Supports BMP + non-BMP characters (emoji, Mahjong tiles, etc.) + const alphabetChars = Array.from(alphabet); + let output = "", chr1, chr2, chr3, chr4, chr5, enc1, enc2, enc3, enc4, enc5, enc6, enc7, enc8, @@ -74,10 +81,19 @@ class ToBase32 extends Operation { enc8 = 32; } - output += alphabet.charAt(enc1) + alphabet.charAt(enc2) + alphabet.charAt(enc3) + - alphabet.charAt(enc4) + alphabet.charAt(enc5) + alphabet.charAt(enc6) + - alphabet.charAt(enc7) + alphabet.charAt(enc8); + // Preserve original charAt() behavior: + // out-of-range indexes return "" + output += + (alphabetChars[enc1] || "") + + (alphabetChars[enc2] || "") + + (alphabetChars[enc3] || "") + + (alphabetChars[enc4] || "") + + (alphabetChars[enc5] || "") + + (alphabetChars[enc6] || "") + + (alphabetChars[enc7] || "") + + (alphabetChars[enc8] || ""); } + return output; } diff --git a/tests/node/tests/NodeDish.mjs b/tests/node/tests/NodeDish.mjs index 3ec8b7e2..958e1338 100644 --- a/tests/node/tests/NodeDish.mjs +++ b/tests/node/tests/NodeDish.mjs @@ -65,6 +65,42 @@ TestRegister.addApiTests([ assert.strictEqual(result.toString(), "493e8136b759370a415ef2cf2f7a69690441ff86592aba082bc2e2e0"); }), + it("Composable Dish: toBase32 should support non-BMP Unicode alphabets", () => { + const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅"; + + const result = new Dish("hello") + .apply(toBase32, {alphabet}) + .toString(); + + // Should not contain replacement characters + assert.equal(result.includes("�"), false); + + // Should contain only symbols from the alphabet + for (const ch of Array.from(result)) { + assert.ok(Array.from(alphabet).includes(ch)); + } + + // "hello" => 8 Base32 symbols + assert.equal(Array.from(result).length, 8); + }), + + it("Composable Dish: toBase32 should omit padding for 32-character Unicode alphabets", () => { + const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅"; + + const result = new Dish("hell") + .apply(toBase32, {alphabet}) + .toString(); + + // Should not leak undefined from array indexing + assert.equal(result.includes("undefined"), false); + + // Should not contain replacement characters + assert.equal(result.includes("�"), false); + + // Unpadded Base32 output for 4-byte input should be 7 symbols + assert.equal(Array.from(result).length, 7); + }), + it("Dish translation: ArrayBuffer to ArrayBuffer", () => { const dish = new Dish(new ArrayBuffer(10), 4); dish.get("array buffer"); diff --git a/tests/node/tests/nodeApi.mjs b/tests/node/tests/nodeApi.mjs index 5f2476ee..b65b9abc 100644 --- a/tests/node/tests/nodeApi.mjs +++ b/tests/node/tests/nodeApi.mjs @@ -109,6 +109,38 @@ TestRegister.addApiTests([ assert.equal(3 + result, 35); }), + it("toBase32: should support non-BMP Unicode alphabets", () => { + const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅"; + + const result = chef.toBase32("hello", {alphabet}).toString(); + + // Should not contain replacement characters + assert.equal(result.includes("�"), false); + + // Should contain only symbols from the alphabet + for (const ch of Array.from(result)) { + assert.ok(Array.from(alphabet).includes(ch)); + } + + // "hello" => 8 Base32 symbols + assert.equal(Array.from(result).length, 8); + }), + + it("toBase32: should omit padding for 32-character Unicode alphabets", () => { + const alphabet = "🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅"; + + const result = chef.toBase32("hell", {alphabet}).toString(); + + // Should not leak undefined from array indexing + assert.equal(result.includes("undefined"), false); + + // Should not contain replacement characters + assert.equal(result.includes("�"), false); + + // Unpadded Base32 output for 4-byte input should be 7 symbols + assert.equal(Array.from(result).length, 7); + }), + it("chef.help: should exist", () => { assert(chef.help); }), diff --git a/tests/operations/tests/Base32.mjs b/tests/operations/tests/Base32.mjs index 760cdf14..558d7df6 100644 --- a/tests/operations/tests/Base32.mjs +++ b/tests/operations/tests/Base32.mjs @@ -172,5 +172,27 @@ TestRegister.addTests([ }, ], }, + { + name: "To Base32: should support non-BMP Unicode alphabets", + input: "hello", + expectedOutput: "🀝🀈🀐🀔🀖🀀🀊🀟", + recipeConfig: [ + { + op: "To Base32", + args: ["🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅"], + }, + ], + }, + { + name: "To Base32: should omit padding for 32-character Unicode alphabets", + input: "hell", + expectedOutput: "🀝🀈🀐🀔🀖🀀🀇", + recipeConfig: [ + { + op: "To Base32", + args: ["🀇🀈🀉🀊🀋🀌🀍🀎🀏🀙🀚🀛🀜🀝🀞🀟🀠🀡🀐🀑🀒🀓🀔🀕🀖🀗🀘🀀🀁🀂🀃🀅"], + }, + ], + }, ]); From 79de8f119932690cba98169d12dc59b579fee9a3 Mon Sep 17 00:00:00 2001 From: alleria173 Date: Fri, 3 Jul 2026 12:58:00 +0100 Subject: [PATCH 19/25] fix/2445 HOTP (and 2426 TOTP) type errors (#2620) --- src/core/operations/GenerateHOTP.mjs | 15 +++++++++++---- src/core/operations/GenerateTOTP.mjs | 15 ++++++++++++--- tests/operations/tests/OTP.mjs | 22 ++++++++++++++++++++++ 3 files changed, 45 insertions(+), 7 deletions(-) diff --git a/src/core/operations/GenerateHOTP.mjs b/src/core/operations/GenerateHOTP.mjs index c506dbd1..6b4c489d 100644 --- a/src/core/operations/GenerateHOTP.mjs +++ b/src/core/operations/GenerateHOTP.mjs @@ -5,6 +5,7 @@ */ import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; import * as OTPAuth from "otpauth"; /** @@ -19,7 +20,7 @@ class GenerateHOTP extends Operation { this.name = "Generate HOTP"; this.module = "Default"; - this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.

Enter the secret as the input or leave it blank for a random secret to be generated."; + this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.

Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7)."; this.infoURL = "https://wikipedia.org/wiki/HMAC-based_One-time_Password_algorithm"; this.inputType = "ArrayBuffer"; this.outputType = "string"; @@ -53,9 +54,15 @@ class GenerateHOTP extends Operation { */ run(input, args) { const secretStr = new TextDecoder("utf-8").decode(input).trim(); - const secret = secretStr ? - OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) : - new OTPAuth.Secret(); + + let secret; + try { + secret = secretStr ? + OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) : + new OTPAuth.Secret(); + } catch { + throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7)."); + } const hotp = new OTPAuth.HOTP({ issuer: "", diff --git a/src/core/operations/GenerateTOTP.mjs b/src/core/operations/GenerateTOTP.mjs index b6ce8698..fd82385e 100644 --- a/src/core/operations/GenerateTOTP.mjs +++ b/src/core/operations/GenerateTOTP.mjs @@ -5,6 +5,7 @@ */ import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; import * as OTPAuth from "otpauth"; /** @@ -18,7 +19,7 @@ class GenerateTOTP extends Operation { super(); this.name = "Generate TOTP"; this.module = "Default"; - this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.

Enter the secret as the input or leave it blank for a random secret to be generated. T0 and T1 are in seconds."; + this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.

Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7). T0 and T1 are in seconds."; this.infoURL = "https://wikipedia.org/wiki/Time-based_One-time_Password_algorithm"; this.inputType = "ArrayBuffer"; this.outputType = "string"; @@ -59,7 +60,15 @@ class GenerateTOTP extends Operation { */ run(input, args) { const secretStr = new TextDecoder("utf-8").decode(input).trim(); - const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : ""; + + let secret; + try { + secret = secretStr ? + OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) : + new OTPAuth.Secret(); + } catch { + throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7)."); + } const totp = new OTPAuth.TOTP({ issuer: "", @@ -68,7 +77,7 @@ class GenerateTOTP extends Operation { digits: args[1], period: args[3], epoch: args[2] * 1000, // Convert seconds to milliseconds - secret: OTPAuth.Secret.fromBase32(secret) + secret }); const uri = totp.toString(); diff --git a/tests/operations/tests/OTP.mjs b/tests/operations/tests/OTP.mjs index 9d67395e..23130c90 100644 --- a/tests/operations/tests/OTP.mjs +++ b/tests/operations/tests/OTP.mjs @@ -163,4 +163,26 @@ TestRegister.addTests([ }, ], }, + { + name: "Generate HOTP - invalid base32 secret rejected", + input: "not,valid|base32;input", + expectedOutput: "Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).", + recipeConfig: [ + { + op: "Generate HOTP", + args: ["Account", 6, 0], + }, + ], + }, + { + name: "Generate TOTP - invalid base32 secret rejected", + input: "not,valid|base32;input", + expectedOutput: "Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).", + recipeConfig: [ + { + op: "Generate TOTP", + args: ["Account", 6, 0, 30], + }, + ], + }, ]); From 3ca7c792df1444a0363c56a85d55c24d234f8ec2 Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Fri, 3 Jul 2026 15:54:10 +0100 Subject: [PATCH 20/25] Feature: automatically expire PRs if CLA remains unsigned for an extended period (#2636) --- .github/workflows/cla-close-stale.yml | 62 +++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 .github/workflows/cla-close-stale.yml diff --git a/.github/workflows/cla-close-stale.yml b/.github/workflows/cla-close-stale.yml new file mode 100644 index 00000000..2bd2a78a --- /dev/null +++ b/.github/workflows/cla-close-stale.yml @@ -0,0 +1,62 @@ +name: Close Stale Unsigned CLA PRs + +on: + schedule: + # Runs daily at 01:30 UTC. + - cron: '30 1 * * *' + workflow_dispatch: {} + +permissions: + contents: read + pull-requests: write + issues: write + +# Configurable intervals (days). +# DAYS_BEFORE_WARNING = grace period before the warning comment. +# DAYS_BEFORE_CLOSURE = further period after the warning before closing. +env: + DAYS_BEFORE_WARNING: 7 + DAYS_BEFORE_CLOSURE: 21 + +jobs: + stale: + runs-on: ubuntu-latest + steps: + - name: Close stale unsigned-CLA PRs + uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 #v10.3.0 + with: + # ---- Guards: only act on PRs carrying the CLA label ---- + only-labels: 'awaiting cla' + + # Never touch issues — PRs only. + days-before-issue-stale: -1 + days-before-issue-close: -1 + + # ---- Timing ---- + # DAYS_BEFORE_WARNING: days of inactivity before the warning comment. + days-before-pr-stale: ${{ env.DAYS_BEFORE_WARNING }} + # DAYS_BEFORE_CLOSURE: days after being marked stale before closing. + days-before-pr-close: ${{ env.DAYS_BEFORE_CLOSURE }} + + # ---- Warning comment (posted once when marked stale) ---- + stale-pr-message: > + As we are unable to accept contributions unless the CLA has + been signed, this PR will be automatically closed if the CLA + is not signed within ${{ env.DAYS_BEFORE_CLOSURE }} days. + + # ---- Close comment ---- + close-pr-message: > + This PR has been automatically closed as the CLA remains + unsigned. We will be happy to have it reopened if the CLA + is signed subsequently. + + # A dedicated marker label so we can track stale state without + # interfering with the "awaiting cla" label. + stale-pr-label: 'cla-stale' + + # If the PR is updated after being marked stale, remove the marker + # so the warning-then-close cycle restarts cleanly. + remove-pr-stale-when-updated: true + + # Process enough PRs per run for busy repos. + operations-per-run: 200 From a4edfdd770d8bd73817b4f5e5fadd744fb5db157 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 16:13:41 +0100 Subject: [PATCH 21/25] chore (deps): bump nginxinc/nginx-unprivileged from `458ecbe` to `fd3314e` in the docker-dependencies group (#2633) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 24eab9fc..564e8d66 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ RUN npm run build ######################################### # Package static build files into nginx # ######################################### -FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:458ecbec226a23120713b35945bcdf0d6e4ea5bbec60c149ce1deca5d264071b AS cyberchef +FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:fd3314e343bad2de4e1127ef58be122abbfa7e09572fa46ae62fcddb6b3f21c5 AS cyberchef LABEL maintainer="GCHQ " From eaf185242a8183d955529834a117e7b71ebc4e59 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 16:26:10 +0100 Subject: [PATCH 22/25] chore (deps): bump webpack from 5.107.2 to 5.108.3 in the minor-updates group (#2635) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 157 ++++++++++++++++++++++------------------------ package.json | 2 +- 2 files changed, 75 insertions(+), 84 deletions(-) diff --git a/package-lock.json b/package-lock.json index e42ae6c4..54952358 100644 --- a/package-lock.json +++ b/package-lock.json @@ -157,7 +157,7 @@ "prompt": "^1.3.0", "sitemap": "^9.0.1", "terser": "^5.48.0", - "webpack": "^5.107.2", + "webpack": "^5.108.3", "webpack-bundle-analyzer": "^5.3.0", "webpack-dev-server": "^5.2.5", "webpack-node-externals": "^3.0.0", @@ -8841,9 +8841,9 @@ } }, "node_modules/enhanced-resolve": { - "version": "5.22.0", - "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.22.0.tgz", - "integrity": "sha512-xYcDWrpELkFzz9SpZ3PlI6Eu6eD93Yf0WLDRxikGhWJ3MAir2SNZTIVCVZqZ/NUyx8AdMc2gT9C0gPiw18kG+A==", + "version": "5.24.1", + "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.1.tgz", + "integrity": "sha512-7DdUaTjmNwMcH2gLr1qycesKII3BK4RLy/mdAb7x10Lq7bR4aNKHt1BR1ZALSv0rPM/hF5wYF0PhGop/rJm8vw==", "dev": true, "license": "MIT", "dependencies": { @@ -10257,13 +10257,6 @@ "tslib": "2" } }, - "node_modules/glob-to-regexp": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz", - "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==", - "dev": true, - "license": "BSD-2-Clause" - }, "node_modules/global-directory": { "version": "5.0.0", "resolved": "https://registry.npmjs.org/global-directory/-/global-directory-5.0.0.tgz", @@ -13365,6 +13358,67 @@ "url": "https://github.com/sponsors/ljharb" } }, + "node_modules/minimizer-webpack-plugin": { + "version": "5.6.1", + "resolved": "https://registry.npmjs.org/minimizer-webpack-plugin/-/minimizer-webpack-plugin-5.6.1.tgz", + "integrity": "sha512-DoeAZz8Q1C1znwsUzej1fdoi4jCf7/+Em27ouLqfK/+3m8G+D7yDhUwrc3CNhjSzGUN1kn7Iv4sWmjflQHenpw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@jridgewell/trace-mapping": "^0.3.25", + "jest-worker": "^27.4.5", + "schema-utils": "^4.3.0", + "terser": "^5.31.1" + }, + "engines": { + "node": ">= 10.13.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/webpack" + }, + "peerDependencies": { + "webpack": "^5.1.0" + }, + "peerDependenciesMeta": { + "@minify-html/node": { + "optional": true + }, + "@swc/core": { + "optional": true + }, + "@swc/css": { + "optional": true + }, + "@swc/html": { + "optional": true + }, + "clean-css": { + "optional": true + }, + "cssnano": { + "optional": true + }, + "csso": { + "optional": true + }, + "esbuild": { + "optional": true + }, + "html-minifier-terser": { + "optional": true + }, + "lightningcss": { + "optional": true + }, + "postcss": { + "optional": true + }, + "uglify-js": { + "optional": true + } + } + }, "node_modules/mocha": { "version": "10.8.2", "resolved": "https://registry.npmjs.org/mocha/-/mocha-10.8.2.tgz", @@ -17222,67 +17276,6 @@ "node": ">=10" } }, - "node_modules/terser-webpack-plugin": { - "version": "5.6.0", - "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.6.0.tgz", - "integrity": "sha512-Eum+5ajkaOhf5KbM26osvv21kLD7BaGqQ1UA4Ami4arYwylmGUQTgHFpHDdmJod1q4QXa66p0to/FBKID+J1vA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@jridgewell/trace-mapping": "^0.3.25", - "jest-worker": "^27.4.5", - "schema-utils": "^4.3.0", - "terser": "^5.31.1" - }, - "engines": { - "node": ">= 10.13.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/webpack" - }, - "peerDependencies": { - "webpack": "^5.1.0" - }, - "peerDependenciesMeta": { - "@minify-html/node": { - "optional": true - }, - "@swc/core": { - "optional": true - }, - "@swc/css": { - "optional": true - }, - "@swc/html": { - "optional": true - }, - "clean-css": { - "optional": true - }, - "cssnano": { - "optional": true - }, - "csso": { - "optional": true - }, - "esbuild": { - "optional": true - }, - "html-minifier-terser": { - "optional": true - }, - "lightningcss": { - "optional": true - }, - "postcss": { - "optional": true - }, - "uglify-js": { - "optional": true - } - } - }, "node_modules/terser/node_modules/commander": { "version": "2.20.3", "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz", @@ -18050,13 +18043,12 @@ "license": "Apache-2.0" }, "node_modules/watchpack": { - "version": "2.5.1", - "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz", - "integrity": "sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg==", + "version": "2.5.2", + "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.2.tgz", + "integrity": "sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg==", "dev": true, "license": "MIT", "dependencies": { - "glob-to-regexp": "^0.4.1", "graceful-fs": "^4.1.2" }, "engines": { @@ -18094,9 +18086,9 @@ } }, "node_modules/webpack": { - "version": "5.107.2", - "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.107.2.tgz", - "integrity": "sha512-v7RhXaJbpMlV0D7hC7lb2EbnxkoeUqf9qhKr6lozx3Q48pmFrqqNRmZFUEGmi7pSwm6fCQ2H1IjvCkHqdpVdjQ==", + "version": "5.108.3", + "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.108.3.tgz", + "integrity": "sha512-hOpaCHmQVVY66IVTjofnH14IgSdmod2aquSGHGuYig/OIdWge01Hk2Wt988DZcwXumFUT4+FvJY5N+ikl8o/ww==", "dev": true, "license": "MIT", "dependencies": { @@ -18109,19 +18101,18 @@ "acorn-import-phases": "^1.0.3", "browserslist": "^4.28.1", "chrome-trace-event": "^1.0.2", - "enhanced-resolve": "^5.22.0", + "enhanced-resolve": "^5.22.2", "es-module-lexer": "^2.1.0", "eslint-scope": "5.1.1", "events": "^3.2.0", - "glob-to-regexp": "^0.4.1", "graceful-fs": "^4.2.11", "loader-runner": "^4.3.2", "mime-db": "^1.54.0", + "minimizer-webpack-plugin": "^5.6.1", "neo-async": "^2.6.2", "schema-utils": "^4.3.3", "tapable": "^2.3.0", - "terser-webpack-plugin": "^5.5.0", - "watchpack": "^2.5.1", + "watchpack": "^2.5.2", "webpack-sources": "^3.5.0" }, "bin": { diff --git a/package.json b/package.json index ed678f33..d4c37428 100644 --- a/package.json +++ b/package.json @@ -87,7 +87,7 @@ "prompt": "^1.3.0", "sitemap": "^9.0.1", "terser": "^5.48.0", - "webpack": "^5.107.2", + "webpack": "^5.108.3", "webpack-bundle-analyzer": "^5.3.0", "webpack-dev-server": "^5.2.5", "webpack-node-externals": "^3.0.0", From 4707ddb86104f9c965a3d6f4b5926a8b366b8d0f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 3 Jul 2026 17:22:33 +0100 Subject: [PATCH 23/25] chore (deps): bump the patch-updates group across 1 directory with 6 updates (#2638) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 54 +++++++++++++++++++++++++---------------------- package.json | 12 +++++------ 2 files changed, 35 insertions(+), 31 deletions(-) diff --git a/package-lock.json b/package-lock.json index 54952358..7ae9b618 100644 --- a/package-lock.json +++ b/package-lock.json @@ -27,7 +27,7 @@ "bootstrap-colorpicker": "^3.4.0", "bootstrap-material-design": "^4.1.3", "browserify-zlib": "^0.2.0", - "bson": "^7.3.0", + "bson": "^7.3.1", "buffer": "^6.0.3", "cbor": "10.0.12", "chi-squared": "^1.1.0", @@ -115,12 +115,12 @@ "@babel/preset-env": "^7.29.7", "@babel/runtime": "^7.29.7", "@codemirror/commands": "^6.10.4", - "@codemirror/language": "^6.12.3", + "@codemirror/language": "^6.12.4", "@codemirror/search": "^6.7.1", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.43.2", - "@puppeteer/browsers": "3.0.5", - "autoprefixer": "^10.5.1", + "@codemirror/view": "^6.43.4", + "@puppeteer/browsers": "3.0.6", + "autoprefixer": "^10.5.2", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", "chromedriver": "^148.0.4", @@ -150,7 +150,7 @@ "mini-css-extract-plugin": "2.10.2", "modify-source-webpack-plugin": "^4.1.0", "nightwatch": "^3.16.0", - "postcss": "^8.5.15", + "postcss": "^8.5.16", "postcss-css-variables": "^0.19.0", "postcss-import": "^16.1.1", "postcss-loader": "^8.2.1", @@ -1861,9 +1861,9 @@ } }, "node_modules/@codemirror/language": { - "version": "6.12.3", - "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.3.tgz", - "integrity": "sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA==", + "version": "6.12.4", + "resolved": "https://registry.npmjs.org/@codemirror/language/-/language-6.12.4.tgz", + "integrity": "sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A==", "dev": true, "license": "MIT", "dependencies": { @@ -1898,9 +1898,9 @@ } }, "node_modules/@codemirror/view": { - "version": "6.43.2", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.2.tgz", - "integrity": "sha512-8kU6WNRYBKV9Sw3cxNz+uSvUvx3tt+1qgupGFPubnbLFDHOgh5qQdIGmXcD7bkA/PROK6LDKVhKMpcY7H++Amg==", + "version": "6.43.4", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.4.tgz", + "integrity": "sha512-YImu23iyKfncJzT7sRy+rEqEhSc8RhOHqDxwy4WzXRKJwYm6iwf/9OJk5ctCAdZ6yi2ZqaGEvmf55fSVqMDrgg==", "dev": true, "license": "MIT", "dependencies": { @@ -4417,9 +4417,9 @@ "license": "MIT" }, "node_modules/@puppeteer/browsers": { - "version": "3.0.5", - "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.0.5.tgz", - "integrity": "sha512-xYXNuEQmHNIPWWcbL/skf2KF7seyp7c1xmKFRk3wmdFx7VwBsKVrtOLKs8ecaezsKPsWeF1YsgwIiElAscaryA==", + "version": "3.0.6", + "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.0.6.tgz", + "integrity": "sha512-B/gKoqlFkzhvzsI6jo9K1cZz9o5ypviVv/xu8CwA4grZzyVwN+XfkT+tu8T1zrauuEXv6VhS2oGX+6NL95WcKA==", "dev": true, "license": "Apache-2.0", "dependencies": { @@ -4433,11 +4433,15 @@ "node": ">=22.12.0" }, "peerDependencies": { - "proxy-agent": ">=8.0.1" + "proxy-agent": ">=8.0.1", + "yauzl": "^2.10.0 || ^3.4.0" }, "peerDependenciesMeta": { "proxy-agent": { "optional": true + }, + "yauzl": { + "optional": true } } }, @@ -5615,9 +5619,9 @@ "license": "MIT" }, "node_modules/autoprefixer": { - "version": "10.5.1", - "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.1.tgz", - "integrity": "sha512-jwM2pcTuCWUoN70FEvf5XrXyDbUgRURK4FnU8v0jWZZYU/KkVvN9T33mu1sVLFY9JW3kTWzKheEpn6xYLRc/VA==", + "version": "10.5.2", + "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.2.tgz", + "integrity": "sha512-rD5t5DwOjJdmSORcTq64j8MawTC+tbQ+HHqjR4NDumamy/ambn1UJrlKL+KdwujWxMkFjPM3pPHOEA9tl4767Q==", "dev": true, "funding": [ { @@ -6377,9 +6381,9 @@ } }, "node_modules/bson": { - "version": "7.3.0", - "resolved": "https://registry.npmjs.org/bson/-/bson-7.3.0.tgz", - "integrity": "sha512-WmjjMEwFwZHmGnAb7wn90MhkiT+mTm4x/rLj7dvAPWfwnVWDXhLun2e+UM88MJoDGW624yzZglVX/zTBy9ZZMw==", + "version": "7.3.1", + "resolved": "https://registry.npmjs.org/bson/-/bson-7.3.1.tgz", + "integrity": "sha512-h/C0qe6857pQhcSJHLfsR1uYGj98Ge3wKAD3Ed9KqH3wcVh+BM4Jq4xISD7vs9OPuT07n+q3QQVjslJ286j6ag==", "license": "Apache-2.0", "engines": { "node": ">=20.19.0" @@ -14981,9 +14985,9 @@ } }, "node_modules/postcss": { - "version": "8.5.15", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz", - "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==", + "version": "8.5.16", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", + "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index d4c37428..3e800214 100644 --- a/package.json +++ b/package.json @@ -45,12 +45,12 @@ "@babel/preset-env": "^7.29.7", "@babel/runtime": "^7.29.7", "@codemirror/commands": "^6.10.4", - "@codemirror/language": "^6.12.3", + "@codemirror/language": "^6.12.4", "@codemirror/search": "^6.7.1", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.43.2", - "@puppeteer/browsers": "3.0.5", - "autoprefixer": "^10.5.1", + "@codemirror/view": "^6.43.4", + "@puppeteer/browsers": "3.0.6", + "autoprefixer": "^10.5.2", "babel-loader": "^10.1.1", "base64-loader": "^1.0.0", "chromedriver": "^148.0.4", @@ -80,7 +80,7 @@ "mini-css-extract-plugin": "2.10.2", "modify-source-webpack-plugin": "^4.1.0", "nightwatch": "^3.16.0", - "postcss": "^8.5.15", + "postcss": "^8.5.16", "postcss-css-variables": "^0.19.0", "postcss-import": "^16.1.1", "postcss-loader": "^8.2.1", @@ -111,7 +111,7 @@ "bootstrap-colorpicker": "^3.4.0", "bootstrap-material-design": "^4.1.3", "browserify-zlib": "^0.2.0", - "bson": "^7.3.0", + "bson": "^7.3.1", "buffer": "^6.0.3", "cbor": "10.0.12", "chi-squared": "^1.1.0", From 9ab51086649f293d8690933271af57eb36e5f8a2 Mon Sep 17 00:00:00 2001 From: Thomas M <44269971+thomasxm@users.noreply.github.com> Date: Sat, 4 Jul 2026 11:32:23 +0100 Subject: [PATCH 24/25] Add Ascon (NIST SP 800-232) operations: Hash, MAC, Encrypt, Decrypt (#2155) --- package-lock.json | 9 + package.json | 1 + src/core/config/Categories.json | 4 + src/core/operations/AsconDecrypt.mjs | 112 ++++++ src/core/operations/AsconEncrypt.mjs | 108 ++++++ src/core/operations/AsconHash.mjs | 49 +++ src/core/operations/AsconMAC.mjs | 68 ++++ src/core/vendor/ascon.mjs | 162 +++++++++ tests/operations/tests/Ascon.mjs | 501 +++++++++++++++++++++++++++ 9 files changed, 1014 insertions(+) create mode 100644 src/core/operations/AsconDecrypt.mjs create mode 100644 src/core/operations/AsconEncrypt.mjs create mode 100644 src/core/operations/AsconHash.mjs create mode 100644 src/core/operations/AsconMAC.mjs create mode 100644 src/core/vendor/ascon.mjs create mode 100644 tests/operations/tests/Ascon.mjs diff --git a/package-lock.json b/package-lock.json index 7ae9b618..87a23efe 100644 --- a/package-lock.json +++ b/package-lock.json @@ -55,6 +55,7 @@ "jimp": "1.6.0", "jq-web": "^0.5.1", "jquery": "3.7.1", + "js-ascon": "^1.3.0", "js-sha3": "^0.9.3", "jsesc": "^3.1.0", "json5": "^2.2.3", @@ -12349,6 +12350,14 @@ "integrity": "sha512-m4avr8yL8kmFN8psrbFFFmB/If14iN5o9nw/NgnnM+kybDJpRsAynV2BsfpTYrTRysYUdADVD7CkUUizgkpLfg==", "license": "MIT" }, + "node_modules/js-ascon": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/js-ascon/-/js-ascon-1.3.0.tgz", + "integrity": "sha512-7GdMP11Ut8klrwkx+G2qRqEHhkWxmIoyVH6w+MU/4pRwWO0Dh/n3xo8wKe5IkTAdCCpU22uoHiaoB6JwGpbxcA==", + "engines": { + "node": ">=14.21.3" + } + }, "node_modules/js-sha3": { "version": "0.9.3", "resolved": "https://registry.npmjs.org/js-sha3/-/js-sha3-0.9.3.tgz", diff --git a/package.json b/package.json index 3e800214..7940548d 100644 --- a/package.json +++ b/package.json @@ -139,6 +139,7 @@ "jimp": "1.6.0", "jq-web": "^0.5.1", "jquery": "3.7.1", + "js-ascon": "^1.3.0", "js-sha3": "^0.9.3", "jsesc": "^3.1.0", "json5": "^2.2.3", diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index 2879a13a..a417af77 100644 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -113,6 +113,8 @@ "SM4 Decrypt", "RC6 Encrypt", "RC6 Decrypt", + "Ascon Encrypt", + "Ascon Decrypt", "GOST Encrypt", "GOST Decrypt", "GOST Sign", @@ -446,6 +448,8 @@ "BLAKE2b", "BLAKE2s", "BLAKE3", + "Ascon Hash", + "Ascon MAC", "GOST Hash", "Streebog", "SSDEEP", diff --git a/src/core/operations/AsconDecrypt.mjs b/src/core/operations/AsconDecrypt.mjs new file mode 100644 index 00000000..68f43dc0 --- /dev/null +++ b/src/core/operations/AsconDecrypt.mjs @@ -0,0 +1,112 @@ +/** + * @author Medjedtxm + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import Utils from "../Utils.mjs"; +import { toHexFast } from "../lib/Hex.mjs"; +import JsAscon from "js-ascon"; + +/** + * Ascon Decrypt operation + */ +class AsconDecrypt extends Operation { + + /** + * AsconDecrypt constructor + */ + constructor() { + super(); + + this.name = "Ascon Decrypt"; + this.module = "Ciphers"; + this.description = "Ascon-AEAD128 authenticated decryption as standardised in NIST SP 800-232. Decrypts ciphertext and verifies the authentication tag. Decryption will fail if the ciphertext or associated data has been tampered with.

Key: Must be exactly 16 bytes (128 bits).

Nonce: Must be exactly 16 bytes (128 bits). Must match the nonce used during encryption.

Associated Data: Must match the associated data used during encryption. Any mismatch will cause authentication failure."; + this.infoURL = "https://wikipedia.org/wiki/Ascon_(cipher)"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Key", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + }, + { + "name": "Nonce", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + }, + { + "name": "Associated Data", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + }, + { + "name": "Input", + "type": "option", + "value": ["Hex", "Raw"] + }, + { + "name": "Output", + "type": "option", + "value": ["Raw", "Hex"] + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid key or nonce length, or authentication fails + */ + run(input, args) { + const key = Utils.convertToByteArray(args[0].string, args[0].option), + nonce = Utils.convertToByteArray(args[1].string, args[1].option), + ad = Utils.convertToByteArray(args[2].string, args[2].option), + inputType = args[3], + outputType = args[4]; + + if (key.length !== 16) { + throw new OperationError(`Invalid key length: ${key.length} bytes. + +Ascon-AEAD128 requires a key of exactly 16 bytes (128 bits).`); + } + + if (nonce.length !== 16) { + throw new OperationError(`Invalid nonce length: ${nonce.length} bytes. + +Ascon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).`); + } + + // Convert input to byte array + const inputData = Utils.convertToByteArray(input, inputType); + + const keyUint8 = new Uint8Array(key); + const nonceUint8 = new Uint8Array(nonce); + const adUint8 = new Uint8Array(ad); + const ciphertextUint8 = new Uint8Array(inputData); + + try { + // Decrypt (returns Uint8Array containing plaintext) + const plaintext = JsAscon.decrypt(keyUint8, nonceUint8, adUint8, ciphertextUint8); + + // Return in requested format + if (outputType === "Hex") { + return toHexFast(plaintext); + } else { + return Utils.arrayBufferToStr(Uint8Array.from(plaintext).buffer); + } + } catch (e) { + throw new OperationError("Unable to decrypt: authentication failed. The ciphertext, key, nonce, or associated data may be incorrect or tampered with."); + } + } + +} + +export default AsconDecrypt; diff --git a/src/core/operations/AsconEncrypt.mjs b/src/core/operations/AsconEncrypt.mjs new file mode 100644 index 00000000..300ff6c3 --- /dev/null +++ b/src/core/operations/AsconEncrypt.mjs @@ -0,0 +1,108 @@ +/** + * @author Medjedtxm + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import Utils from "../Utils.mjs"; +import { toHexFast } from "../lib/Hex.mjs"; +import JsAscon from "js-ascon"; + +/** + * Ascon Encrypt operation + */ +class AsconEncrypt extends Operation { + + /** + * AsconEncrypt constructor + */ + constructor() { + super(); + + this.name = "Ascon Encrypt"; + this.module = "Ciphers"; + this.description = "Ascon-AEAD128 authenticated encryption as standardised in NIST SP 800-232. Ascon is a family of lightweight authenticated encryption algorithms designed for constrained devices such as IoT sensors and embedded systems.

Key: Must be exactly 16 bytes (128 bits).

Nonce: Must be exactly 16 bytes (128 bits). Should be unique for each encryption with the same key. Never reuse a nonce with the same key.

Associated Data: Optional additional data that is authenticated but not encrypted. Useful for including metadata like headers or timestamps.

The output includes both the ciphertext and a 128-bit authentication tag."; + this.infoURL = "https://wikipedia.org/wiki/Ascon_(cipher)"; + this.inputType = "string"; + this.outputType = "string"; + this.args = [ + { + "name": "Key", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + }, + { + "name": "Nonce", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + }, + { + "name": "Associated Data", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + }, + { + "name": "Input", + "type": "option", + "value": ["Raw", "Hex"] + }, + { + "name": "Output", + "type": "option", + "value": ["Hex", "Raw"] + } + ]; + } + + /** + * @param {string} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid key or nonce length + */ + run(input, args) { + const key = Utils.convertToByteArray(args[0].string, args[0].option), + nonce = Utils.convertToByteArray(args[1].string, args[1].option), + ad = Utils.convertToByteArray(args[2].string, args[2].option), + inputType = args[3], + outputType = args[4]; + + if (key.length !== 16) { + throw new OperationError(`Invalid key length: ${key.length} bytes. + +Ascon-AEAD128 requires a key of exactly 16 bytes (128 bits).`); + } + + if (nonce.length !== 16) { + throw new OperationError(`Invalid nonce length: ${nonce.length} bytes. + +Ascon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).`); + } + + // Convert input to byte array + const inputData = Utils.convertToByteArray(input, inputType); + + const keyUint8 = new Uint8Array(key); + const nonceUint8 = new Uint8Array(nonce); + const adUint8 = new Uint8Array(ad); + const inputUint8 = new Uint8Array(inputData); + + // Encrypt (returns Uint8Array containing ciphertext + tag) + const ciphertext = JsAscon.encrypt(keyUint8, nonceUint8, adUint8, inputUint8); + + // Return in requested format + if (outputType === "Hex") { + return toHexFast(ciphertext); + } else { + return Utils.arrayBufferToStr(Uint8Array.from(ciphertext).buffer); + } + } + +} + +export default AsconEncrypt; diff --git a/src/core/operations/AsconHash.mjs b/src/core/operations/AsconHash.mjs new file mode 100644 index 00000000..0019c2b1 --- /dev/null +++ b/src/core/operations/AsconHash.mjs @@ -0,0 +1,49 @@ +/** + * @author Medjedtxm + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import { toHexFast } from "../lib/Hex.mjs"; +import JsAscon from "js-ascon"; + +/** + * Ascon Hash operation + */ +class AsconHash extends Operation { + + /** + * AsconHash constructor + */ + constructor() { + super(); + + this.name = "Ascon Hash"; + this.module = "Crypto"; + this.description = "Ascon-Hash256 produces a fixed 256-bit (32-byte) cryptographic hash as standardised in NIST SP 800-232. Ascon is a family of lightweight authenticated encryption and hashing algorithms designed for constrained devices such as IoT sensors and embedded systems.

The algorithm was selected by NIST in 2023 as the new standard for lightweight cryptography after a multi-year competition."; + this.infoURL = "https://wikipedia.org/wiki/Ascon_(cipher)"; + this.inputType = "ArrayBuffer"; + this.outputType = "string"; + this.args = []; + } + + /** + * @param {ArrayBuffer} input + * @param {Object[]} args + * @returns {string} + */ + run(input, args) { + + const inputUint8 = new Uint8Array(input); + + // Compute hash (returns Uint8Array) + const hashResult = JsAscon.hash(inputUint8); + + // Convert to hex string + return toHexFast(hashResult); + } + +} + +export default AsconHash; diff --git a/src/core/operations/AsconMAC.mjs b/src/core/operations/AsconMAC.mjs new file mode 100644 index 00000000..9eb75ea6 --- /dev/null +++ b/src/core/operations/AsconMAC.mjs @@ -0,0 +1,68 @@ +/** + * @author Medjedtxm + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ + +import Operation from "../Operation.mjs"; +import OperationError from "../errors/OperationError.mjs"; +import Utils from "../Utils.mjs"; +import { toHexFast } from "../lib/Hex.mjs"; +import AsconMac from "../vendor/ascon.mjs"; + +/** + * Ascon MAC operation + */ +class AsconMAC extends Operation { + + /** + * AsconMAC constructor + */ + constructor() { + super(); + + this.name = "Ascon MAC"; + this.module = "Crypto"; + this.description = "Ascon-Mac produces a 128-bit (16-byte) message authentication code as part of the Ascon family standardised by NIST in SP 800-232. It provides authentication for messages using a secret key, ensuring both data integrity and authenticity.

Ascon is designed for lightweight cryptography on constrained devices such as IoT sensors and embedded systems."; + this.infoURL = "https://wikipedia.org/wiki/Ascon_(cipher)"; + this.inputType = "ArrayBuffer"; + this.outputType = "string"; + this.args = [ + { + "name": "Key", + "type": "toggleString", + "value": "", + "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"] + } + ]; + } + + /** + * @param {ArrayBuffer} input + * @param {Object[]} args + * @returns {string} + * @throws {OperationError} if invalid key length + */ + run(input, args) { + const keyArray = Utils.convertToByteArray(args[0].string, args[0].option); + + if (keyArray.length !== 16) { + throw new OperationError(`Invalid key length: ${keyArray.length} bytes. + +Ascon-Mac requires a key of exactly 16 bytes (128 bits).`); + } + + // Convert to Uint8Array for vendor Ascon implementation + const keyUint8 = new Uint8Array(keyArray); + const inputUint8 = new Uint8Array(input); + + // Compute MAC (returns Uint8Array) + const macResult = AsconMac.mac(keyUint8, inputUint8); + + // Convert to hex string + return toHexFast(macResult); + } + +} + +export default AsconMAC; diff --git a/src/core/vendor/ascon.mjs b/src/core/vendor/ascon.mjs new file mode 100644 index 00000000..891741d9 --- /dev/null +++ b/src/core/vendor/ascon.mjs @@ -0,0 +1,162 @@ +/** + * Ascon MAC implementation following NIST SP 800-232 + * Vendor file for CyberChef + * + * @author Medjedtxm + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ + +/** + * NIST SP 800-232 compliant Ascon-Mac implementation + * Uses little-endian byte ordering as per NIST specification + */ +class AsconMac { + // NIST SP 800-232 constants + static ASCON_MAC_IV = 0x0010200080cc0005n; + static ASCON_PRF_IN_RATE = 32; // 4 * 8 bytes + static ASCON_PRF_OUT_RATE = 16; // 2 * 8 bytes + + /** + * Compute Ascon-Mac tag + * @param {Uint8Array} key - 16-byte key + * @param {Uint8Array} message - Message to authenticate + * @param {number} tagLength - Output tag length (default 16) + * @returns {Uint8Array} - MAC tag + */ + static mac(key, message, tagLength = 16) { + if (key.length !== 16) { + throw new Error(`Invalid key length: ${key.length} bytes. Ascon-Mac requires exactly 16 bytes.`); + } + + // Initialise state + const state = new BigUint64Array(5); + + // Load key as two 64-bit words (little-endian per NIST SP 800-232) + const K0 = AsconMac.loadBytes(key, 0, 8); + const K1 = AsconMac.loadBytes(key, 8, 8); + + // Set initial value per NIST SP 800-232 + state[0] = AsconMac.ASCON_MAC_IV; + state[1] = K0; + state[2] = K1; + state[3] = 0n; + state[4] = 0n; + + // Initial permutation P12 + AsconMac.permutation(state, 12); + + // Absorb message in 8-byte chunks, cycling through state[0..3] + let pos = 0; + let wordIdx = 0; + + while (pos + 8 <= message.length) { + state[wordIdx] ^= AsconMac.loadBytes(message, pos, 8); + wordIdx++; + if (wordIdx === 4) { + wordIdx = 0; + AsconMac.permutation(state, 12); + } + pos += 8; + } + + // Absorb final partial block with padding + const remaining = message.length - pos; + if (remaining > 0) { + state[wordIdx] ^= AsconMac.loadBytes(message, pos, remaining); + } + // PAD(remaining) = 0x01 << (8 * remaining) + state[wordIdx] ^= 0x01n << BigInt(8 * remaining); + + // Domain separation: DSEP() = 0x80 << 56 = 0x8000000000000000 + state[4] ^= 0x8000000000000000n; + + // Finalisation permutation P12 + AsconMac.permutation(state, 12); + + // Squeeze output + const tag = new Uint8Array(tagLength); + let outPos = 0; + wordIdx = 0; + + while (outPos < tagLength) { + const toCopy = Math.min(8, tagLength - outPos); + AsconMac.storeBytes(tag, outPos, state[wordIdx], toCopy); + outPos += toCopy; + wordIdx++; + if (wordIdx === 2 && outPos < tagLength) { + wordIdx = 0; + AsconMac.permutation(state, 12); + } + } + + return tag; + } + + /** + * Load n bytes as little-endian 64-bit integer (NIST SP 800-232 byte order) + * LOADBYTES: bytes[i] goes to position i (byte 0 = LSB) + */ + static loadBytes(arr, offset, n) { + let result = 0n; + for (let i = 0; i < n && offset + i < arr.length; i++) { + result |= BigInt(arr[offset + i]) << BigInt(i * 8); + } + return result; + } + + /** + * Store n bytes from 64-bit integer in little-endian order + * STOREBYTES: position i goes to bytes[i] (LSB = byte 0) + */ + static storeBytes(arr, offset, val, n) { + for (let i = 0; i < n; i++) { + arr[offset + i] = Number((val >> BigInt(i * 8)) & 0xFFn); + } + } + + /** + * Ascon permutation + */ + static permutation(state, rounds) { + for (let r = 12 - rounds; r < 12; r++) { + // Add round constant + state[2] ^= BigInt(0xf0 - r * 0x10 + r); + + // Substitution layer + state[0] ^= state[4]; + state[4] ^= state[3]; + state[2] ^= state[1]; + + const t0 = state[0] ^ (~state[1] & state[2]); + const t1 = state[1] ^ (~state[2] & state[3]); + const t2 = state[2] ^ (~state[3] & state[4]); + const t3 = state[3] ^ (~state[4] & state[0]); + const t4 = state[4] ^ (~state[0] & state[1]); + + state[0] = t0 ^ t4; + state[1] = t1 ^ t0; + state[2] = ~t2; + state[3] = t3 ^ t2; + state[4] = t4; + + // Linear diffusion layer + state[0] ^= AsconMac.rotr64(state[0], 19n) ^ AsconMac.rotr64(state[0], 28n); + state[1] ^= AsconMac.rotr64(state[1], 61n) ^ AsconMac.rotr64(state[1], 39n); + state[2] ^= AsconMac.rotr64(state[2], 1n) ^ AsconMac.rotr64(state[2], 6n); + state[3] ^= AsconMac.rotr64(state[3], 10n) ^ AsconMac.rotr64(state[3], 17n); + state[4] ^= AsconMac.rotr64(state[4], 7n) ^ AsconMac.rotr64(state[4], 41n); + } + } + + /** + * 64-bit rotate right + */ + static rotr64(val, n) { + const mask = 0xFFFFFFFFFFFFFFFFn; + val = val & mask; + return ((val >> n) | (val << (64n - n))) & mask; + } +} + +export default AsconMac; diff --git a/tests/operations/tests/Ascon.mjs b/tests/operations/tests/Ascon.mjs new file mode 100644 index 00000000..dca3b485 --- /dev/null +++ b/tests/operations/tests/Ascon.mjs @@ -0,0 +1,501 @@ +/** + * Ascon tests. + * + * Test vectors include official NIST ACVP vectors from: + * https://github.com/usnistgov/ACVP-Server/tree/master/gen-val/json-files/Ascon-Hash256-SP800-232 + * https://github.com/ascon/ascon-c (LWC_AEAD_KAT files) + * + * @author Medjedtxm + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ + +import TestRegister from "../../lib/TestRegister.mjs"; + +TestRegister.addTests([ + // ============= Ascon Hash Tests (NIST SP 800-232) ============= + // Official NIST ACVP test vector + { + name: "Ascon Hash: NIST ACVP vector (msg=0x50)", + input: "P", // 0x50 + expectedOutput: "b96da347d720272533a87f5a94a356155f49cdf7c0c10a3e6f346d8a2293e480", + recipeConfig: [ + { + "op": "Ascon Hash", + "args": [] + } + ], + }, + { + name: "Ascon Hash: empty input", + input: "", + expectedOutput: "0b3be5850f2f6b98caf29f8fdea89b64a1fa70aa249b8f839bd53baa304d92b2", + recipeConfig: [ + { + "op": "Ascon Hash", + "args": [] + } + ], + }, + { + name: "Ascon Hash: Hello", + input: "Hello", + expectedOutput: "c1beebe1251d562c4526d6b947cefb932998499424f6cd186e764aa0a36cddb7", + recipeConfig: [ + { + "op": "Ascon Hash", + "args": [] + } + ], + }, + { + name: "Ascon Hash: Hello, World!", + input: "Hello, World!", + expectedOutput: "f40e1ce8d4272e628e9535193f196f4ff2a720b00f6380c5d6f16b975f3a7777", + recipeConfig: [ + { + "op": "Ascon Hash", + "args": [] + } + ], + }, + + // ============= Ascon MAC Tests (NIST LWC_MAC_KAT_128_128.txt) ============= + // Official test vectors from ascon-c: https://github.com/ascon/ascon-c/blob/main/crypto_auth/asconmacv13/LWC_MAC_KAT_128_128.txt + { + name: "Ascon MAC: NIST KAT Count=1 (empty message)", + input: "", + expectedOutput: "eac9d74bbedf8bf1eba2862b26aa6d39", + recipeConfig: [ + { + "op": "Ascon MAC", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"} + ] + } + ], + }, + { + name: "Ascon MAC: NIST KAT Count=2 (Msg=0x10)", + input: "\x10", + expectedOutput: "e5be5b6dfb7b0e3eae00a070791947a8", + recipeConfig: [ + { + "op": "Ascon MAC", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"} + ] + } + ], + }, + { + name: "Ascon MAC: NIST KAT Count=5 (Msg=0x10111213)", + input: "\x10\x11\x12\x13", + expectedOutput: "727f6386405a52ad7ca0669a6a885294", + recipeConfig: [ + { + "op": "Ascon MAC", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"} + ] + } + ], + }, + { + name: "Ascon MAC: invalid key length", + input: "test", + expectedOutput: "Invalid key length: 8 bytes.\n\nAscon-Mac requires a key of exactly 16 bytes (128 bits).", + recipeConfig: [ + { + "op": "Ascon MAC", + "args": [ + {"option": "Hex", "string": "0001020304050607"} + ] + } + ], + }, + + // ============= Ascon Encrypt Tests (NIST SP 800-232) ============= + // Official NIST ascon-c KAT test vector (Count=1) + // https://github.com/ascon/ascon-c/blob/main/crypto_aead/asconaead128/LWC_AEAD_KAT_128_128.txt + { + name: "Ascon Encrypt: NIST KAT Count=1 (empty PT, empty AD)", + input: "", + expectedOutput: "4f9c278211bec9316bf68f46ee8b2ec6", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + // Official NIST ascon-c KAT test vector (Count=2) + { + name: "Ascon Encrypt: NIST KAT Count=2 (empty PT, AD=0x30)", + input: "", + expectedOutput: "cccb674fe18a09a285d6ab11b35675c0", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "Hex", "string": "30"}, + "Raw", "Hex" + ] + } + ], + }, + // Official NIST ascon-c KAT test vector (Count=34) - PT=0x20 + { + name: "Ascon Encrypt: NIST KAT Count=34 (PT=0x20, empty AD)", + input: "\x20", + expectedOutput: "e8dd576aba1cd3e6fc704de02aedb79588", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + // Official NIST ascon-c KAT test vector (Count=341) - PT + AD + { + name: "Ascon Encrypt: NIST KAT Count=341 (PT=10 bytes, AD=10 bytes)", + input: "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29", + expectedOutput: "12042996da42b4536e5a0e64692cf6041ff8c367e1423253c84c", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "Hex", "string": "30313233343536373839"}, + "Raw", "Hex" + ] + } + ], + }, + // Official NIST ascon-c KAT test vector (PT=16 bytes, AD=16 bytes) + { + name: "Ascon Encrypt: NIST KAT (PT=16 bytes, AD=16 bytes)", + input: "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f", + expectedOutput: "6373ebb28be97c9bac090cf399c13ef13abfc0d209e8f4844c90814d13f32c59", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "Hex", "string": "303132333435363738393a3b3c3d3e3f"}, + "Raw", "Hex" + ] + } + ], + }, + // https://github.com/ascon/ascon-c/blob/main/crypto_aead/asconaead128/LWC_AEAD_KAT_128_128.txt + { + name: "Ascon Encrypt: no key", + input: "test message", + expectedOutput: `Invalid key length: 0 bytes. + +Ascon-AEAD128 requires a key of exactly 16 bytes (128 bits).`, + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": ""}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: invalid key length", + input: "test message", + expectedOutput: `Invalid key length: 8 bytes. + +Ascon-AEAD128 requires a key of exactly 16 bytes (128 bits).`, + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "0001020304050607"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: no nonce", + input: "test message", + expectedOutput: `Invalid nonce length: 0 bytes. + +Ascon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).`, + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: invalid nonce length", + input: "test message", + expectedOutput: `Invalid nonce length: 12 bytes. + +Ascon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).`, + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: basic encryption", + input: "Hello", + expectedOutput: "af14bce6b9b6588c3aa63f9ddc5a0cf5f565f358b0", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: with associated data", + input: "Hello", + expectedOutput: "351880c09f9dee12c20c4ba973066bc10dd26000b6", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "UTF8", "string": "metadata"}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: longer message", + input: "test message", + expectedOutput: "9314a3fef6cc299a07b8c9e0f9e479ca0d1187e87345cf590adc572b", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: empty plaintext", + input: "", + expectedOutput: "4427d64b8e1e1451fc445960f0839bb0", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + { + name: "Ascon Encrypt: zero key and nonce", + input: "Hello", + expectedOutput: "403281e117ebb087e2d9196552b2d123bccb7b5500", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "00000000000000000000000000000000"}, + {"option": "Hex", "string": "00000000000000000000000000000000"}, + {"option": "Hex", "string": ""}, + "Raw", "Hex" + ] + } + ], + }, + + // ============= Ascon Decrypt Tests ============= + { + name: "Ascon Decrypt: no key", + input: "af14bce6b9b6588c3aa63f9ddc5a0cf5f565f358b0", + expectedOutput: `Invalid key length: 0 bytes. + +Ascon-AEAD128 requires a key of exactly 16 bytes (128 bits).`, + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": ""}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Hex", "Raw" + ] + } + ], + }, + { + name: "Ascon Decrypt: basic decryption", + input: "af14bce6b9b6588c3aa63f9ddc5a0cf5f565f358b0", + expectedOutput: "Hello", + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Hex", "Raw" + ] + } + ], + }, + { + name: "Ascon Decrypt: with associated data", + input: "351880c09f9dee12c20c4ba973066bc10dd26000b6", + expectedOutput: "Hello", + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "UTF8", "string": "metadata"}, + "Hex", "Raw" + ] + } + ], + }, + { + name: "Ascon Decrypt: longer message", + input: "9314a3fef6cc299a07b8c9e0f9e479ca0d1187e87345cf590adc572b", + expectedOutput: "test message", + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Hex", "Raw" + ] + } + ], + }, + { + name: "Ascon Decrypt: authentication failure (tampered ciphertext)", + input: "bf14bce6b9b6588c3aa63f9ddc5a0cf5f565f358b0", + expectedOutput: "Unable to decrypt: authentication failed. The ciphertext, key, nonce, or associated data may be incorrect or tampered with.", + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Hex", "Raw" + ] + } + ], + }, + { + name: "Ascon Decrypt: authentication failure (wrong key)", + input: "af14bce6b9b6588c3aa63f9ddc5a0cf5f565f358b0", + expectedOutput: "Unable to decrypt: authentication failed. The ciphertext, key, nonce, or associated data may be incorrect or tampered with.", + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "ff0102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": ""}, + "Hex", "Raw" + ] + } + ], + }, + { + name: "Ascon Decrypt: authentication failure (wrong associated data)", + input: "351880c09f9dee12c20c4ba973066bc10dd26000b6", + expectedOutput: "Unable to decrypt: authentication failed. The ciphertext, key, nonce, or associated data may be incorrect or tampered with.", + recipeConfig: [ + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "UTF8", "string": "wrong data"}, + "Hex", "Raw" + ] + } + ], + }, + + // ============= Round-trip Tests ============= + { + name: "Ascon: encrypt then decrypt round-trip", + input: "This is a test message for Ascon AEAD encryption!", + expectedOutput: "This is a test message for Ascon AEAD encryption!", + recipeConfig: [ + { + "op": "Ascon Encrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "UTF8", "string": "additional data"}, + "Raw", "Hex" + ] + }, + { + "op": "Ascon Decrypt", + "args": [ + {"option": "Hex", "string": "000102030405060708090a0b0c0d0e0f"}, + {"option": "Hex", "string": "101112131415161718191a1b1c1d1e1f"}, + {"option": "UTF8", "string": "additional data"}, + "Hex", "Raw" + ] + } + ], + }, +]); From 86746296befdb325fdd3dd17456c6b18d47d379f Mon Sep 17 00:00:00 2001 From: MAN$I VERMA Date: Sat, 4 Jul 2026 16:50:33 +0530 Subject: [PATCH 25/25] feat: Implement automated option-type ingredient validation (#2625) --- src/core/Ingredient.mjs | 40 +++++++++++--- .../operations/AutomatedValidationTestOp.mjs | 6 +++ src/core/operations/SM4Encrypt.mjs | 2 +- src/node/api.mjs | 2 +- .../operations/tests/AutomatedValidation.mjs | 53 +++++++++++++++---- tests/operations/tests/CharEnc.mjs | 4 +- tests/operations/tests/GenerateLoremIpsum.mjs | 4 +- tests/operations/tests/Image.mjs | 2 +- tests/operations/tests/SM2.mjs | 2 +- 9 files changed, 90 insertions(+), 25 deletions(-) diff --git a/src/core/Ingredient.mjs b/src/core/Ingredient.mjs index 4f81f83b..1c0f0cc3 100644 --- a/src/core/Ingredient.mjs +++ b/src/core/Ingredient.mjs @@ -76,8 +76,15 @@ class Ingredient { if (this.disabled) return true; let checkVal = val; - if (this.type === "toggleString" && val && typeof val === "object" && "string" in val) { - checkVal = val.string; + if (checkVal === null || checkVal === undefined) { + checkVal = this.defaultValue; + } + + if (this.type === "toggleString" && checkVal && typeof checkVal === "object" && "string" in checkVal) { + checkVal = checkVal.string; + } + if (this.type === "option" && Array.isArray(checkVal)) { + checkVal = checkVal[this.defaultIndex ?? 0]; } // 1. check if empty @@ -89,7 +96,11 @@ class Ingredient { } if (isEmpty) { - if (this.allowEmpty === false) { + let isAllowedOptionEmpty = false; + if (this.type === "option" && Array.isArray(this.defaultValue)) { + isAllowedOptionEmpty = this.defaultValue.includes(""); + } + if (this.allowEmpty === false || (this.type === "option" && !isAllowedOptionEmpty)) { throw new OperationError(`${this.name} cannot be empty.`); } return true; @@ -110,20 +121,35 @@ class Ingredient { // 3. number checks if (this.type === "number") { - if (val === null || val === undefined || isNaN(val)) { + if (checkVal === null || checkVal === undefined || isNaN(checkVal)) { throw new OperationError(`${this.name} must be a number.`); } - if (this.integer && !Number.isInteger(val)) { + if (this.integer && !Number.isInteger(checkVal)) { throw new OperationError(`${this.name} must be an integer.`); } - if (typeof this.min === "number" && val < this.min) { + if (typeof this.min === "number" && checkVal < this.min) { throw new OperationError(`${this.name} must be greater than or equal to ${this.min}.`); } - if (typeof this.max === "number" && val > this.max) { + if (typeof this.max === "number" && checkVal > this.max) { throw new OperationError(`${this.name} must be less than or equal to ${this.max}.`); } } + // 4. option checks + if (this.type === "option") { + if (Array.isArray(this.defaultValue)) { + const permittedOptions = this.defaultValue.filter(opt => { + if (typeof opt !== "string") return false; + return !opt.match(/^\[\/?[a-z0-9 -()^]+\]$/i); + }); + const valStr = (checkVal !== null && checkVal !== undefined) ? String(checkVal).toLowerCase() : ""; + const matchedOption = permittedOptions.find(opt => opt.toLowerCase() === valStr); + if (!matchedOption) { + throw new OperationError(`${this.name} must be one of the following: ${permittedOptions.join(", ")}.`); + } + } + } + return true; } diff --git a/src/core/operations/AutomatedValidationTestOp.mjs b/src/core/operations/AutomatedValidationTestOp.mjs index 315eb417..92f803ae 100644 --- a/src/core/operations/AutomatedValidationTestOp.mjs +++ b/src/core/operations/AutomatedValidationTestOp.mjs @@ -60,6 +60,12 @@ class AutomatedValidationTestOp extends Operation { }, "toggleValues": ["Option A", "Option B"], "allowEmpty": false + }, + { + "name": "Option Ingredient", + "type": "option", + "value": ["[Group 1]", "Option 1", "Option 2", "[/Group 1]", "[Group 2]", "Option 3", "[/Group 2]"], + "allowEmpty": false } ]; } diff --git a/src/core/operations/SM4Encrypt.mjs b/src/core/operations/SM4Encrypt.mjs index 0a58dfb9..69c414eb 100644 --- a/src/core/operations/SM4Encrypt.mjs +++ b/src/core/operations/SM4Encrypt.mjs @@ -43,7 +43,7 @@ class SM4Encrypt extends Operation { { "name": "Mode", "type": "option", - "value": ["CBC", "CFB", "OFB", "CTR", "ECB"] + "value": ["CBC", "CFB", "OFB", "CTR", "ECB", "CBC/NoPadding", "ECB/NoPadding"] }, { "name": "Input", diff --git a/src/node/api.mjs b/src/node/api.mjs index f41feb23..83163d37 100644 --- a/src/node/api.mjs +++ b/src/node/api.mjs @@ -74,7 +74,7 @@ function transformArgs(opArgsList, newArgs) { return opArgs.map((arg) => { if (arg.type === "option") { // pick default option if not already chosen - return typeof arg.value === "string" ? arg.value : arg.value[arg.defaultIndex ?? 0]; + return !Array.isArray(arg.value) ? arg.value : arg.value[arg.defaultIndex ?? 0]; } if (arg.type === "editableOption") { diff --git a/tests/operations/tests/AutomatedValidation.mjs b/tests/operations/tests/AutomatedValidation.mjs index da84de11..f55efa01 100644 --- a/tests/operations/tests/AutomatedValidation.mjs +++ b/tests/operations/tests/AutomatedValidation.mjs @@ -15,7 +15,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }] + args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -26,7 +26,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [4, 1.5, "hello", "", { "option": "Option A", "string": "test" }] + args: [4, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -37,7 +37,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [11, 1.5, "hello", "", { "option": "Option A", "string": "test" }] + args: [11, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -48,7 +48,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5.5, 1.5, "hello", "", { "option": "Option A", "string": "test" }] + args: [5.5, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -59,7 +59,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 1.4, "hello", "", { "option": "Option A", "string": "test" }] + args: [5, 1.4, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -70,7 +70,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 5.6, "hello", "", { "option": "Option A", "string": "test" }] + args: [5, 5.6, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -81,7 +81,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 1.5, "helloooo", "", { "option": "Option A", "string": "test" }] + args: [5, 1.5, "helloooo", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -92,7 +92,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 1.5, "", "", { "option": "Option A", "string": "test" }] + args: [5, 1.5, "", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -103,7 +103,7 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }] + args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "Option 1"] } ] }, @@ -114,7 +114,40 @@ TestRegister.addTests([ recipeConfig: [ { op: "Automated Validation Test Op", - args: [5, 1.5, "hello", "", { "option": "Option A", "string": "" }] + args: [5, 1.5, "hello", "", { "option": "Option A", "string": "" }, "Option 1"] + } + ] + }, + { + name: "Automated Validation: Invalid Option value", + input: "test", + expectedOutput: "Option Ingredient must be one of the following: Option 1, Option 2, Option 3.", + recipeConfig: [ + { + op: "Automated Validation Test Op", + args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "Option 4"] + } + ] + }, + { + name: "Automated Validation: Option value as optgroup heading (invalid)", + input: "test", + expectedOutput: "Option Ingredient must be one of the following: Option 1, Option 2, Option 3.", + recipeConfig: [ + { + op: "Automated Validation Test Op", + args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }, "[Group 1]"] + } + ] + }, + { + name: "Automated Validation: Option value empty (invalid)", + input: "test", + expectedOutput: "Option Ingredient cannot be empty.", + recipeConfig: [ + { + op: "Automated Validation Test Op", + args: [5, 1.5, "hello", "", { "option": "Option A", "string": "test" }, ""] } ] } diff --git a/tests/operations/tests/CharEnc.mjs b/tests/operations/tests/CharEnc.mjs index 83f71ca9..88991761 100644 --- a/tests/operations/tests/CharEnc.mjs +++ b/tests/operations/tests/CharEnc.mjs @@ -71,7 +71,7 @@ TestRegister.addTests([ { name: "Encode text: empty encoding", input: "hello", - expectedOutput: "Invalid encoding", + expectedOutput: "Encoding cannot be empty.", recipeConfig: [ { "op": "Encode text", @@ -82,7 +82,7 @@ TestRegister.addTests([ { name: "Decode text: empty encoding", input: "68 65 6c 6c 6f", - expectedOutput: "Invalid encoding", + expectedOutput: "Encoding cannot be empty.", recipeConfig: [ { "op": "From Hex", diff --git a/tests/operations/tests/GenerateLoremIpsum.mjs b/tests/operations/tests/GenerateLoremIpsum.mjs index c42bf8da..6861752c 100644 --- a/tests/operations/tests/GenerateLoremIpsum.mjs +++ b/tests/operations/tests/GenerateLoremIpsum.mjs @@ -67,12 +67,12 @@ TestRegister.addTests([ { name: "Generate Lorem Ipsum: Incorrect lengthType", input: "", - expectedOutput: "Invalid length type", + expectedOutput: "Length in must be one of the following: Paragraphs, Sentences, Words, Bytes.", recipeConfig: [ { "op": "Generate Lorem Ipsum", "args": [999_999, "Novels"] - }, + } ], }, diff --git a/tests/operations/tests/Image.mjs b/tests/operations/tests/Image.mjs index 7da6c65d..56f3fa2b 100644 --- a/tests/operations/tests/Image.mjs +++ b/tests/operations/tests/Image.mjs @@ -48,7 +48,7 @@ TestRegister.addTests([ { name: "Generate Image: empty mode", input: "", - expectedOutput: "Unsupported Mode: ()", + expectedOutput: "Mode cannot be empty.", recipeConfig: [ { op: "Generate Image", diff --git a/tests/operations/tests/SM2.mjs b/tests/operations/tests/SM2.mjs index a3d6fd2c..53ee22ca 100644 --- a/tests/operations/tests/SM2.mjs +++ b/tests/operations/tests/SM2.mjs @@ -113,7 +113,7 @@ TestRegister.addTests([ }, { "op": "SM2 Decrypt", - "args": [PRIVATE_K, "C1C2C2", CURVE] + "args": [PRIVATE_K, "C1C2C3", CURVE] } ] },