exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump jsonpath-plus (#2166)

Browse Source 
Closes #1928 #1926
This commit is contained in:
GCHQ Developer C85297 2026-01-29 13:40:34 +00:00 committed by GitHub
parent 2092e5b20c
commit b885e8423d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
package-lock.json generated
View File

@ -57,7 +57,7 @@
"jsesc": "^3.0.2", "jsesc": "^3.0.2",
"json5": "^2.2.3", "json5": "^2.2.3",
"jsonata": "^2.0.3", "jsonata": "^2.0.3",
"jsonpath-plus": "^9.0.0", "jsonpath-plus": "^10.3.0",
"jsonwebtoken": "8.5.1", "jsonwebtoken": "8.5.1",
"jsqr": "^1.4.0", "jsqr": "^1.4.0",
"jsrsasign": "^11.1.0", "jsrsasign": "^11.1.0",
@ -12503,21 +12503,21 @@
} }
}, },
"node_modules/jsonpath-plus": { "node_modules/jsonpath-plus": {
"version": "9.0.0", "version": "10.3.0",
"resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-9.0.0.tgz", "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.3.0.tgz",
"integrity": "sha512-bqE77VIDStrOTV/czspZhTn+o27Xx9ZJRGVkdVShEtPoqsIx5yALv3lWVU6y+PqYvWPJNWE7ORCQheQkEe0DDA==", "integrity": "sha512-8TNmfeTCk2Le33A3vRRwtuworG/L5RrgMvdjhKZxvyShO+mBu2fP50OWUjRLNtvw344DdDarFh9buFAZs5ujeA==",
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"@jsep-plugin/assignment": "^1.2.1", "@jsep-plugin/assignment": "^1.3.0",
"@jsep-plugin/regex": "^1.0.3", "@jsep-plugin/regex": "^1.0.4",
"jsep": "^1.3.8" "jsep": "^1.4.0"
}, },
"bin": { "bin": {
"jsonpath": "bin/jsonpath-cli.js", "jsonpath": "bin/jsonpath-cli.js",
"jsonpath-plus": "bin/jsonpath-cli.js" "jsonpath-plus": "bin/jsonpath-cli.js"
}, },
"engines": { "engines": {
"node": ">=14.0.0" "node": ">=18.0.0"
} }
}, },
"node_modules/jsonwebtoken": { "node_modules/jsonwebtoken": {

2
package.json
View File

@ -143,7 +143,7 @@
"jsesc": "^3.0.2", "jsesc": "^3.0.2",
"json5": "^2.2.3", "json5": "^2.2.3",
"jsonata": "^2.0.3", "jsonata": "^2.0.3",
"jsonpath-plus": "^9.0.0", "jsonpath-plus": "^10.3.0",
"jsonwebtoken": "8.5.1", "jsonwebtoken": "8.5.1",
"jsqr": "^1.4.0", "jsqr": "^1.4.0",
"jsrsasign": "^11.1.0", "jsrsasign": "^11.1.0",

15
tests/operations/tests/Code.mjs
View File

@ -322,8 +322,21 @@ TestRegister.addTests([
] ]
} }
], ],
expectedMatch: /^Invalid JPath expression: jsonPath: self is not defined:/ expectedMatch: /^Invalid JPath expression: Unexpected "{" at character 1/
}, },
{
name: "JPath Expression: Script-based RCE",
input: "[{}]",
recipeConfig: [
{
"op": "JPath expression",
"args": [
"$..[?(p=\"console.log(this.process.mainModule.require('child_process').execSync('id').toString())\";a=''[['constructor']][['constructor']](p);a())]",
"\n"
]
}
],
expectedMatch: /^Invalid JPath expression: jsonPath: Cannot read properties of {2}\(reading 'constructor'\): / },
{ {
name: "CSS selector", name: "CSS selector",
input: '<div id="test">\n<p class="a">hello</p>\n<p>world</p>\n<p class="a">again</p>\n</div>', input: '<div id="test">\n<p class="a">hello</p>\n<p>world</p>\n<p class="a">again</p>\n</div>',