diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 77f22bcf..c03810a8 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -16,7 +16,7 @@ jobs: pages: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/.github/workflows/pull_requests.yml b/.github/workflows/pull_requests.yml index 01f23d17..fd5ff732 100644 --- a/.github/workflows/pull_requests.yml +++ b/.github/workflows/pull_requests.yml @@ -12,7 +12,7 @@ jobs: main: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 @@ -64,7 +64,7 @@ jobs: uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 + uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Production Image Build if: success() diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index e826d4b1..13f45cb1 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -22,7 +22,7 @@ jobs: contents: write runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 @@ -64,7 +64,7 @@ jobs: uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 + uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 - name: Image Metadata id: image-metadata @@ -110,7 +110,7 @@ jobs: needs: main runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set node version uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 diff --git a/CHANGELOG.md b/CHANGELOG.md index cec4ea57..e4e3be87 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,75 @@ All major and minor version changes will be documented in this file. Details of ## Details +### [11.1.0] - 2026-06-13 +This release includes a security fix ([#2557]) +- Security: Add fix, and tests, for Lorem Ipsum DoS issue [@GCHQDeveloper581] | [#2557] +- chore (deps): bump the patch-updates group with 4 updates | [#2552] +- chore (deps): bump the actions-dependencies group with 2 updates | [#2551] +- chore (deps): bump the docker-dependencies group with 2 updates | [#2550] +- chore (deps): bump protobufjs from 8.5.0 to 8.6.2 in the minor-updates group | [#2553] +- Security Policy Update [@C85297] | [#2547] +- Fix spurious error messages generated during webpack build [@GCHQDeveloper581] | [#2545] +- chore (deps): bump shell-quote from 1.8.3 to 1.8.4 | [#2543] +- Implementing ROR13 feature [@Fufu-btw] | [#2539] +- New operation improvements [@jl5193] [@GCHQDeveloper581] | [#1431] +- Npm and yarn/major version updates [@GCHQDeveloper581] | [#2527] +- Update README to reflect AES Decrypt changes [@andreasrtv] | [#2502] +- feat: add Escape Smart Characters operation [@HarelKatz] | [#2391] +- feat: Get AES IV from input (QoL) [@andreasrtv] | [#2471] +- fix: validate text encoding options [@SyedIshmumAhnaf] | [#2497] +- chore (deps): bump the minor-updates group with 5 updates [@GCHQDeveloper581] | [#2500] +- chore (deps): bump the patch-updates group with 2 updates | [#2499] +- chore (deps): bump nginxinc/nginx-unprivileged from `df0e9ed` to `0a1e718` in the docker-dependencies group | [#2498] +- Add remove ANSI escape codes operation [@Louis-Ladd] [@GCHQDeveloper581] | [#2143] +- Fix option ingredients being overwriten [@C85297] | [#2341] +- chore (deps): bump qs and express | [#2478] +- chore (deps): bump tmp from 0.2.5 to 0.2.7 | [#2479] +- chore (deps): bump the patch-updates group across 1 directory with 6 updates | [#2463] +- chore (deps): bump the docker-dependencies group across 1 directory with 2 updates | [#2468] +- chore (deps): bump terser from 5.46.2 to 5.48.0 | [#2385] +- Make dependabot quieter [@GCHQDeveloper581] | [#2467] +- update sitemap [@Blank0120] | [#2443] +- Bump webpack-dev-server to 5.2.4 [@GCHQDeveloper581] | [#2417] +- Fix pgp tests [@GCHQDeveloper581] [@C85297] | [#2461] +- chore (deps): bump the patch-updates group across 1 directory with 4 updates | [#2438] +- chore (deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 | [#2439] +- chore (deps): bump docker/login-action from 4.1.0 to 4.2.0 | [#2441] +- chore (deps): bump docker/metadata-action from 6.0.0 to 6.1.0 | [#2442] +- update bson [@Blank0120] [@GCHQDeveloper581] | [#2425] +- chore (deps): bump webpack from 5.106.2 to 5.107.1 | [#2428] +- chore (deps): bump protobufjs from 7.5.8 to 7.6.0 | [#2429] +- chore (deps): bump sql-formatter from 15.7.4 to 15.8.0 | [#2430] +- chore (deps): bump docker/build-push-action from 7.1.0 to 7.2.0 | [#2431] +- Fix flaky `npm run testui` [@lzandman] | [#2412] +- Include git ref in website download zip name [@C85297] | [#2339] +- Bump nginxinc/nginx-unprivileged from `808f784` to `b9f7ba1` | [#2389] +- Series Chart HTML Formatting fix [@C85297] | [#2403] +- Parse Ethernet Frame HTML formatting fix [@C85297] | [#2402] +- Parse IPv4 Header HTML formatting fix [@C85297] | [#2401] +- Update chromedriver, and install corresponding chrome in workflows (fixes build) [@GCHQDeveloper581] | [#2387] +- chore (deps): bump @codemirror/view from 6.41.1 to 6.43.0 | [#2384] +- chore (deps): bump globals from 17.5.0 to 17.6.0 | [#2386] +- chore (deps): bump the patch-updates group across 1 directory with 3 updates | [#2388] +- [StepSecurity] Apply security best practices [@GCHQDeveloper581] StepSecurity Bot | [#2378] +- Build docker container for arm v7 as well [@GCHQDeveloper581] | [#2379] +- chore (deps): bump fast-uri from 3.1.0 to 3.1.2 | [#2372] +- update bcryptjs [@C85297] [@GCHQDeveloper581] | [#2368] +- chore (deps): bump picomatch from 2.3.1 to 2.3.2 | [#2370] +- chore (deps): bump ip-address from 10.1.0 to 10.2.0 | [#2371] +- chore (deps): bump axios from 1.15.0 to 1.16.0 | [#2369] +- feat(operation-wrap): add new Wrap operation to format text at specified line width [@0xff1ce] | [#1882] +- chore (deps): bump the patch-updates group across 1 directory with 5 updates | [#2354] +- chore (deps): bump docker/login-action from 3 to 4 | [#2363] +- chore (deps): bump docker/setup-buildx-action from 3 to 4 | [#2364] +- chore (deps): bump crazy-max/ghaction-github-pages from 3 to 5 | [#2365] +- chore (deps): bump docker/metadata-action from 4 to 6 | [#2366] +- chore (deps): bump docker/setup-qemu-action from 3 to 4 | [#2367] +- Update dependabot for Node 24. [@GCHQDeveloper581] | [#2361] +- chore (deps): bump uuid from 13.0.0 to 14.0.0 | [#2332] +- chore (deps): bump webpack-bundle-analyzer from 5.2.0 to 5.3.0 | [#2353] +- Fix all zeros after 16384 bytes with Blake3 [@zachbowden] [@GCHQDeveloper581] | [#2351] + ## [11.0.0] - 2026-04-28 - Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348] - Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347] @@ -638,6 +707,7 @@ Breaking changes: ## [4.0.0] - 2016-11-28 - Initial open source commit [@n1474335] | [b1d73a72](https://github.com/gchq/CyberChef/commit/b1d73a725dc7ab9fb7eb789296efd2b7e4b08306) +[11.1.0]: https://github.com/gchq/CyberChef/releases/tag/v11.1.0 [11.0.0]: https://github.com/gchq/CyberChef/releases/tag/v11.0.0 [10.24.0]: https://github.com/gchq/CyberChef/releases/tag/v10.24.0 [10.23.0]: https://github.com/gchq/CyberChef/releases/tag/v10.23.0 @@ -923,6 +993,14 @@ Breaking changes: [@hsolberg]: https://github.com/hsolberg [@lzandman]: https://github.com/lzandman [@engin0223]: https://github.com/engin0223 +[@Fufu-btw]: https://github.com/Fufu-btw +[@jl5193]: https://github.com/jl5193 +[@andreasrtv]: https://github.com/andreasrtv +[@HarelKatz]: https://github.com/HarelKatz +[@SyedIshmumAhnaf]: https://github.com/SyedIshmumAhnaf +[@Louis-Ladd]: https://github.com/Louis-Ladd +[@Blank0120]: https://github.com/Blank0120 +[@zachbowden]: https://github.com/zachbowden [8ad18b]: https://github.com/gchq/CyberChef/commit/8ad18bc7db6d9ff184ba3518686293a7685bf7b7 @@ -1220,4 +1298,70 @@ Breaking changes: [#2273]: https://github.com/gchq/CyberChef/pull/2273 [#2342]: https://github.com/gchq/CyberChef/pull/2342 [#1922]: https://github.com/gchq/CyberChef/pull/1922 +[#2557]: https://github.com/gchq/CyberChef/pull/2557 +[#2552]: https://github.com/gchq/CyberChef/pull/2552 +[#2551]: https://github.com/gchq/CyberChef/pull/2551 +[#2550]: https://github.com/gchq/CyberChef/pull/2550 +[#2553]: https://github.com/gchq/CyberChef/pull/2553 +[#2547]: https://github.com/gchq/CyberChef/pull/2547 +[#2545]: https://github.com/gchq/CyberChef/pull/2545 +[#2543]: https://github.com/gchq/CyberChef/pull/2543 +[#2539]: https://github.com/gchq/CyberChef/pull/2539 +[#1431]: https://github.com/gchq/CyberChef/pull/1431 +[#2527]: https://github.com/gchq/CyberChef/pull/2527 +[#2502]: https://github.com/gchq/CyberChef/pull/2502 +[#2391]: https://github.com/gchq/CyberChef/pull/2391 +[#2471]: https://github.com/gchq/CyberChef/pull/2471 +[#2497]: https://github.com/gchq/CyberChef/pull/2497 +[#2500]: https://github.com/gchq/CyberChef/pull/2500 +[#2499]: https://github.com/gchq/CyberChef/pull/2499 +[#2498]: https://github.com/gchq/CyberChef/pull/2498 +[#2143]: https://github.com/gchq/CyberChef/pull/2143 +[#2341]: https://github.com/gchq/CyberChef/pull/2341 +[#2478]: https://github.com/gchq/CyberChef/pull/2478 +[#2479]: https://github.com/gchq/CyberChef/pull/2479 +[#2463]: https://github.com/gchq/CyberChef/pull/2463 +[#2468]: https://github.com/gchq/CyberChef/pull/2468 +[#2385]: https://github.com/gchq/CyberChef/pull/2385 +[#2467]: https://github.com/gchq/CyberChef/pull/2467 +[#2443]: https://github.com/gchq/CyberChef/pull/2443 +[#2417]: https://github.com/gchq/CyberChef/pull/2417 +[#2461]: https://github.com/gchq/CyberChef/pull/2461 +[#2438]: https://github.com/gchq/CyberChef/pull/2438 +[#2439]: https://github.com/gchq/CyberChef/pull/2439 +[#2441]: https://github.com/gchq/CyberChef/pull/2441 +[#2442]: https://github.com/gchq/CyberChef/pull/2442 +[#2425]: https://github.com/gchq/CyberChef/pull/2425 +[#2428]: https://github.com/gchq/CyberChef/pull/2428 +[#2429]: https://github.com/gchq/CyberChef/pull/2429 +[#2430]: https://github.com/gchq/CyberChef/pull/2430 +[#2431]: https://github.com/gchq/CyberChef/pull/2431 +[#2412]: https://github.com/gchq/CyberChef/pull/2412 +[#2339]: https://github.com/gchq/CyberChef/pull/2339 +[#2389]: https://github.com/gchq/CyberChef/pull/2389 +[#2403]: https://github.com/gchq/CyberChef/pull/2403 +[#2402]: https://github.com/gchq/CyberChef/pull/2402 +[#2401]: https://github.com/gchq/CyberChef/pull/2401 +[#2387]: https://github.com/gchq/CyberChef/pull/2387 +[#2384]: https://github.com/gchq/CyberChef/pull/2384 +[#2386]: https://github.com/gchq/CyberChef/pull/2386 +[#2388]: https://github.com/gchq/CyberChef/pull/2388 +[#2378]: https://github.com/gchq/CyberChef/pull/2378 +[#2379]: https://github.com/gchq/CyberChef/pull/2379 +[#2372]: https://github.com/gchq/CyberChef/pull/2372 +[#2368]: https://github.com/gchq/CyberChef/pull/2368 +[#2370]: https://github.com/gchq/CyberChef/pull/2370 +[#2371]: https://github.com/gchq/CyberChef/pull/2371 +[#2369]: https://github.com/gchq/CyberChef/pull/2369 +[#1882]: https://github.com/gchq/CyberChef/pull/1882 +[#2354]: https://github.com/gchq/CyberChef/pull/2354 +[#2363]: https://github.com/gchq/CyberChef/pull/2363 +[#2364]: https://github.com/gchq/CyberChef/pull/2364 +[#2365]: https://github.com/gchq/CyberChef/pull/2365 +[#2366]: https://github.com/gchq/CyberChef/pull/2366 +[#2367]: https://github.com/gchq/CyberChef/pull/2367 +[#2361]: https://github.com/gchq/CyberChef/pull/2361 +[#2332]: https://github.com/gchq/CyberChef/pull/2332 +[#2353]: https://github.com/gchq/CyberChef/pull/2353 +[#2351]: https://github.com/gchq/CyberChef/pull/2351 diff --git a/Dockerfile b/Dockerfile index 6e6ee6f6..5bab956e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds # This is because npm "chromedriver" package is not compatiable with all platforms # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation -FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS builder +FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:fb71d01345f11b708a3553c66e7c74074f2d506400ea81973343d915cb64eef0 AS builder WORKDIR /app @@ -27,7 +27,7 @@ RUN npm run build ######################################### # Package static build files into nginx # ######################################### -FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:0a1e718ff1e1a22fc519d0c2e5b6872681f01e37c8a2817ec43ce6e716103929 AS cyberchef +FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:37f356a5eba5d187365b4f59cd6cc29f1f922ad18146d554b576a80983377e6a AS cyberchef LABEL maintainer="GCHQ " diff --git a/package-lock.json b/package-lock.json index e31e9bab..5125275a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "cyberchef", - "version": "11.0.0", + "version": "11.1.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cyberchef", - "version": "11.0.0", + "version": "11.1.0", "hasInstallScript": true, "license": "Apache-2.0", "dependencies": { @@ -21,7 +21,7 @@ "assert": "^2.1.0", "avsc": "^5.7.9", "bcryptjs": "^3.0.3", - "bignumber.js": "^11.1.2", + "bignumber.js": "^11.1.3", "blakejs": "^1.2.1", "bootstrap": "4.6.2", "bootstrap-colorpicker": "^3.4.0", @@ -39,7 +39,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^9.0.0", - "dompurify": "^3.4.7", + "dompurify": "^3.4.8", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -85,7 +85,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^8.5.0", + "protobufjs": "^8.6.2", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -94,7 +94,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.8.0", + "sql-formatter": "^15.8.1", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^7.0.0", @@ -118,7 +118,7 @@ "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.7.0", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.43.0", + "@codemirror/view": "^6.43.1", "@puppeteer/browsers": "3.0.4", "autoprefixer": "^10.5.0", "babel-loader": "^10.1.1", @@ -1898,9 +1898,9 @@ } }, "node_modules/@codemirror/view": { - "version": "6.43.0", - "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.0.tgz", - "integrity": "sha512-V7ZCLQO3Jus9hzh2jVCCPW3mO4IBMr43O37PqSUYautJSnnJF41YlgLw21x0fLJTYvJ+Vkm6Gp+qKGH9pltgXA==", + "version": "6.43.1", + "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.1.tgz", + "integrity": "sha512-+BIjw/AG3tDQ4pJgTLPYdAW25eDE66YsvM4LKyVPgGzVgZ4a9Wj1SRX8kPVKgBDdPt8oHtZ15F0qx7p0oOHdHw==", "dev": true, "license": "MIT", "dependencies": { @@ -5794,9 +5794,9 @@ } }, "node_modules/bignumber.js": { - "version": "11.1.2", - "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-11.1.2.tgz", - "integrity": "sha512-9idDyC15Vpk+53w4OfxEu2PqHSKFQUffrH1oTvnkJ9fduTJ032tpuI2sxS04oCzocklokWUZmWVEkTEQdLmUOQ==", + "version": "11.1.3", + "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-11.1.3.tgz", + "integrity": "sha512-+esZiNSo6VgFokTsYX6mYqNJfFd/IczzZCd4Z7cR8e+AQWhvIcj6nqQ1h9814D9u/TApU0jjTVmfWL0Pd1ZBdA==", "license": "MIT" }, "node_modules/binary-extensions": { @@ -8585,9 +8585,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.7", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.7.tgz", - "integrity": "sha512-2jBxDJY4RR06tQNy4w5FlFH7kfxsQZlufd0sbv+chfHCxeJwrFw2baUDsSwvBISD4K4RDbd0PTfy3uNXsR6siA==", + "version": "3.4.8", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.8.tgz", + "integrity": "sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -15086,10 +15086,9 @@ "license": "MIT" }, "node_modules/protobufjs": { - "version": "8.5.0", - "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.5.0.tgz", - "integrity": "sha512-df1jWDPA5VIBNRtuAHjqr09f2qN5D4Vke1wYqOQg1XJ7ZDpA7BD6L7E4tyChgGRLB5hqk2m79Zsy0WHwV9a84A==", - "hasInstallScript": true, + "version": "8.6.2", + "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.2.tgz", + "integrity": "sha512-CCERJxzRvKMeEdJSLwdQf40TXWNPc8M4RkN7j/lxY6FQB+4do8rETWqj60AqxP9n0XIsxnSefZ8uhAaGKg2njw==", "license": "BSD-3-Clause", "dependencies": { "long": "^5.3.2" @@ -16775,9 +16774,9 @@ "license": "BSD-3-Clause" }, "node_modules/sql-formatter": { - "version": "15.8.0", - "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.8.0.tgz", - "integrity": "sha512-HnjdRHlSsO4Ap2erB5YXAvWggrnk/S4TezUn8zmpq9J/hEKn9+6gGaqiKPyDtI10Xf4zJmHYPREGjMjZmmP1fg==", + "version": "15.8.1", + "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.8.1.tgz", + "integrity": "sha512-nT2r90kTEYBuse9fe4r1Rp78v1mOBD35KsGc07Vo9eQSVa1TcTSnCS0zouf6BCmdzvmqBsBW+cYuBoYkHO/OWg==", "license": "MIT", "dependencies": { "argparse": "^2.0.1", diff --git a/package.json b/package.json index 5cf36e96..8439ed01 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cyberchef", - "version": "11.0.0", + "version": "11.1.0", "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.", "author": "GCHQ ", "homepage": "https://gchq.github.io/CyberChef", @@ -48,7 +48,7 @@ "@codemirror/language": "^6.12.3", "@codemirror/search": "^6.7.0", "@codemirror/state": "^6.5.4", - "@codemirror/view": "^6.43.0", + "@codemirror/view": "^6.43.1", "@puppeteer/browsers": "3.0.4", "autoprefixer": "^10.5.0", "babel-loader": "^10.1.1", @@ -105,7 +105,7 @@ "assert": "^2.1.0", "avsc": "^5.7.9", "bcryptjs": "^3.0.3", - "bignumber.js": "^11.1.2", + "bignumber.js": "^11.1.3", "blakejs": "^1.2.1", "bootstrap": "4.6.2", "bootstrap-colorpicker": "^3.4.0", @@ -123,7 +123,7 @@ "d3": "7.9.0", "d3-hexbin": "^0.2.2", "diff": "^9.0.0", - "dompurify": "^3.4.7", + "dompurify": "^3.4.8", "es6-promisify": "^7.0.0", "escodegen": "^2.1.0", "esprima": "^4.0.1", @@ -169,7 +169,7 @@ "path": "^0.12.7", "popper.js": "^1.16.1", "process": "^0.11.10", - "protobufjs": "^8.5.0", + "protobufjs": "^8.6.2", "punycode.js": "^2.3.1", "qr-image": "^3.2.0", "reflect-metadata": "^0.2.2", @@ -178,7 +178,7 @@ "snackbarjs": "^1.1.0", "sortablejs": "^1.15.7", "split.js": "^1.6.5", - "sql-formatter": "^15.8.0", + "sql-formatter": "^15.8.1", "ssdeep.js": "0.0.3", "stream-browserify": "^3.0.0", "tesseract.js": "^7.0.0", diff --git a/src/core/operations/GenerateLoremIpsum.mjs b/src/core/operations/GenerateLoremIpsum.mjs index 7bc636ac..5065f331 100644 --- a/src/core/operations/GenerateLoremIpsum.mjs +++ b/src/core/operations/GenerateLoremIpsum.mjs @@ -8,6 +8,10 @@ import Operation from "../Operation.mjs"; import OperationError from "../errors/OperationError.mjs"; import { GenerateParagraphs, GenerateSentences, GenerateWords, GenerateBytes } from "../lib/LoremIpsum.mjs"; +// arbitrary limits set to avoid DoS by requesting ridiculous amounts of data +const maxLoremWords = 100_000; // same limit also used for paragraphs/sentences +const maxLoremCharacters = 1_000_000; + /** * Generate Lorem Ipsum operation */ @@ -47,9 +51,7 @@ class GenerateLoremIpsum extends Operation { */ run(input, args) { const [length, lengthType] = args; - if (length < 1) { - throw new OperationError("Length must be greater than 0"); - } + checkLimits(lengthType, length); switch (lengthType) { case "Paragraphs": return GenerateParagraphs(length); @@ -68,3 +70,32 @@ class GenerateLoremIpsum extends Operation { } export default GenerateLoremIpsum; + +/** + * check combined validity of lengthType and length arguments + * @param {string} lengthType + * @param {number} length + * @throws {OperationError} + */ +function checkLimits(lengthType, length) { + if (length < 1) { + throw new OperationError("Length must be greater than 0"); + } + + switch (lengthType) { + case "Paragraphs": + case "Sentences": + case "Words": + if (length > maxLoremWords) { + throw new OperationError("Length must be less than " + maxLoremWords); + } + break; + case "Bytes": + if (length > maxLoremCharacters) { + throw new OperationError("Length must be less than " + maxLoremCharacters); + } + break; + default: + throw new OperationError("Invalid length type"); + } +} diff --git a/tests/operations/tests/GenerateLoremIpsum.mjs b/tests/operations/tests/GenerateLoremIpsum.mjs new file mode 100644 index 00000000..c42bf8da --- /dev/null +++ b/tests/operations/tests/GenerateLoremIpsum.mjs @@ -0,0 +1,80 @@ +/** + * Generate Lorem Ipsum tests + * + * @author GCHQDeveloper581 + * @copyright Crown Copyright 2025 + * @license Apache-2.0 + */ +import TestRegister from "../../lib/TestRegister.mjs"; + +TestRegister.addTests([ + { + name: "Generate Lorem Ipsum: Exceeds Word Limit", + input: "", + expectedOutput: "Length must be less than 100000", + recipeConfig: [ + { + "op": "Generate Lorem Ipsum", + "args": [999_999, "Words"] + }, + ], + }, + { + name: "Generate Lorem Ipsum: Within Word Limit", + input: "", + // each word is >= 3 characters long, so expect at least 3000 characters + expectedMatch: /.{3000,}/s, + recipeConfig: [ + { + "op": "Generate Lorem Ipsum", + "args": [1000, "Words"] + }, + ], + }, + { + name: "Generate Lorem Ipsum: Exceeds Byte Limit", + input: "", + expectedOutput: "Length must be less than 1000000", + recipeConfig: [ + { + "op": "Generate Lorem Ipsum", + "args": [1_000_001, "Bytes"] + }, + ], + }, + { + name: "Generate Lorem Ipsum: Exceeds Sentence Limit", + input: "", + expectedOutput: "Length must be less than 100000", + recipeConfig: [ + { + "op": "Generate Lorem Ipsum", + "args": [999_999, "Sentences"] + }, + ], + }, + { + name: "Generate Lorem Ipsum: Exceeds Paragraph Limit", + input: "", + expectedOutput: "Length must be less than 100000", + recipeConfig: [ + { + "op": "Generate Lorem Ipsum", + "args": [999_999, "Paragraphs"] + }, + ], + }, + { + name: "Generate Lorem Ipsum: Incorrect lengthType", + input: "", + expectedOutput: "Invalid length type", + recipeConfig: [ + { + "op": "Generate Lorem Ipsum", + "args": [999_999, "Novels"] + }, + ], + }, + + +]);