Merge branch 'master' into fix-2247

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
 {
 	"name": "CyberChef",
 	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-	"image": "mcr.microsoft.com/devcontainers/javascript-node:1-18-bookworm",
+	"image": "mcr.microsoft.com/devcontainers/javascript-node:24-trixie",
 
 	// Features to add to the dev container. More info: https://containers.dev/features.
 	"features": {

.github/dependabot.yml

@@ -15,6 +15,8 @@ updates:
       day: 'friday'
       time: '03:00'
       timezone: Europe/London
+    cooldown:
+      default-days: 2
     commit-message:
       prefix: 'chore (deps): '
     ignore:
@@ -25,16 +27,10 @@ updates:
       # see issue #2214 for rationale for each of these
       - dependency-name: '@xmldom/xmldom'
         versions: [ '>=0.9.0' ]
-      - dependency-name: 'bcryptjs'
-        versions: [ '>=3.0.0' ]
       - dependency-name: 'bootstrap'
         versions: [ '>=5.0.0' ]
-      - dependency-name: 'bson'
-        versions: [ '>=5.0.0' ]
       - dependency-name: 'cbor'
         versions: [ '>=10.0.0' ]
-      - dependency-name: 'cspell'
-        versions: [ '>=9.0.0' ]
       - dependency-name: 'eslint'
         versions: [ '>=10.0.0' ]
       - dependency-name: 'eslint-plugin-jsdoc'
@@ -43,13 +39,14 @@ updates:
         versions: [ '>=0.4.0' ]
       - dependency-name: 'geodesy'
         versions: [ '>=2.0.0' ]
-      - dependency-name: 'otpauth'
+      - dependency-name: 'jimp'
-        versions: [ '>=9.4.0' ]
+        versions: [ '1.6.1' ]
-      - dependency-name: 'webpack-dev-server'
+      - dependency-name: 'jq-web'
-        versions: [ '>=5.1.0' ]
+        versions: [ '>=0.6.0' ]
     groups:
       #
-      # Grouping so we don't get a seperate PR for every patch version.
+      # Grouping so patch version updates are batched together in a single PR 
+      # and similarly with minor version updates
       #
       patch-updates:
         applies-to: version-updates
@@ -57,16 +54,44 @@ updates:
           - '*'
         update-types:
           - 'patch'
+      minor-updates:
+        applies-to: version-updates
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
 
-  # Can't enable this until we are using Node 24 as the latest actions all require this version
+  # Versioning on Github Actions
-  # - package-ecosystem: "github-actions"
+  - package-ecosystem: "github-actions"
-  #   # Workflow files stored in the default location of `.github/workflows`; no need to
+    # Workflow files stored in the default location of `.github/workflows`; no need to
-  #   # specify `/.github/workflows` for `directory`
+    # specify `/.github/workflows` for `directory`
-  #   directory: '/'
+    directory: '/'
-  #   schedule:
+    schedule:
-  #     interval: 'weekly'
+      interval: 'weekly'
-  #     day: 'friday'
+      day: 'friday'
-  #     time: '03:00'
+      time: '03:00'
-  #     timezone: Europe/London
+      timezone: Europe/London
-  #   commit-message:
+    cooldown:
-  #     prefix: 'chore (deps): '
+      default-days: 4
+    commit-message:
+      prefix: 'chore (deps): '
+    groups:
+      actions-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: 'weekly'
+      day: 'friday'
+      time: '03:00'
+      timezone: Europe/London
+    cooldown:
+      default-days: 4
+    commit-message:
+      prefix: 'chore (deps): '
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"

.github/workflows/master.yml

@@ -16,18 +16,17 @@ jobs:
       pages: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 18
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
       - name: Install
         run: |
-          export DETECT_CHROMEDRIVER_VERSION=true
+          npm ci
-          npm install
           npm run setheapsize
 
       - name: Lint
@@ -45,9 +44,17 @@ jobs:
       - name: Generate sitemap
         run: npx grunt exec:sitemap
 
+      - name: Setup Chrome
+        id: setup-chrome
+        if: success()
+        run: |
+          npx @puppeteer/browsers install chrome@148
+          echo chromedir=$(dirname $(find `pwd`/chrome/* -name chrome -print -quit)) >> $GITHUB_OUTPUT
+
       - name: UI Tests
         if: success()
         run: |
+          export PATH=${{ steps.setup-chrome.outputs.chromedir }}:$PATH
           sudo apt-get install xvfb
           xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui
 
@@ -57,7 +64,7 @@ jobs:
 
       - name: Deploy to GitHub Pages
         if: success() && github.ref == 'refs/heads/master'
-        uses: crazy-max/ghaction-github-pages@v3
+        uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0
         with:
           target_branch: gh-pages
           build_dir: ./build/prod

.github/workflows/pull_requests.yml

@@ -12,18 +12,17 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 18
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
       - name: Install
         run: |
-          export DETECT_CHROMEDRIVER_VERSION=true
+          npm ci
-          npm install
           npm run setheapsize
 
       - name: Lint
@@ -38,20 +37,38 @@ jobs:
         if: success()
         run: npx grunt prod
 
+      - name: Upload Build Artefact
+        if: success()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: zipped-build
+          path: build/prod/*.zip
+          retention-days: 5
+
+      - name: Setup Chrome
+        id: setup-chrome
+        if: success()
+        run: |
+          npx @puppeteer/browsers install chrome@148
+          echo chromedir=$(dirname $(find `pwd`/chrome/* -name chrome -print -quit)) >> $GITHUB_OUTPUT
+
+      - name: UI Tests
+        if: success()
+        run: |
+          export PATH=${{ steps.setup-chrome.outputs.chromedir }}:$PATH
+          sudo apt-get install xvfb
+          xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui
+
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        if: success()
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Production Image Build
         if: success()
         id: build-image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
-      - name: UI Tests
-        if: success()
-        run: |
-          sudo apt-get install xvfb
-          xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui

.github/workflows/releases.yml

@@ -22,17 +22,16 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 18
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
       - name: Install
         run: |
-          export DETECT_CHROMEDRIVER_VERSION=true
           npm ci
           npm run setheapsize
 
@@ -47,20 +46,29 @@ jobs:
       - name: Production Build
         run: npx grunt prod
 
-      - name: UI Tests
+      - name: Setup Chrome
+        id: setup-chrome
+        if: success()
         run: |
+          npx @puppeteer/browsers install chrome@148
+          echo chromedir=$(dirname $(find `pwd`/chrome/* -name chrome -print -quit)) >> $GITHUB_OUTPUT
+
+      - name: UI Tests
+        if: success()
+        run: |
+          export PATH=${{ steps.setup-chrome.outputs.chromedir }}:$PATH
           sudo apt-get install xvfb
           xvfb-run --server-args="-screen 0 1200x800x24" npx grunt testui
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Image Metadata
         id: image-metadata
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -69,24 +77,24 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.REGISTRY_USER }}
           password: ${{ env.REGISTRY_PASSWORD }}
 
       - name: Publish to GHCR
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: true
           tags: ${{ steps.image-metadata.outputs.tags }}
           labels: ${{ steps.image-metadata.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm64,linux/arm/v7
 
       - name: Upload Release Assets
         id: upload-release-assets
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: build/prod/*.zip
@@ -102,12 +110,12 @@ jobs:
     needs: main
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 18
+          node-version: 24
           registry-url: "https://registry.npmjs.org"
 
       - name: Install
@@ -116,11 +124,5 @@ jobs:
       - name: Create machine generated files
         run: npm run node
 
-      - name: Reset node version ready for publish
-        uses: actions/setup-node@v6
-        with:
-          node-version: ^24.5
-          registry-url: "https://registry.npmjs.org"
-
       - name: Publish to NPM
         run: npm publish

.gitignore

@@ -10,6 +10,8 @@ src/core/config/OperationConfig.json
 src/core/operations/index.mjs
 src/node/config/OperationConfig.json
 src/node/index.mjs
+tests/operations/index.mjs
 **/*.DS_Store
 tests/browser/output/*
 .node-version
+chrome

.nvmrc

@@ -1 +1 @@
-18
+24

CHANGELOG.md

@@ -13,6 +13,184 @@ All major and minor version changes will be documented in this file. Details of
 
 ## Details
 
+### [11.2.0] - 2026-06-17
+This release includes a security fix ([#2569])
+- Security: Chart operation prototype protection [@C85297] | [#2569]
+- Update website references [@C85297] | [#2566]
+- Fix: Add input validation for XOR Checksum blocksize (#2537) [@dweep-js] | [#2542]
+- Fix: Reverse highlights unwind incorrectly [@kendallgoto] [@C85297] | [#2022]
+- Fix Uint8Array concat crash in Parse IPv4 header [@Zish19] | [#2409]
+- Fix typos and documentation errors (bytes→bits, wrong release link, spelling) [@qa2me] [@GCHQDeveloper581] | [#2404]
+- Add integer check for alphabet size [@heapframe] [@GCHQDeveloper581] | [#2458]
+- fix: validate hexdump width upper bound [@skyswordw] | [#2514]
+
+### [11.1.0] - 2026-06-13
+This release includes a security fix ([#2557])
+- Security: Add fix, and tests, for Lorem Ipsum DoS issue [@GCHQDeveloper581] | [#2557]
+- chore (deps): bump the patch-updates group with 4 updates  | [#2552]
+- chore (deps): bump the actions-dependencies group with 2 updates  | [#2551]
+- chore (deps): bump the docker-dependencies group with 2 updates  | [#2550]
+- chore (deps): bump protobufjs from 8.5.0 to 8.6.2 in the minor-updates group  | [#2553]
+- Security Policy Update [@C85297] | [#2547]
+- Fix spurious error messages generated during webpack build [@GCHQDeveloper581] | [#2545]
+- chore (deps): bump shell-quote from 1.8.3 to 1.8.4  | [#2543]
+- Implementing ROR13 feature [@Fufu-btw] | [#2539]
+- New operation improvements [@jl5193] [@GCHQDeveloper581] | [#1431]
+- Npm and yarn/major version updates [@GCHQDeveloper581] | [#2527]
+- Update README to reflect AES Decrypt changes [@andreasrtv] | [#2502]
+- feat: add Escape Smart Characters operation [@HarelKatz] | [#2391]
+- feat: Get AES IV from input (QoL) [@andreasrtv] | [#2471]
+- fix: validate text encoding options [@SyedIshmumAhnaf] | [#2497]
+- chore (deps): bump the minor-updates group with 5 updates [@GCHQDeveloper581] | [#2500]
+- chore (deps): bump the patch-updates group with 2 updates  | [#2499]
+- chore (deps): bump nginxinc/nginx-unprivileged from `df0e9ed` to `0a1e718` in the docker-dependencies group  | [#2498]
+- Add remove ANSI escape codes operation [@Louis-Ladd] [@GCHQDeveloper581] | [#2143]
+- Fix option ingredients being overwriten [@C85297] | [#2341]
+- chore (deps): bump qs and express  | [#2478]
+- chore (deps): bump tmp from 0.2.5 to 0.2.7  | [#2479]
+- chore (deps): bump the patch-updates group across 1 directory with 6 updates  | [#2463]
+- chore (deps): bump the docker-dependencies group across 1 directory with 2 updates  | [#2468]
+- chore (deps): bump terser from 5.46.2 to 5.48.0  | [#2385]
+- Make dependabot quieter [@GCHQDeveloper581] | [#2467]
+- update sitemap [@Blank0120] | [#2443]
+- Bump webpack-dev-server to 5.2.4 [@GCHQDeveloper581] | [#2417]
+- Fix pgp tests [@GCHQDeveloper581] [@C85297] | [#2461]
+- chore (deps): bump the patch-updates group across 1 directory with 4 updates  | [#2438]
+- chore (deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0  | [#2439]
+- chore (deps): bump docker/login-action from 4.1.0 to 4.2.0  | [#2441]
+- chore (deps): bump docker/metadata-action from 6.0.0 to 6.1.0  | [#2442]
+- update bson [@Blank0120] [@GCHQDeveloper581] | [#2425]
+- chore (deps): bump webpack from 5.106.2 to 5.107.1  | [#2428]
+- chore (deps): bump protobufjs from 7.5.8 to 7.6.0  | [#2429]
+- chore (deps): bump sql-formatter from 15.7.4 to 15.8.0  | [#2430]
+- chore (deps): bump docker/build-push-action from 7.1.0 to 7.2.0  | [#2431]
+- Fix flaky `npm run testui` [@lzandman] | [#2412]
+- Include git ref in website download zip name [@C85297] | [#2339]
+- Bump nginxinc/nginx-unprivileged from `808f784` to `b9f7ba1`  | [#2389]
+- Series Chart HTML Formatting fix [@C85297] | [#2403]
+- Parse Ethernet Frame HTML formatting fix [@C85297] | [#2402]
+- Parse IPv4 Header HTML formatting fix [@C85297] | [#2401]
+- Update chromedriver, and install corresponding chrome in workflows (fixes build) [@GCHQDeveloper581] | [#2387]
+- chore (deps): bump @codemirror/view from 6.41.1 to 6.43.0  | [#2384]
+- chore (deps): bump globals from 17.5.0 to 17.6.0  | [#2386]
+- chore (deps): bump the patch-updates group across 1 directory with 3 updates  | [#2388]
+- [StepSecurity] Apply security best practices [@GCHQDeveloper581] StepSecurity Bot <bot@stepsecurity.io> | [#2378]
+- Build docker container for arm v7 as well [@GCHQDeveloper581] | [#2379]
+- chore (deps): bump fast-uri from 3.1.0 to 3.1.2  | [#2372]
+- update bcryptjs [@C85297] [@GCHQDeveloper581] | [#2368]
+- chore (deps): bump picomatch from 2.3.1 to 2.3.2  | [#2370]
+- chore (deps): bump ip-address from 10.1.0 to 10.2.0  | [#2371]
+- chore (deps): bump axios from 1.15.0 to 1.16.0  | [#2369]
+- feat(operation-wrap): add new Wrap operation to format text at specified line width [@0xff1ce] | [#1882]
+- chore (deps): bump the patch-updates group across 1 directory with 5 updates  | [#2354]
+- chore (deps): bump docker/login-action from 3 to 4  | [#2363]
+- chore (deps): bump docker/setup-buildx-action from 3 to 4  | [#2364]
+- chore (deps): bump crazy-max/ghaction-github-pages from 3 to 5  | [#2365]
+- chore (deps): bump docker/metadata-action from 4 to 6  | [#2366]
+- chore (deps): bump docker/setup-qemu-action from 3 to 4  | [#2367]
+- Update dependabot for Node 24. [@GCHQDeveloper581] | [#2361]
+- chore (deps): bump uuid from 13.0.0 to 14.0.0  | [#2332]
+- chore (deps): bump webpack-bundle-analyzer from 5.2.0 to 5.3.0  | [#2353]
+- Fix all zeros after 16384 bytes with Blake3 [@zachbowden] [@GCHQDeveloper581] | [#2351]
+
+## [11.0.0] - 2026-04-28
+- Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348]
+- Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347]
+- Fix XSS in Show Base64 offsets [@C85297] | [#2346]
+- Make compatible with node >=22 [@GCHQDeveloper581] | [#2273]
+- Fix(node): enable asynchronous operation support in Node.js API [@engin0223] [@GCHQDeveloper581] | [#2342]
+- Feature: Change to nginx-unprivileged image for better kubernetes support [@hsolberg] | [#1922]
+
+Breaking changes:
+- Minimum supported node version - now v24 (was v16)
+- Change of exported port on Docker Container - now 8080 (was 80)
+- Node API now exports "bake" and "execute" functions as async.
+
+<details>
+    <summary>Click to expand v10 minor versions</summary>
+
+### [10.24.0] - 2026-04-27
+- Update CONTRIBUTING.md [@GCHQDeveloper581] | [#2333]
+- Fix, and link, Fernet tests [@GCHQDeveloper581] | [#2335]
+- [#927] added parity bit operation [@j83305] | [#1036]
+- Feature md link blanks [@BjoernAkAManf] [@GCHQDeveloper581] | [#660]
+- Accessibility - Add support for screenreaders in operations search [@mattnotmitt] | [#1862]
+- Added metadata extraction for UUID strings. [@ko80240] | [#2322]
+- chore (deps): bump the patch-updates group with 6 updates  | [#2330]
+- chore (deps): bump @codemirror/search from 6.6.0 to 6.7.0  | [#2331]
+- (Feature) Improve CI [@GCHQDeveloper581] | [#2328]
+- Update dependabot.yml [@GCHQDeveloper581] | [#2326]
+- chore (deps): bump lodash, grunt-legacy-log and grunt-legacy-util  | [#2327]
+- chore (deps): bump the patch-updates group with 6 updates [@GCHQDeveloper581] | [#2323]
+- chore (deps): bump autoprefixer from 10.4.27 to 10.5.0  | [#2324]
+- chore (deps): bump dompurify from 3.3.3 to 3.4.0  | [#2321]
+- chore (deps): bump follow-redirects from 1.15.11 to 1.16.0  | [#2320]
+- Regular Expression operation email address regex: Support IPv4 domains [@C85297] [@GCHQDeveloper581] | [#2167]
+- Rewriting fixCryptoApiImports and fixSnackbarMarkup to js to make it OS agnostic [@BigYellowHammer] | [#2298]
+- chore (deps): bump basic-ftp from 5.2.1 to 5.2.2  | [#2317]
+- chore (deps): bump axios from 1.13.6 to 1.15.0  | [#2316]
+- chore (deps): bump webpack from 5.105.4 to 5.106.0  | [#2315]
+- chore (deps): bump basic-ftp from 5.2.0 to 5.2.1  | [#2313]
+- Update vulnerable dependencies [@GCHQDeveloper581] | [#2311]
+
+### [10.23.0] - 2026-04-06
+- Properly escape HTML entities in sampleDelim to avoid XSS issue [@GCHQDeveloper581] | [#2307]
+- chore (deps): bump lodash from 4.17.23 to 4.18.1  | [#2304]
+- chore (deps): bump @codemirror/view from 6.40.0 to 6.41.0  | [#2305]
+- chore (deps): bump the patch-updates group with 2 updates  | [#2303]
+- chore (deps): bump @xmldom/xmldom from 0.8.11 to 0.8.12  | [#2302]
+- chore (deps): bump picomatch  | [#2299]
+- chore (deps): bump node-forge from 1.3.3 to 1.4.0  | [#2297]
+- chore (deps): bump the patch-updates group with 3 updates | [#2296]
+- chore (deps) bump chromedriver from 130.0.4 to 146.0.6 [@GCHQDeveloper581] | [#2292]
+- ParseEthernetFrame - Fix vlan calculation [@Kalkran] | [#2295]
+- Add pull request template with AI usage disclosure [@C85297] | [#2279]
+- fix: return empty output for zero-length To Modhex input [@saschabuehrle] | [#2249]
+- Added tab focus to top banner and navigation to About/Support Modal [@j264415] | [#1733]
+- Add Parse Ethernet frame Operation, allow Parse IPv4 Header to cascade [@Kalkran] | [#1722]
+- Selection and Deselection of autobake checkbox using keyboard [@j264415] | [#1727]
+- chore (deps): bump @babel/runtime from 7.28.6 to 7.29.2  | [#2263]
+- Add more helpful error for when numerical ingredient is left empty [@Lamby777] [@C85297] | [#1540]
+- chore (deps): bump @codemirror/view from 6.39.17 to 6.40.0  | [#2262]
+- Bump flatted from 3.3.2 to 3.4.2 [@GCHQDeveloper581] | [#2266]
+- feat: add Raw option for Jq operation [@rtpt-romankarwacik] | [#2237]
+- chore (deps): bump core-js from 3.48.0 to 3.49.0  | [#2261]
+- chore (deps): bump the patch-updates group with 6 updates  | [#2260]
+- Add Extract Audio Metadata operation [@d0s1nt] [@GCHQDeveloper581] | [#2170]
+- Fix Jq issue [@GCHQDeveloper581] | [#2210]
+- Configure dependabot updates [@GCHQDeveloper581] | [#2259]
+- fix(A1Z26): return empty string instead of empty array for empty input [@brick-pixel] | [#2257]
+- Fix broken Docker link in README [@am-periphery] | [#2250]
+- Update some dependencies, including a number causing npm audit warnings [@GCHQDeveloper581] | [#2236]
+- Bump axios from 1.7.9 to 1.13.6  | [#2234]
+- Bump jws from 3.2.2 to 3.2.3  | [#2235]
+- Bump pbkdf2 from 3.1.2 to 3.1.5  | [#2229]
+- Bump form-data from 4.0.1 to 4.0.5  | [#2228]
+- Bump basic-ftp from 5.0.5 to 5.2.0  | [#2231]
+- feat: add ARM disassembler operation [@thomasxm] | [#2156]
+- Add Text/Integer Converter operation [@p-leriche] [@GCHQDeveloper581] | [#2213]
+- Feat/rc6 add RC6 Encrypt/Decrypt operations [@thomasxm] | [#2163]
+- [bugfix] Add Bootstrap form style for CodeMirror editor [@Swonkie] | [#2161]
+- Add Flask Session operations (Decode, Sign, Verify) [@ThePlayer372-FR] | [#2208]
+- fix: `jq-web` -> `jq-wasm`, includes `jq` version `1.8.1` [@W-Floyd] [@GCHQDeveloper581] | [#2223]
+- Bump jsonwebtoken from 8.5.1 to 9.0.0 [@GCHQDeveloper581] | [#2219]
+- Bump basic-ftp from 5.0.5 to 5.2.0  | [#2218]
+- feat: add random integer generation operation [@cktgh] | [#2151]
+- Add BigInt utility functions for number theory operations [@p-leriche] [@GCHQDeveloper581] | [#2205]
+- Improve SQL Beautify: use sql-formatter and support bind variables [@aby-jo] [@GCHQDeveloper581] | [#2071]
+- update tesseract.js to 6.0.1 [@atsiv1] | [#2133]
+- Fix hint tooltip display issues [@bartvanandel] | [#2017]
+- Simplify babel dependencies [@GCHQDeveloper581] | [#2204]
+- Dependency updates [@GCHQDeveloper581] | [#2201]
+- Fix: Move Magic checks from Escape to Unescape Unicode Characters [@fjh1997] | [#2195]
+- Paste spreadsheets as text [@C85297] | [#2200]
+- Fix Roboto Mono font [@C85297] | [#2199]
+- Fix return of buffer for PNG QR image generation [@GCHQDeveloper581] [@C85297] | [#2125]
+- Update JIMP [@C85297] | [#2171]
+- Overwrite NGINX maintainer label [@C85297] | [#2194]
+- Bump v10.22.1 [@GCHQDeveloper581] | [#2193]
+- Fix npm publish - Run "npm ci" and "npm run node" under node 18 then switch to node 24.5 [@GCHQDeveloper581] | [#2192]
+
 ### [10.22.0] - 2026-02-11
 - Separate npm publish out into separate job and run with Node 24.5 [@GCHQDeveloper581] | [#2188]
 - Fixed Percent delimiter for hex encoding [@beneri] [@C85297] | [#2137]
@@ -195,6 +373,8 @@ All major and minor version changes will be documented in this file. Details of
 - Added 'Levenshtein Distance' operation [@mikecat] | [#1498]
 - Added 'Swap case' operation [@mikecat] | [#1499]
 
+</details>
+
 ## [10.0.0] - 2023-03-22
 - [Full details explained here](https://github.com/gchq/CyberChef/wiki/Character-encoding,-EOL-separators,-and-editor-features)
 - Status bars added to the Input and Output [@n1474335] | [#1405]
@@ -538,6 +718,11 @@ All major and minor version changes will be documented in this file. Details of
 ## [4.0.0] - 2016-11-28
 -  Initial open source commit [@n1474335] | [b1d73a72](https://github.com/gchq/CyberChef/commit/b1d73a725dc7ab9fb7eb789296efd2b7e4b08306)
 
+[11.2.0]: https://github.com/gchq/CyberChef/releases/tag/v11.2.0
+[11.1.0]: https://github.com/gchq/CyberChef/releases/tag/v11.1.0
+[11.0.0]: https://github.com/gchq/CyberChef/releases/tag/v11.0.0
+[10.24.0]: https://github.com/gchq/CyberChef/releases/tag/v10.24.0
+[10.23.0]: https://github.com/gchq/CyberChef/releases/tag/v10.23.0
 [10.22.0]: https://github.com/gchq/CyberChef/releases/tag/v10.22.0
 [10.21.0]: https://github.com/gchq/CyberChef/releases/tag/v10.21.0
 [10.20.0]: https://github.com/gchq/CyberChef/releases/tag/v10.20.0
@@ -552,7 +737,7 @@ All major and minor version changes will be documented in this file. Details of
 [10.11.0]: https://github.com/gchq/CyberChef/releases/tag/v10.11.0
 [10.10.0]: https://github.com/gchq/CyberChef/releases/tag/v10.10.0
 [10.9.0]: https://github.com/gchq/CyberChef/releases/tag/v10.9.0
-[10.8.0]: https://github.com/gchq/CyberChef/releases/tag/v10.7.0
+[10.8.0]: https://github.com/gchq/CyberChef/releases/tag/v10.8.0
 [10.7.0]: https://github.com/gchq/CyberChef/releases/tag/v10.7.0
 [10.6.0]: https://github.com/gchq/CyberChef/releases/tag/v10.6.0
 [10.5.0]: https://github.com/gchq/CyberChef/releases/tag/v10.5.0
@@ -797,6 +982,42 @@ All major and minor version changes will be documented in this file. Details of
 [@t-martine]: https://github.com/t-martine
 [@wesinator]: https://github.com/wesinator
 [@Raka-loah]: https://github.com/Raka-loah
+[@Kalkran]: https://github.com/Kalkran
+[@saschabuehrle]: https://github.com/saschabuehrle
+[@j264415]: https://github.com/j264415
+[@Lamby777]: https://github.com/Lamby777
+[@rtpt-romankarwacik]: https://github.com/rtpt-romankarwacik
+[@d0s1nt]: https://github.com/d0s1nt
+[@brick-pixel]: https://github.com/brick-pixel
+[@am-periphery]: https://github.com/am-periphery
+[@p-leriche]: https://github.com/p-leriche
+[@Swonkie]: https://github.com/Swonkie
+[@ThePlayer372-FR]: https://github.com/ThePlayer372-FR
+[@W-Floyd]: https://github.com/W-Floyd
+[@cktgh]: https://github.com/cktgh
+[@aby-jo]: https://github.com/aby-jo
+[@atsiv1]: https://github.com/atsiv1
+[@fjh1997]: https://github.com/fjh1997
+[@j83305]: https://github.com/j83305
+[@BjoernAkAManf]: https://github.com/BjoernAkAManf
+[@ko80240]: https://github.com/ko80240
+[@BigYellowHammer]: https://github.com/BigYellowHammer
+[@hsolberg]: https://github.com/hsolberg
+[@lzandman]: https://github.com/lzandman
+[@engin0223]: https://github.com/engin0223
+[@Fufu-btw]: https://github.com/Fufu-btw
+[@jl5193]: https://github.com/jl5193
+[@andreasrtv]: https://github.com/andreasrtv
+[@HarelKatz]: https://github.com/HarelKatz
+[@SyedIshmumAhnaf]: https://github.com/SyedIshmumAhnaf
+[@Louis-Ladd]: https://github.com/Louis-Ladd
+[@Blank0120]: https://github.com/Blank0120
+[@zachbowden]: https://github.com/zachbowden
+[@dweep-js]: https://github.com/dweep-js
+[@Zish19]: https://github.com/Zish19
+[@qa2me]: https://github.com/qa2me
+[@heapframe]: https://github.com/heapframe
+[@skyswordw]: https://github.com/skyswordw
 
 
 [8ad18b]: https://github.com/gchq/CyberChef/commit/8ad18bc7db6d9ff184ba3518686293a7685bf7b7
@@ -1010,4 +1231,162 @@ All major and minor version changes will be documented in this file. Details of
 [#2183]: https://github.com/gchq/CyberChef/pull/2183
 [#2182]: https://github.com/gchq/CyberChef/pull/2182
 [#2181]: https://github.com/gchq/CyberChef/pull/2181
+[#2307]: https://github.com/gchq/CyberChef/pull/2307
+[#2304]: https://github.com/gchq/CyberChef/pull/2304
+[#2305]: https://github.com/gchq/CyberChef/pull/2305
+[#2303]: https://github.com/gchq/CyberChef/pull/2303
+[#2302]: https://github.com/gchq/CyberChef/pull/2302
+[#2299]: https://github.com/gchq/CyberChef/pull/2299
+[#2297]: https://github.com/gchq/CyberChef/pull/2297
+[#2296]: https://github.com/gchq/CyberChef/pull/2296
+[#2292]: https://github.com/gchq/CyberChef/pull/2292
+[#2295]: https://github.com/gchq/CyberChef/pull/2295
+[#2279]: https://github.com/gchq/CyberChef/pull/2279
+[#2249]: https://github.com/gchq/CyberChef/pull/2249
+[#1733]: https://github.com/gchq/CyberChef/pull/1733
+[#1722]: https://github.com/gchq/CyberChef/pull/1722
+[#1727]: https://github.com/gchq/CyberChef/pull/1727
+[#2263]: https://github.com/gchq/CyberChef/pull/2263
+[#1540]: https://github.com/gchq/CyberChef/pull/1540
+[#2262]: https://github.com/gchq/CyberChef/pull/2262
+[#2266]: https://github.com/gchq/CyberChef/pull/2266
+[#2237]: https://github.com/gchq/CyberChef/pull/2237
+[#2261]: https://github.com/gchq/CyberChef/pull/2261
+[#2260]: https://github.com/gchq/CyberChef/pull/2260
+[#2170]: https://github.com/gchq/CyberChef/pull/2170
+[#2210]: https://github.com/gchq/CyberChef/pull/2210
+[#2259]: https://github.com/gchq/CyberChef/pull/2259
+[#2257]: https://github.com/gchq/CyberChef/pull/2257
+[#2250]: https://github.com/gchq/CyberChef/pull/2250
+[#2236]: https://github.com/gchq/CyberChef/pull/2236
+[#2234]: https://github.com/gchq/CyberChef/pull/2234
+[#2235]: https://github.com/gchq/CyberChef/pull/2235
+[#2229]: https://github.com/gchq/CyberChef/pull/2229
+[#2228]: https://github.com/gchq/CyberChef/pull/2228
+[#2231]: https://github.com/gchq/CyberChef/pull/2231
+[#2156]: https://github.com/gchq/CyberChef/pull/2156
+[#2213]: https://github.com/gchq/CyberChef/pull/2213
+[#2163]: https://github.com/gchq/CyberChef/pull/2163
+[#2161]: https://github.com/gchq/CyberChef/pull/2161
+[#2208]: https://github.com/gchq/CyberChef/pull/2208
+[#2223]: https://github.com/gchq/CyberChef/pull/2223
+[#2219]: https://github.com/gchq/CyberChef/pull/2219
+[#2218]: https://github.com/gchq/CyberChef/pull/2218
+[#2151]: https://github.com/gchq/CyberChef/pull/2151
+[#2205]: https://github.com/gchq/CyberChef/pull/2205
+[#2071]: https://github.com/gchq/CyberChef/pull/2071
+[#2133]: https://github.com/gchq/CyberChef/pull/2133
+[#2017]: https://github.com/gchq/CyberChef/pull/2017
+[#2204]: https://github.com/gchq/CyberChef/pull/2204
+[#2201]: https://github.com/gchq/CyberChef/pull/2201
+[#2195]: https://github.com/gchq/CyberChef/pull/2195
+[#2200]: https://github.com/gchq/CyberChef/pull/2200
+[#2199]: https://github.com/gchq/CyberChef/pull/2199
+[#2125]: https://github.com/gchq/CyberChef/pull/2125
+[#2171]: https://github.com/gchq/CyberChef/pull/2171
+[#2194]: https://github.com/gchq/CyberChef/pull/2194
+[#2193]: https://github.com/gchq/CyberChef/pull/2193
+[#2192]: https://github.com/gchq/CyberChef/pull/2192
+[#2333]: https://github.com/gchq/CyberChef/pull/2333
+[#2335]: https://github.com/gchq/CyberChef/pull/2335
+[#1036]: https://github.com/gchq/CyberChef/pull/1036
+[#660]: https://github.com/gchq/CyberChef/pull/660
+[#1862]: https://github.com/gchq/CyberChef/pull/1862
+[#2322]: https://github.com/gchq/CyberChef/pull/2322
+[#2330]: https://github.com/gchq/CyberChef/pull/2330
+[#2331]: https://github.com/gchq/CyberChef/pull/2331
+[#2328]: https://github.com/gchq/CyberChef/pull/2328
+[#2326]: https://github.com/gchq/CyberChef/pull/2326
+[#2327]: https://github.com/gchq/CyberChef/pull/2327
+[#2323]: https://github.com/gchq/CyberChef/pull/2323
+[#2324]: https://github.com/gchq/CyberChef/pull/2324
+[#2321]: https://github.com/gchq/CyberChef/pull/2321
+[#2320]: https://github.com/gchq/CyberChef/pull/2320
+[#2167]: https://github.com/gchq/CyberChef/pull/2167
+[#2298]: https://github.com/gchq/CyberChef/pull/2298
+[#2317]: https://github.com/gchq/CyberChef/pull/2317
+[#2316]: https://github.com/gchq/CyberChef/pull/2316
+[#2315]: https://github.com/gchq/CyberChef/pull/2315
+[#2313]: https://github.com/gchq/CyberChef/pull/2313
+[#2311]: https://github.com/gchq/CyberChef/pull/2311
+[#2348]: https://github.com/gchq/CyberChef/pull/2348
+[#2347]: https://github.com/gchq/CyberChef/pull/2347
+[#2346]: https://github.com/gchq/CyberChef/pull/2346
+[#2273]: https://github.com/gchq/CyberChef/pull/2273
+[#2342]: https://github.com/gchq/CyberChef/pull/2342
+[#1922]: https://github.com/gchq/CyberChef/pull/1922
+[#2557]: https://github.com/gchq/CyberChef/pull/2557
+[#2552]: https://github.com/gchq/CyberChef/pull/2552
+[#2551]: https://github.com/gchq/CyberChef/pull/2551
+[#2550]: https://github.com/gchq/CyberChef/pull/2550
+[#2553]: https://github.com/gchq/CyberChef/pull/2553
+[#2547]: https://github.com/gchq/CyberChef/pull/2547
+[#2545]: https://github.com/gchq/CyberChef/pull/2545
+[#2543]: https://github.com/gchq/CyberChef/pull/2543
+[#2539]: https://github.com/gchq/CyberChef/pull/2539
+[#1431]: https://github.com/gchq/CyberChef/pull/1431
+[#2527]: https://github.com/gchq/CyberChef/pull/2527
+[#2502]: https://github.com/gchq/CyberChef/pull/2502
+[#2391]: https://github.com/gchq/CyberChef/pull/2391
+[#2471]: https://github.com/gchq/CyberChef/pull/2471
+[#2497]: https://github.com/gchq/CyberChef/pull/2497
+[#2500]: https://github.com/gchq/CyberChef/pull/2500
+[#2499]: https://github.com/gchq/CyberChef/pull/2499
+[#2498]: https://github.com/gchq/CyberChef/pull/2498
+[#2143]: https://github.com/gchq/CyberChef/pull/2143
+[#2341]: https://github.com/gchq/CyberChef/pull/2341
+[#2478]: https://github.com/gchq/CyberChef/pull/2478
+[#2479]: https://github.com/gchq/CyberChef/pull/2479
+[#2463]: https://github.com/gchq/CyberChef/pull/2463
+[#2468]: https://github.com/gchq/CyberChef/pull/2468
+[#2385]: https://github.com/gchq/CyberChef/pull/2385
+[#2467]: https://github.com/gchq/CyberChef/pull/2467
+[#2443]: https://github.com/gchq/CyberChef/pull/2443
+[#2417]: https://github.com/gchq/CyberChef/pull/2417
+[#2461]: https://github.com/gchq/CyberChef/pull/2461
+[#2438]: https://github.com/gchq/CyberChef/pull/2438
+[#2439]: https://github.com/gchq/CyberChef/pull/2439
+[#2441]: https://github.com/gchq/CyberChef/pull/2441
+[#2442]: https://github.com/gchq/CyberChef/pull/2442
+[#2425]: https://github.com/gchq/CyberChef/pull/2425
+[#2428]: https://github.com/gchq/CyberChef/pull/2428
+[#2429]: https://github.com/gchq/CyberChef/pull/2429
+[#2430]: https://github.com/gchq/CyberChef/pull/2430
+[#2431]: https://github.com/gchq/CyberChef/pull/2431
+[#2412]: https://github.com/gchq/CyberChef/pull/2412
+[#2339]: https://github.com/gchq/CyberChef/pull/2339
+[#2389]: https://github.com/gchq/CyberChef/pull/2389
+[#2403]: https://github.com/gchq/CyberChef/pull/2403
+[#2402]: https://github.com/gchq/CyberChef/pull/2402
+[#2401]: https://github.com/gchq/CyberChef/pull/2401
+[#2387]: https://github.com/gchq/CyberChef/pull/2387
+[#2384]: https://github.com/gchq/CyberChef/pull/2384
+[#2386]: https://github.com/gchq/CyberChef/pull/2386
+[#2388]: https://github.com/gchq/CyberChef/pull/2388
+[#2378]: https://github.com/gchq/CyberChef/pull/2378
+[#2379]: https://github.com/gchq/CyberChef/pull/2379
+[#2372]: https://github.com/gchq/CyberChef/pull/2372
+[#2368]: https://github.com/gchq/CyberChef/pull/2368
+[#2370]: https://github.com/gchq/CyberChef/pull/2370
+[#2371]: https://github.com/gchq/CyberChef/pull/2371
+[#2369]: https://github.com/gchq/CyberChef/pull/2369
+[#1882]: https://github.com/gchq/CyberChef/pull/1882
+[#2354]: https://github.com/gchq/CyberChef/pull/2354
+[#2363]: https://github.com/gchq/CyberChef/pull/2363
+[#2364]: https://github.com/gchq/CyberChef/pull/2364
+[#2365]: https://github.com/gchq/CyberChef/pull/2365
+[#2366]: https://github.com/gchq/CyberChef/pull/2366
+[#2367]: https://github.com/gchq/CyberChef/pull/2367
+[#2361]: https://github.com/gchq/CyberChef/pull/2361
+[#2332]: https://github.com/gchq/CyberChef/pull/2332
+[#2353]: https://github.com/gchq/CyberChef/pull/2353
+[#2351]: https://github.com/gchq/CyberChef/pull/2351
+[#2569]: https://github.com/gchq/CyberChef/pull/2569
+[#2566]: https://github.com/gchq/CyberChef/pull/2566
+[#2542]: https://github.com/gchq/CyberChef/pull/2542
+[#2022]: https://github.com/gchq/CyberChef/pull/2022
+[#2409]: https://github.com/gchq/CyberChef/pull/2409
+[#2404]: https://github.com/gchq/CyberChef/pull/2404
+[#2458]: https://github.com/gchq/CyberChef/pull/2458
+[#2514]: https://github.com/gchq/CyberChef/pull/2514
 

CONTRIBUTING.md

@@ -6,10 +6,13 @@ There are lots of opportunities to contribute to CyberChef. If you want ideas, t
 
 Before your contributions can be accepted, you must:
 
- - Sign the [GCHQ Contributor Licence Agreement](https://cla-assistant.io/gchq/CyberChef)
+ - Fork the CyberChef repo
+ - Create a new branch within your fork for the changes
  - Push your changes to your fork.
+ - Sign the [GCHQ Contributor Licence Agreement](https://cla-assistant.io/gchq/CyberChef)
  - Submit a pull request.
 
+Please note that we will ***reject*** pull requests from the master branch of your fork owing to the mess it makes of our own working repositories and the extra work entailed.
 
 ## Coding conventions
 

Dockerfile

@@ -4,7 +4,7 @@
 # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds
 # This is because npm "chromedriver" package is not compatiable with all platforms
 # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation
-FROM --platform=$BUILDPLATFORM node:18-alpine AS builder
+FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:156b55f92e98ccd5ef49578a8cea0df4679826564bad1c9d4ef04462b9f0ded6 AS builder
 
 WORKDIR /app
 
@@ -27,7 +27,7 @@ RUN npm run build
 #########################################
 # Package static build files into nginx #
 #########################################
-FROM nginx:stable-alpine AS cyberchef
+FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:fafa1102c789119971b3d83f9293f1ef5526bc73583a12e13ff5cd1299ed8b6c AS cyberchef
 
 LABEL maintainer="GCHQ <oss@gchq.gov.uk>"
 

Gruntfile.js

@@ -6,7 +6,7 @@ const BundleAnalyzerPlugin = require("webpack-bundle-analyzer").BundleAnalyzerPl
 const glob = require("glob");
 const path = require("path");
 
-const nodeFlags = "--experimental-modules --experimental-json-modules --experimental-specifier-resolution=node --no-warnings --no-deprecation";
+const nodeFlags = "--no-warnings --no-deprecation";
 
 /**
  * Grunt configuration for building the app in various formats.
@@ -89,6 +89,8 @@ module.exports = function (grunt) {
     const compileYear = grunt.template.today("UTC:yyyy"),
         compileTime = grunt.template.today("UTC:dd/mm/yyyy HH:MM:ss") + " UTC",
         pkg = grunt.file.readJSON("package.json"),
+        version = process.env.GITHUB_SHA || `v${pkg.version}`,
+        downloadZipFilename = `CyberChef_${version}.zip`,
         webpackConfig = require("./webpack.config.js"),
         BUILD_CONSTANTS = {
             COMPILE_YEAR: JSON.stringify(compileYear),
@@ -129,7 +131,9 @@ module.exports = function (grunt) {
                         chunks: ["main"],
                         compileYear: compileYear,
                         compileTime: compileTime,
-                        version: pkg.version,
+                        version: version,
+                        latestReleaseVersion: pkg.version,
+                        downloadZipFilename: downloadZipFilename,
                         minify: {
                             removeComments: true,
                             collapseWhitespace: true,
@@ -140,7 +144,8 @@ module.exports = function (grunt) {
                     new BundleAnalyzerPlugin({
                         analyzerMode: "static",
                         reportFilename: "BundleAnalyzerReport.html",
-                        openAnalyzer: false
+                        openAnalyzer: false,
+                        excludeAssets: /.*Worker.js/
                     }),
                 ]
             };
@@ -245,7 +250,7 @@ module.exports = function (grunt) {
                     "!build/prod/index.html",
                     "!build/prod/BundleAnalyzerReport.html",
                 ],
-                dest: `build/prod/CyberChef_v${pkg.version}.zip`
+                dest: `build/prod/${downloadZipFilename}`
             }
         },
         connect: {
@@ -333,12 +338,12 @@ module.exports = function (grunt) {
                     switch (process.platform) {
                         case "darwin":
                             return chainCommands([
-                                `shasum -a 256 build/prod/CyberChef_v${pkg.version}.zip | awk '{print $1;}' > build/prod/sha256digest.txt`,
+                                `shasum -a 256 build/prod/${downloadZipFilename} | awk '{print $1;}' > build/prod/sha256digest.txt`,
                                 `sed -i '' -e "s/DOWNLOAD_HASH_PLACEHOLDER/$(cat build/prod/sha256digest.txt)/" build/prod/index.html`
                             ]);
                         default:
                             return chainCommands([
-                                `sha256sum build/prod/CyberChef_v${pkg.version}.zip | awk '{print $1;}' > build/prod/sha256digest.txt`,
+                                `sha256sum build/prod/${downloadZipFilename} | awk '{print $1;}' > build/prod/sha256digest.txt`,
                                 `sed -i -e "s/DOWNLOAD_HASH_PLACEHOLDER/$(cat build/prod/sha256digest.txt)/" build/prod/index.html`
                             ]);
                     }
@@ -411,25 +416,11 @@ module.exports = function (grunt) {
                 stdout: false,
             },
             fixCryptoApiImports: {
-                command: function () {
+                command: `node ${nodeFlags} src/core/config/scripts/fixCryptoApiImports.mjs`,
-                    switch (process.platform) {
-                        case "darwin":
-                            return `find ./node_modules/crypto-api/src/ \\( -type d -name .git -prune \\) -o -type f -print0 | xargs -0 sed -i '' -e '/\\.mjs/!s/\\(from "\\.[^"]*\\)";/\\1.mjs";/g'`;
-                        default:
-                            return `find ./node_modules/crypto-api/src/ \\( -type d -name .git -prune \\) -o -type f -print0 | xargs -0 sed -i -e '/\\.mjs/!s/\\(from "\\.[^"]*\\)";/\\1.mjs";/g'`;
-                    }
-                },
                 stdout: false
             },
             fixSnackbarMarkup: {
-                command: function () {
+                command: `node ${nodeFlags} src/core/config/scripts/fixSnackBarMarkup.mjs`,
-                    switch (process.platform) {
-                        case "darwin":
-                            return `sed -i '' 's/<div id=snackbar-container\\/>/<div id=snackbar-container>/g' ./node_modules/snackbarjs/src/snackbar.js`;
-                        default:
-                            return `sed -i 's/<div id=snackbar-container\\/>/<div id=snackbar-container>/g' ./node_modules/snackbarjs/src/snackbar.js`;
-                    }
-                },
                 stdout: false
             },
         },

README.md

@@ -12,13 +12,9 @@ CyberChef is a simple, intuitive web app for carrying out all manner of "cyber"
 
 The tool is designed to enable both technical and non-technical analysts to manipulate data in complex ways without having to deal with complex tools or algorithms. It was conceived, designed, built and incrementally improved by an analyst in their 10% innovation time over several years.
 
-## Live demo
+## Official website
 
-CyberChef is still under active development. As a result, it shouldn't be considered a finished product. There is still testing and bug fixing to do, new features to be added and additional documentation to write. Please contribute!
+[CyberChef's official website can be found here][1] - have fun!
-
-Cryptographic operations in CyberChef should not be relied upon to provide security in any situation. No guarantee is offered for their correctness.
-
-[A live demo can be found here][1] - have fun!
 
 ## Running Locally with Docker
 
@@ -36,7 +32,7 @@ docker build --tag cyberchef --ulimit nofile=10000 .
 ```
 2. Run the docker container
 ```bash
-docker run -it -p 8080:80 cyberchef
+docker run -it -p 8080:8080 cyberchef
 ```
 3. Navigate to `http://localhost:8080` in your browser
 
@@ -45,7 +41,7 @@ docker run -it -p 8080:80 cyberchef
 If you prefer to skip the build process, you can use the pre-built image
 
 ```bash
-docker run -it -p 8080:80 ghcr.io/gchq/cyberchef:latest
+docker run -it -p 8080:8080 ghcr.io/gchq/cyberchef:latest
 ```
 
 Just like before, navigate to `http://localhost:8080` in your browser.
@@ -72,6 +68,7 @@ You can use as many operations as you like in simple or complex ways. Some examp
  - [Carry out different operations on data of different types][8]
  - [Use parts of the input as arguments to operations][9]
  - [Perform AES decryption, extracting the IV from the beginning of the cipher stream][10]
+ - [A simpler way to perform the same AES Decryption][13]
  - [Automagically detect several layers of nested encoding][12]
 
 
@@ -120,7 +117,12 @@ CyberChef is built to support
 
 ## Node.js support
 
-CyberChef is built to fully support Node.js `v16`. For more information, see the ["Node API" wiki page](https://github.com/gchq/CyberChef/wiki/Node-API)
+CyberChef is built to fully support Node.js `v24`. For more information, see the ["Node API" wiki page](https://github.com/gchq/CyberChef/wiki/Node-API)
+
+
+## Security
+
+Please see the [CyberChef security policy](./SECURITY.md).
 
 
 ## Contributing
@@ -147,6 +149,7 @@ CyberChef is released under the [Apache 2.0 Licence](https://www.apache.org/lice
   [7]: https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)From_UNIX_Timestamp('Seconds%20(s)')&input=OTc4MzQ2ODAwCjEwMTI2NTEyMDAKMTA0NjY5NjQwMAoxMDgxMDg3MjAwCjExMTUzMDUyMDAKMTE0OTYwOTYwMA
   [8]: https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Conditional_Jump('1',false,'base64',10)To_Hex('Space')Return()Label('base64')To_Base64('A-Za-z0-9%2B/%3D')&input=U29tZSBkYXRhIHdpdGggYSAxIGluIGl0ClNvbWUgZGF0YSB3aXRoIGEgMiBpbiBpdA
   [9]: https://gchq.github.io/CyberChef/#recipe=Register('key%3D(%5B%5C%5Cda-f%5D*)',true,false)Find_/_Replace(%7B'option':'Regex','string':'.*data%3D(.*)'%7D,'$1',true,false,true)RC4(%7B'option':'Hex','string':'$R0'%7D,'Hex','Latin1')&input=aHR0cDovL21hbHdhcmV6LmJpei9iZWFjb24ucGhwP2tleT0wZTkzMmE1YyZkYXRhPThkYjdkNWViZTM4NjYzYTU0ZWNiYjMzNGUzZGIxMQ
-  [10]: https://gchq.github.io/CyberChef/#recipe=Register('(.%7B32%7D)',true,false)Drop_bytes(0,32,false)AES_Decrypt(%7B'option':'Hex','string':'1748e7179bd56570d51fa4ba287cc3e5'%7D,%7B'option':'Hex','string':'$R0'%7D,'CTR','Hex','Raw',%7B'option':'Hex','string':''%7D)&input=NTFlMjAxZDQ2MzY5OGVmNWY3MTdmNzFmNWI0NzEyYWYyMGJlNjc0YjNiZmY1M2QzODU0NjM5NmVlNjFkYWFjNDkwOGUzMTljYTNmY2Y3MDg5YmZiNmIzOGVhOTllNzgxZDI2ZTU3N2JhOWRkNmYzMTFhMzk0MjBiODk3OGU5MzAxNGIwNDJkNDQ3MjZjYWVkZjU0MzZlYWY2NTI0MjljMGRmOTRiNTIxNjc2YzdjMmNlODEyMDk3YzI3NzI3M2M3YzcyY2Q4OWFlYzhkOWZiNGEyNzU4NmNjZjZhYTBhZWUyMjRjMzRiYTNiZmRmN2FlYjFkZGQ0Nzc2MjJiOTFlNzJjOWU3MDlhYjYwZjhkYWY3MzFlYzBjYzg1Y2UwZjc0NmZmMTU1NGE1YTNlYzI5MWNhNDBmOWU2MjlhODcyNTkyZDk4OGZkZDgzNDUzNGFiYTc5YzFhZDE2NzY3NjlhN2MwMTBiZjA0NzM5ZWNkYjY1ZDk1MzAyMzcxZDYyOWQ5ZTM3ZTdiNGEzNjFkYTQ2OGYxZWQ1MzU4OTIyZDJlYTc1MmRkMTFjMzY2ZjMwMTdiMTRhYTAxMWQyYWYwM2M0NGY5NTU3OTA5OGExNWUzY2Y5YjQ0ODZmOGZmZTljMjM5ZjM0ZGU3MTUxZjZjYTY1MDBmZTRiODUwYzNmMWMwMmU4MDFjYWYzYTI0NDY0NjE0ZTQyODAxNjE1YjhmZmFhMDdhYzgyNTE0OTNmZmRhN2RlNWRkZjMzNjg4ODBjMmI5NWIwMzBmNDFmOGYxNTA2NmFkZDA3MWE2NmNmNjBlNWY0NmYzYTIzMGQzOTdiNjUyOTYzYTIxYTUzZg
+  [10]: https://gchq.github.io/CyberChef/#recipe=Register('(.%7B32%7D)',true,false,false)Drop_bytes(0,32,false)AES_Decrypt(%7B'option':'Hex','string':'1748e7179bd56570d51fa4ba287cc3e5'%7D,%7B'option':'Hex','string':'$R0'%7D,16,'CTR','Hex','Raw',%7B'option':'Hex','string':''%7D,%7B'option':'Hex','string':''%7D,'Off')&input=NTFlMjAxZDQ2MzY5OGVmNWY3MTdmNzFmNWI0NzEyYWYyMGJlNjc0YjNiZmY1M2QzODU0NjM5NmVlNjFkYWFjNDkwOGUzMTljYTNmY2Y3MDg5YmZiNmIzOGVhOTllNzgxZDI2ZTU3N2JhOWRkNmYzMTFhMzk0MjBiODk3OGU5MzAxNGIwNDJkNDQ3MjZjYWVkZjU0MzZlYWY2NTI0MjljMGRmOTRiNTIxNjc2YzdjMmNlODEyMDk3YzI3NzI3M2M3YzcyY2Q4OWFlYzhkOWZiNGEyNzU4NmNjZjZhYTBhZWUyMjRjMzRiYTNiZmRmN2FlYjFkZGQ0Nzc2MjJiOTFlNzJjOWU3MDlhYjYwZjhkYWY3MzFlYzBjYzg1Y2UwZjc0NmZmMTU1NGE1YTNlYzI5MWNhNDBmOWU2MjlhODcyNTkyZDk4OGZkZDgzNDUzNGFiYTc5YzFhZDE2NzY3NjlhN2MwMTBiZjA0NzM5ZWNkYjY1ZDk1MzAyMzcxZDYyOWQ5ZTM3ZTdiNGEzNjFkYTQ2OGYxZWQ1MzU4OTIyZDJlYTc1MmRkMTFjMzY2ZjMwMTdiMTRhYTAxMWQyYWYwM2M0NGY5NTU3OTA5OGExNWUzY2Y5YjQ0ODZmOGZmZTljMjM5ZjM0ZGU3MTUxZjZjYTY1MDBmZTRiODUwYzNmMWMwMmU4MDFjYWYzYTI0NDY0NjE0ZTQyODAxNjE1YjhmZmFhMDdhYzgyNTE0OTNmZmRhN2RlNWRkZjMzNjg4ODBjMmI5NWIwMzBmNDFmOGYxNTA2NmFkZDA3MWE2NmNmNjBlNWY0NmYzYTIzMGQzOTdiNjUyOTYzYTIxYTUzZg
   [11]: https://gchq.github.io/CyberChef/#recipe=XOR(%7B'option':'Hex','string':'3a'%7D,'Standard',false)To_Hexdump(16,false,false)&input=VGhlIGFuc3dlciB0byB0aGUgdWx0aW1hdGUgcXVlc3Rpb24gb2YgbGlmZSwgdGhlIFVuaXZlcnNlLCBhbmQgZXZlcnl0aGluZyBpcyA0Mi4
   [12]: https://gchq.github.io/CyberChef/#recipe=Magic(3,false,false)&input=V1VhZ3dzaWFlNm1QOGdOdENDTFVGcENwQ0IyNlJtQkRvREQ4UGFjZEFtekF6QlZqa0syUXN0RlhhS2hwQzZpVVM3UkhxWHJKdEZpc29SU2dvSjR3aGptMWFybTg2NHFhTnE0UmNmVW1MSHJjc0FhWmM1VFhDWWlmTmRnUzgzZ0RlZWpHWDQ2Z2FpTXl1QlY2RXNrSHQxc2NnSjg4eDJ0TlNvdFFEd2JHWTFtbUNvYjJBUkdGdkNLWU5xaU45aXBNcTFaVTFtZ2tkYk51R2NiNzZhUnRZV2hDR1VjOGc5M1VKdWRoYjhodHNoZVpud1RwZ3FoeDgzU1ZKU1pYTVhVakpUMnptcEM3dVhXdHVtcW9rYmRTaTg4WXRrV0RBYzFUb291aDJvSDRENGRkbU5LSldVRHBNd21uZ1VtSzE0eHdtb21jY1BRRTloTTE3MkFQblNxd3hkS1ExNzJSa2NBc3lzbm1qNWdHdFJtVk5OaDJzMzU5d3I2bVMyUVJQ
+  [13]: https://gchq.github.io/CyberChef/#recipe=AES_Decrypt(%7B'option':'Hex','string':'1748e7179bd56570d51fa4ba287cc3e5'%7D,%7B'option':'Hex','string':'$R0'%7D,16,'CTR','Hex','Raw',%7B'option':'Hex','string':''%7D,%7B'option':'Hex','string':''%7D,'From%20start')&input=NTFlMjAxZDQ2MzY5OGVmNWY3MTdmNzFmNWI0NzEyYWYyMGJlNjc0YjNiZmY1M2QzODU0NjM5NmVlNjFkYWFjNDkwOGUzMTljYTNmY2Y3MDg5YmZiNmIzOGVhOTllNzgxZDI2ZTU3N2JhOWRkNmYzMTFhMzk0MjBiODk3OGU5MzAxNGIwNDJkNDQ3MjZjYWVkZjU0MzZlYWY2NTI0MjljMGRmOTRiNTIxNjc2YzdjMmNlODEyMDk3YzI3NzI3M2M3YzcyY2Q4OWFlYzhkOWZiNGEyNzU4NmNjZjZhYTBhZWUyMjRjMzRiYTNiZmRmN2FlYjFkZGQ0Nzc2MjJiOTFlNzJjOWU3MDlhYjYwZjhkYWY3MzFlYzBjYzg1Y2UwZjc0NmZmMTU1NGE1YTNlYzI5MWNhNDBmOWU2MjlhODcyNTkyZDk4OGZkZDgzNDUzNGFiYTc5YzFhZDE2NzY3NjlhN2MwMTBiZjA0NzM5ZWNkYjY1ZDk1MzAyMzcxZDYyOWQ5ZTM3ZTdiNGEzNjFkYTQ2OGYxZWQ1MzU4OTIyZDJlYTc1MmRkMTFjMzY2ZjMwMTdiMTRhYTAxMWQyYWYwM2M0NGY5NTU3OTA5OGExNWUzY2Y5YjQ0ODZmOGZmZTljMjM5ZjM0ZGU3MTUxZjZjYTY1MDBmZTRiODUwYzNmMWMwMmU4MDFjYWYzYTI0NDY0NjE0ZTQyODAxNjE1YjhmZmFhMDdhYzgyNTE0OTNmZmRhN2RlNWRkZjMzNjg4ODBjMmI5NWIwMzBmNDFmOGYxNTA2NmFkZDA3MWE2NmNmNjBlNWY0NmYzYTIzMGQzOTdiNjUyOTYzYTIxYTUzZg

SECURITY.md

@@ -1,26 +1,18 @@
 # Security Policy
 
-## Supported Versions
+## Support
 
-CyberChef is supported on a best endeavours basis. Patches will be applied to
+CyberChef is supported on a best endeavours basis.
-the latest version rather than retroactively to older versions. To ensure you
+Patches will be applied to the latest version rather than retroactively to older versions.
-are using the most secure version of CyberChef, please make sure you have the
+To ensure you are using the most secure version of CyberChef, please make sure you have the [latest release](https://github.com/gchq/CyberChef/releases/latest). [The official website](https://gchq.github.io/CyberChef/) is always up to date.
-[latest release](https://github.com/gchq/CyberChef/releases/latest). The
+
-official [live demo](https://gchq.github.io/CyberChef/) is always up to date.
+No guarantee is offered for the correctness or security of CyberChef. In paticular, the security of cryptographic operations should not be relied upon.
 
 ## Reporting a Vulnerability
 
-In most scenarios, the most appropriate way to report a vulnerability is to
+If you discover a vulnerability in CyberChef, please do not publicly disclose it, and do not create a GitHub issue.
-[raise a new issue](https://github.com/gchq/CyberChef/issues/new/choose)
-describing the problem in as much detail as possible, ideally with examples.
-This will obviously be public. If you feel that the vulnerability is
-significant enough to warrant a private disclosure, please email
-[oss@gchq.gov.uk](mailto:oss@gchq.gov.uk) and
-[n1474335@gmail.com](mailto:n1474335@gmail.com).
 
-Disclosures of vulnerabilities in CyberChef are always welcomed. Whilst we aim
+Instead, send an email as soon as possible to [CyberChefSecurity@gchq.gov.uk](mailto:CyberChefSecurity@gchq.gov.uk).
-to write clean and secure code free from bugs, we recognise that this is an open
+The report will be acknowledged and actioned urgently by the CyberChef maintainers.
-source project written by analysts in their spare time, relying on dozens of
+
-open source libraries that are modified and updated on a regular basis. We hope
+If you do not receive a timely acknowledgement, please notify [oss@gchq.gov.uk](mailto:oss@gchq.gov.uk) and [CyberChef@gchq.gov.uk](mailto:CyberChef@gchq.gov.uk) of your vulnerability report.
-that the community will continue to support us as we endeavour to maintain and
-develop this tool together.

babel.config.js

@@ -16,6 +16,9 @@ module.exports = function(api) {
                     "regenerator": true
                 }
             ]
-        ]
+        ],
+        "generatorOpts": {
+            "importAttributesKeyword": "with"
+        }
     };
 };

package.json

@@ -1,8 +1,8 @@
 {
   "name": "cyberchef",
-  "version": "10.22.1",
+  "version": "11.2.0",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
-  "author": "n1474335 <n1474335@gmail.com>",
+  "author": "GCHQ <CyberChef@gchq.gov.uk>",
   "homepage": "https://gchq.github.io/CyberChef",
   "copyright": "Crown copyright 2016",
   "license": "Apache-2.0",
@@ -36,59 +36,60 @@
   "browserslist": [
     "Chrome >= 50",
     "Firefox >= 38",
-    "node >= 16"
+    "node >= 24"
   ],
   "devDependencies": {
-    "@babel/eslint-parser": "^7.28.6",
+    "@babel/eslint-parser": "^7.29.7",
     "@babel/plugin-syntax-import-assertions": "^7.28.6",
-    "@babel/plugin-transform-runtime": "^7.29.0",
+    "@babel/plugin-transform-runtime": "^7.29.7",
-    "@babel/preset-env": "^7.29.2",
+    "@babel/preset-env": "^7.29.7",
-    "@babel/runtime": "^7.29.2",
+    "@babel/runtime": "^7.29.7",
     "@codemirror/commands": "^6.10.3",
-    "@codemirror/language": "^6.12.2",
+    "@codemirror/language": "^6.12.3",
-    "@codemirror/search": "^6.6.0",
+    "@codemirror/search": "^6.7.1",
     "@codemirror/state": "^6.5.4",
-    "@codemirror/view": "^6.40.0",
+    "@codemirror/view": "^6.43.1",
-    "autoprefixer": "^10.4.27",
+    "@puppeteer/browsers": "3.0.4",
+    "autoprefixer": "^10.5.0",
     "babel-loader": "^10.1.1",
     "base64-loader": "^1.0.0",
-    "chromedriver": "^130.0.4",
+    "chromedriver": "^148.0.4",
     "cli-progress": "^3.12.0",
     "colors": "^1.4.0",
-    "compression-webpack-plugin": "^11.1.0",
+    "compression-webpack-plugin": "^12.0.0",
-    "copy-webpack-plugin": "^13.0.1",
+    "copy-webpack-plugin": "^14.0.0",
     "core-js": "^3.49.0",
-    "cspell": "^8.19.4",
+    "cspell": "^10.0.1",
-    "css-loader": "7.1.4",
+    "css-loader": "^7.1.4",
     "eslint": "^9.39.4",
     "eslint-plugin-jsdoc": "^50.8.0",
-    "globals": "^15.15.0",
+    "globals": "^17.6.0",
-    "grunt": "^1.6.1",
+    "grunt": "^1.6.2",
     "grunt-chmod": "~1.1.1",
     "grunt-concurrent": "^3.0.0",
     "grunt-contrib-clean": "~2.0.1",
     "grunt-contrib-connect": "^5.0.1",
     "grunt-contrib-copy": "~1.0.0",
     "grunt-contrib-watch": "^1.1.0",
-    "grunt-eslint": "^25.0.0",
+    "grunt-eslint": "^26.0.0",
     "grunt-exec": "~3.0.0",
-    "grunt-webpack": "^6.0.0",
+    "grunt-webpack": "^8.0.0",
     "grunt-zip": "^1.0.0",
-    "html-webpack-plugin": "^5.6.6",
+    "html-webpack-plugin": "^5.6.7",
     "imports-loader": "^5.0.0",
-    "mini-css-extract-plugin": "2.10.1",
+    "mini-css-extract-plugin": "2.10.2",
     "modify-source-webpack-plugin": "^4.1.0",
-    "nightwatch": "^3.15.0",
+    "nightwatch": "^3.16.0",
-    "postcss": "^8.5.8",
+    "postcss": "^8.5.15",
     "postcss-css-variables": "^0.19.0",
     "postcss-import": "^16.1.1",
     "postcss-loader": "^8.2.1",
     "prompt": "^1.3.0",
-    "sitemap": "^8.0.3",
+    "sitemap": "^9.0.1",
-    "terser": "^5.46.1",
+    "terser": "^5.48.0",
-    "webpack": "^5.105.4",
+    "webpack": "^5.107.2",
-    "webpack-bundle-analyzer": "^4.10.2",
+    "webpack-bundle-analyzer": "^5.3.0",
-    "webpack-dev-server": "5.0.4",
+    "webpack-dev-server": "^5.2.5",
     "webpack-node-externals": "^3.0.0",
     "worker-loader": "^3.0.8"
   },
@@ -96,22 +97,23 @@
     "@alexaltea/capstone-js": "^3.0.5",
     "@astronautlabs/amf": "^0.0.6",
     "@blu3r4y/lzma": "^2.3.3",
+    "@noble/hashes": "2.2.0",
     "@wavesenterprise/crypto-gost-js": "^2.1.0-RC1",
-    "@xmldom/xmldom": "^0.8.11",
+    "@xmldom/xmldom": "^0.8.13",
     "argon2-browser": "^1.18.0",
-    "arrive": "^2.5.2",
+    "arrive": "^2.5.3",
     "assert": "^2.1.0",
     "avsc": "^5.7.9",
-    "bcryptjs": "^2.4.3",
+    "bcryptjs": "^3.0.3",
-    "bignumber.js": "^9.3.1",
+    "bignumber.js": "^11.1.4",
     "blakejs": "^1.2.1",
     "bootstrap": "4.6.2",
     "bootstrap-colorpicker": "^3.4.0",
     "bootstrap-material-design": "^4.1.3",
     "browserify-zlib": "^0.2.0",
-    "bson": "^4.7.2",
+    "bson": "^7.2.0",
     "buffer": "^6.0.3",
-    "cbor": "9.0.2",
+    "cbor": "10.0.12",
     "chi-squared": "^1.1.0",
     "codepage": "^1.15.0",
     "crypto-api": "^0.8.5",
@@ -120,8 +122,8 @@
     "ctph.js": "0.0.5",
     "d3": "7.9.0",
     "d3-hexbin": "^0.2.2",
-    "diff": "^5.2.2",
+    "diff": "^9.0.0",
-    "dompurify": "^3.3.3",
+    "dompurify": "^3.4.11",
     "es6-promisify": "^7.0.0",
     "escodegen": "^2.1.0",
     "esprima": "^4.0.1",
@@ -131,44 +133,44 @@
     "file-saver": "^2.0.5",
     "flat": "^6.0.1",
     "geodesy": "1.1.3",
-    "handlebars": "^4.7.8",
+    "handlebars": "^4.7.9",
-    "hash-wasm": "^4.12.0",
     "highlight.js": "^11.11.1",
     "ieee754": "^1.2.1",
-    "jimp": "^1.6.0",
+    "jimp": "1.6.0",
     "jq-web": "^0.5.1",
     "jquery": "3.7.1",
     "js-sha3": "^0.9.3",
     "jsesc": "^3.1.0",
     "json5": "^2.2.3",
-    "jsonata": "^2.1.0",
+    "jsonata": "^2.2.1",
     "jsonpath-plus": "^10.4.0",
     "jsonwebtoken": "9.0.3",
     "jsqr": "^1.4.0",
-    "jsrsasign": "^11.1.1",
+    "jsrsasign": "^11.1.3",
     "kbpgp": "^2.1.17",
     "libbzip2-wasm": "0.0.4",
     "libyara-wasm": "^1.2.1",
-    "lodash": "^4.17.23",
+    "lodash": "^4.18.1",
     "loglevel": "^1.9.2",
     "loglevel-message-prefix": "^3.0.0",
     "lz-string": "^1.5.0",
     "lz4js": "^0.2.0",
-    "markdown-it": "^14.1.1",
+    "markdown-it": "^14.2.0",
     "moment": "^2.30.1",
-    "moment-timezone": "^0.6.1",
+    "moment-timezone": "^0.6.2",
     "ngeohash": "^0.6.3",
-    "node-forge": "^1.3.3",
+    "node-forge": "^1.4.0",
     "node-md6": "^0.1.0",
     "nodom": "^2.4.0",
     "notepack.io": "^3.0.1",
     "ntlm": "^0.1.3",
     "nwmatcher": "^1.4.4",
-    "otpauth": "9.3.6",
+    "otpauth": "^9.5.0",
     "path": "^0.12.7",
     "popper.js": "^1.16.1",
     "process": "^0.11.10",
-    "protobufjs": "^7.5.4",
+    "protobufjs": "^8.6.4",
+    "punycode.js": "^2.3.1",
     "qr-image": "^3.2.0",
     "reflect-metadata": "^0.2.2",
     "rison": "^0.1.1",
@@ -176,15 +178,15 @@
     "snackbarjs": "^1.1.0",
     "sortablejs": "^1.15.7",
     "split.js": "^1.6.5",
-    "sql-formatter": "^15.6.12",
+    "sql-formatter": "^15.8.1",
     "ssdeep.js": "0.0.3",
     "stream-browserify": "^3.0.0",
-    "tesseract.js": "^6.0.1",
+    "tesseract.js": "^7.0.0",
-    "ua-parser-js": "^1.0.41",
+    "ua-parser-js": "^2.0.10",
     "unorm": "^1.6.0",
     "url": "^0.11.4",
     "utf8": "^3.0.0",
-    "uuid": "^13.0.0",
+    "uuid": "^14.0.0",
     "vkbeautify": "^0.99.3",
     "xpath": "0.0.34",
     "xregexp": "^5.1.2",
@@ -194,18 +196,21 @@
     "start": "npx grunt dev",
     "build": "npx grunt prod",
     "node": "npx grunt node",
-    "repl": "node --experimental-modules --experimental-json-modules --experimental-specifier-resolution=node --no-experimental-fetch --no-warnings src/node/repl.mjs",
+    "repl": "node --no-warnings src/node/repl.mjs",
-    "test": "npx grunt configTests && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation --openssl-legacy-provider --no-experimental-fetch tests/node/index.mjs && node --experimental-modules --experimental-json-modules --no-warnings --no-deprecation --openssl-legacy-provider --no-experimental-fetch --trace-uncaught tests/operations/index.mjs",
+    "test": "npx grunt configTests && node --no-warnings --no-deprecation --openssl-legacy-provider tests/node/index.mjs && node --no-warnings --no-deprecation --openssl-legacy-provider --trace-uncaught tests/operations/index.mjs",
     "testnodeconsumer": "npx grunt testnodeconsumer",
     "testui": "npx grunt testui",
     "testuidev": "npx nightwatch --env=dev",
     "lint": "npx grunt lint",
     "lint:grammar": "cspell ./src",
     "postinstall": "npx grunt exec:fixCryptoApiImports && npx grunt exec:fixSnackbarMarkup",
-    "newop": "node --experimental-modules --experimental-json-modules src/core/config/scripts/newOperation.mjs",
+    "newop": "node src/core/config/scripts/newOperation.mjs",
-    "minor": "node --experimental-modules --experimental-json-modules src/core/config/scripts/newMinorVersion.mjs && npm version minor --git-tag-version=false && echo \"Updated to version v$(npm pkg get version | xargs), please create a pull request and once merged use 'npm run tag'\"",
+    "minor": "node src/core/config/scripts/newMinorVersion.mjs && npm version minor --git-tag-version=false && echo \"Updated to version v$(npm pkg get version | xargs), please create a pull request and once merged use 'npm run tag'\"",
     "tag": "git tag -s \"v$(npm pkg get version | xargs)\" -m \"$(npm pkg get version | xargs)\" && echo \"Created v$(npm pkg get version | xargs), now check and push the tag\"",
     "getheapsize": "node -e 'console.log(`node heap limit = ${require(\"v8\").getHeapStatistics().heap_size_limit / (1024 * 1024)} Mb`)'",
     "setheapsize": "export NODE_OPTIONS=--max_old_space_size=2048"
+  },
+  "engines": {
+    "node": ">=24 <25"
   }
 }

src/core/Chef.mjs

@@ -138,6 +138,8 @@ class Chef {
 
         if (!highlights) return false;
 
+        if (direction === "reverse") highlights.reverse();
+
         for (let i = 0; i < highlights.length; i++) {
             // Remove multiple highlights before processing again
             pos = [pos[0]];

src/core/ChefWorker.js

@@ -7,7 +7,7 @@
  */
 
 import Chef from "./Chef.mjs";
-import OperationConfig from "./config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "./config/OperationConfig.json" with { type: "json" };
 import OpModules from "./config/modules/OpModules.mjs";
 import loglevelMessagePrefix from "loglevel-message-prefix";
 

src/core/Ingredient.mjs

@@ -32,6 +32,8 @@ class Ingredient {
         this.min = null;
         this.max = null;
         this.step = 1;
+        this.integer = false;
+        this.allowEmpty = true;
 
         if (ingredientConfig) {
             this._parseConfig(ingredientConfig);
@@ -59,6 +61,70 @@ class Ingredient {
         this.min = ingredientConfig.min;
         this.max = ingredientConfig.max;
         this.step = ingredientConfig.step;
+        this.integer = typeof ingredientConfig.integer !== "undefined" ? !!ingredientConfig.integer : false;
+        this.allowEmpty = typeof ingredientConfig.allowEmpty !== "undefined" ? !!ingredientConfig.allowEmpty : true;
+    }
+
+
+    /**
+     * Validates the given value against the constraints of this ingredient.
+     *
+     * @param {*} val
+     * @returns {boolean}
+     */
+    validate(val) {
+        if (this.disabled) return true;
+
+        let checkVal = val;
+        if (this.type === "toggleString" && val && typeof val === "object" && "string" in val) {
+            checkVal = val.string;
+        }
+
+        // 1. check if empty
+        let isEmpty = false;
+        if (checkVal === null || checkVal === undefined || checkVal === "") {
+            isEmpty = true;
+        } else if (typeof checkVal.length === "number" && checkVal.length === 0) {
+            isEmpty = true;
+        }
+
+        if (isEmpty) {
+            if (this.allowEmpty === false) {
+                throw new OperationError(`${this.name} cannot be empty.`);
+            }
+            return true;
+        }
+
+        // 2. maxLength check
+        if (typeof this.maxLength === "number" && checkVal !== null && checkVal !== undefined) {
+            if (typeof checkVal === "string" && checkVal.length > this.maxLength) {
+                throw new OperationError(`${this.name} length cannot exceed ${this.maxLength}.`);
+            }
+            if (Array.isArray(checkVal) && checkVal.length > this.maxLength) {
+                throw new OperationError(`${this.name} length cannot exceed ${this.maxLength}.`);
+            }
+            if (checkVal instanceof Uint8Array && checkVal.length > this.maxLength) {
+                throw new OperationError(`${this.name} length cannot exceed ${this.maxLength}.`);
+            }
+        }
+
+        // 3. number checks
+        if (this.type === "number") {
+            if (val === null || val === undefined || isNaN(val)) {
+                throw new OperationError(`${this.name} must be a number.`);
+            }
+            if (this.integer && !Number.isInteger(val)) {
+                throw new OperationError(`${this.name} must be an integer.`);
+            }
+            if (typeof this.min === "number" && val < this.min) {
+                throw new OperationError(`${this.name} must be greater than or equal to ${this.min}.`);
+            }
+            if (typeof this.max === "number" && val > this.max) {
+                throw new OperationError(`${this.name} must be less than or equal to ${this.max}.`);
+            }
+        }
+
+        return true;
     }
 
 

src/core/Operation.mjs

@@ -189,11 +189,30 @@ class Operation {
             if (typeof ing.min === "number") conf.min = ing.min;
             if (typeof ing.max === "number") conf.max = ing.max;
             if (ing.step) conf.step = ing.step;
+            if (typeof ing.integer !== "undefined") conf.integer = ing.integer;
+            if (typeof ing.allowEmpty !== "undefined") conf.allowEmpty = ing.allowEmpty;
             return conf;
         });
     }
 
 
+    /**
+     * Validates the operation's ingredients against their defined constraints.
+     *
+     * @param {Object[]} [args] - Optional list of argument values to validate. If not provided, validates the current ingredient values.
+     * @returns {boolean} - True if valid, throws an OperationError if invalid.
+     */
+    validateIngredients(args) {
+        const values = args || this.ingValues;
+        this._ingList.forEach((ing, i) => {
+            if (i < values.length) {
+                ing.validate(values[i]);
+            }
+        });
+        return true;
+    }
+
+
     /**
      * Returns the value of the Operation as it should be displayed in a recipe config.
      *

src/core/Recipe.mjs

@@ -4,7 +4,7 @@
  * @license Apache-2.0
  */
 
-import OperationConfig from "./config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "./config/OperationConfig.json" with { type: "json" };
 import OperationError from "./errors/OperationError.mjs";
 import Operation from "./Operation.mjs";
 import DishError from "./errors/DishError.mjs";
@@ -212,6 +212,8 @@ class Recipe  {
                     self.sendProgressMessage(i + 1, this.opList.length);
                 }
 
+                op.validateIngredients(op.ingValues);
+
                 if (op.flowControl) {
                     // Package up the current state
                     let state = {

src/core/config/Categories.json

@@ -49,6 +49,7 @@
             "Escape Unicode Characters",
             "Unescape Unicode Characters",
             "Normalise Unicode",
+            "Escape Smart Characters",
             "To Quoted Printable",
             "From Quoted Printable",
             "To Punycode",
@@ -118,6 +119,7 @@
             "GOST Verify",
             "GOST Key Wrap",
             "GOST Key Unwrap",
+            "ROR13",
             "ROT13",
             "ROT13 Brute Force",
             "ROT47",
@@ -188,6 +190,7 @@
             "Generate PGP Key Pair",
             "PGP Encrypt",
             "PGP Decrypt",
+            "PGP Sign",
             "PGP Verify",
             "PGP Encrypt and Sign",
             "PGP Decrypt and Verify",
@@ -238,6 +241,7 @@
             "Bit shift right",
             "Rotate left",
             "Rotate right",
+            "ROR13",
             "ROT13",
             "ROT8000"
         ]
@@ -303,6 +307,7 @@
             "Diff",
             "Remove whitespace",
             "Remove null bytes",
+            "Remove ANSI Escape Codes",
             "To Upper case",
             "To Lower case",
             "Swap case",
@@ -348,6 +353,7 @@
             "Pseudo-Random Number Generator",
             "Sleep",
             "File Tree",
+            "Wrap",
             "Take nth bytes",
             "Drop nth bytes"
         ]
@@ -465,7 +471,8 @@
             "Luhn Checksum",
             "CRC Checksum",
             "TCP/IP Checksum",
-            "XOR Checksum"
+            "XOR Checksum",
+            "Parity Bit"
         ]
     },
     {
@@ -551,7 +558,7 @@
             "Scatter chart",
             "Series chart",
             "Heatmap chart",
-            "Extract Audio Metadata"
+            "Render PDF"
         ]
     },
     {
@@ -577,7 +584,8 @@
             "HTML To Text",
             "Generate Lorem Ipsum",
             "Numberwang",
-            "XKCD Random Number"
+            "XKCD Random Number",
+            "Automated Validation Test Op"
         ]
     },
     {

src/core/config/scripts/fixCryptoApiImports.mjs

@@ -0,0 +1,54 @@
+/**
+ * This script updates crypto-api package
+ * It adds .mjs to local imports where its missing
+ *
+ * before:
+ * import foo from "./bar";
+ * after
+ * import foo from "./bar.mjs";
+ *
+ */
+
+/* eslint no-console: ["off"] */
+
+import { readdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// Base directory of crypto-api source
+const baseDir = join(process.cwd(), "node_modules/crypto-api/src");
+
+/**
+ * Recursively walk a directory, updating import statements
+ * to include ".mjs" if missing
+ */
+function walk(dir) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+
+    for (const entry of entries) {
+        if (entry.name === ".git") continue;
+
+        const fullPath = join(dir, entry.name);
+
+        if (entry.isDirectory()) {
+            walk(fullPath);
+        } else if (entry.isFile()) {
+            const content = readFileSync(fullPath, "utf8");
+
+            // Add .mjs to imports if not present
+            const updated = content.replace(
+                /from "(\.[^"]*)";/g,
+                (match, p1) => {
+                    if (p1.endsWith(".mjs")) return match;
+                    return `from "${p1}.mjs";`;
+                }
+            );
+
+            if (updated !== content) {
+                writeFileSync(fullPath, updated, "utf8");
+            }
+        }
+    }
+}
+
+// Run the walker
+walk(baseDir);

src/core/config/scripts/fixSnackBarMarkup.mjs

@@ -0,0 +1,28 @@
+/**
+ * This script updates snackbarjs package
+ * Replaces self-closing div with standard opening div
+ *
+ * before:
+ * <div id=snackbar-container/>
+ * after:
+ * <div id=snackbar-container>
+ *
+ */
+
+/* eslint no-console: ["off"] */
+
+import { readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// Base directory of snackbarjs source
+const filePath = join(process.cwd(), "node_modules/snackbarjs/src/snackbar.js");
+
+const content = readFileSync(filePath, "utf8");
+
+// Replace self-closing div with standard opening div
+const updated = content.replace(
+    /<div id=snackbar-container\/>/g,
+    "<div id=snackbar-container>"
+);
+
+writeFileSync(filePath, updated, "utf8");

src/core/config/scripts/generateOpsIndex.mjs

@@ -58,3 +58,66 @@ fs.writeFileSync(
     code
 );
 console.log("Written operation index.");
+
+// find all test files
+const testsDir = path.join(process.cwd() + "/tests/operations/tests/");
+const testObjs = [];
+fs.readdirSync(testsDir).forEach(file => {
+    if (!file.endsWith(".mjs")) return;
+    testObjs.push(file.split(".mjs")[0]);
+});
+
+// Construct test index file
+code = `/**
+* THIS FILE IS AUTOMATICALLY GENERATED BY src/core/config/scripts/generateOpsIndex.mjs
+*
+* @author john [john19696@protonmail.com]
+* @author tlwr [toby@toby.codes]
+* @author n1474335 [n1474335@gmail.com]
+* @copyright Crown Copyright ${new Date().getUTCFullYear()}
+* @license Apache-2.0
+*/
+
+import {
+    setLongTestFailure,
+    logTestReport,
+} from "../lib/utils.mjs";
+
+import "../lib/wasmFetchPolyfill.mjs";
+
+import TestRegister from "../lib/TestRegister.mjs";
+`;
+
+testObjs.forEach(obj => {
+    if (obj !== "SplitColourChannels")
+        code += `import "./tests/${obj}.mjs";\n`;
+    else
+        code += `// Cannot test operations that use the File type yet
+// import "./tests/SplitColourChannels.mjs";\n`;
+});
+
+code += `
+
+const testStatus = {
+    allTestsPassing: true,
+    counts: {
+        total: 0,
+    }
+};
+
+setLongTestFailure();
+
+const logOpsTestReport = logTestReport.bind(null, testStatus);
+
+(async function() {
+    const results = await TestRegister.runTests();
+    logOpsTestReport(results);
+})();
+`;
+
+// Write tests file
+fs.writeFileSync(
+    path.join(testsDir, "../index.mjs"),
+    code
+);
+console.log("Written operation tests index.");

src/core/config/scripts/newOperation.mjs

@@ -23,7 +23,7 @@ if (!fs.existsSync(dir)) {
     console.log("Example> node --experimental-modules src/core/config/scripts/newOperation.mjs");
     process.exit(1);
 }
-
+const testDir = path.join(process.cwd() + "/tests/operations/tests/");
 const ioTypes = ["string", "byteArray", "number", "html", "ArrayBuffer", "BigNumber", "JSON", "File", "List<File>"];
 
 const schema = {
@@ -123,6 +123,30 @@ prompt.get(schema, (err, result) => {
         return txt.charAt(0).toUpperCase() + txt.substr(1);
     }).replace(/[\s-()./]/g, "");
 
+    const testTemplate = `/**
+* ${moduleName} tests
+*
+* @author ${result.authorName} [${result.authorEmail}]
+* @copyright Crown Copyright ${(new Date()).getFullYear()}
+* @license Apache-2.0
+*/
+
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "${result.opName}: test",
+        input: "Example input",
+        expectedOutput: "Expected output",
+        recipeConfig: [
+            {
+                op: "${result.opName}",
+                args: [],
+            },
+        ],
+    },
+]);
+`;
 
     const template = `/**
  * @author ${result.authorName} [${result.authorEmail}]
@@ -218,13 +242,16 @@ export default ${moduleName};
     }
     fs.writeFileSync(filename, template);
 
+    const testFilename = path.join(testDir, `./${moduleName}.mjs`);
+    fs.writeFileSync(testFilename, testTemplate);
+
     console.log(`\nOperation template written to ${colors.green(filename)}`);
+    console.log(`\nOperation test template written to ${colors.green(testFilename)}`);
     console.log(`\nNext steps:
 1. Add your operation to ${colors.green("src/core/config/Categories.json")}
-2. Write your operation code.
+2. Write your operation code in ${colors.green(filename)}
-3. Write tests in ${colors.green("tests/operations/tests/")}
+3. Write your operation test code in ${colors.green(testFilename)}
 4. Run ${colors.cyan("npm run lint")} and ${colors.cyan("npm run test")}
 5. Submit a Pull Request to get your operation added to the official CyberChef repository.`);
 
 });
-

src/core/dishTypes/DishType.mjs

@@ -11,7 +11,7 @@
 class DishType {
 
     /**
-     * Warn translations dont work without value from bind
+     * Warn translations don't work without value from bind
      */
     static checkForValue(value) {
         if (value === undefined) {

src/core/errors/ExcludedOperationError.mjs

@@ -1,5 +1,5 @@
 /**
- * Custom error type for handling operation that isnt included in node.js API
+ * Custom error type for handling operation that isn't included in node.js API
  *
  * @author d98762625 [d98762625@gmail.com]
  * @copyright Crown Copyright 2018

src/core/lib/Arithmetic.mjs

@@ -108,14 +108,17 @@ export function mean(data) {
  * @returns {BigNumber}
  */
 export function median(data) {
-    if ((data.length % 2) === 0 && data.length > 0) {
+    if (data.length > 0) {
         data.sort(function(a, b) {
             return a.minus(b);
         });
+
+        if ((data.length % 2) === 0) {
             const first = data[Math.floor(data.length / 2)];
             const second = data[Math.floor(data.length / 2) - 1];
             return mean([first, second]);
-    } else {
+        }
+
         return data[Math.floor(data.length / 2)];
     }
 }

src/core/lib/Charts.mjs

@@ -153,7 +153,7 @@ export function getSeriesValues(input, recordDelimiter, fieldDelimiter, columnHe
     );
 
     let xValues = new Set();
-    const series = {};
+    const series = Object.create(null);
 
     values.forEach(row => {
         const serie = row[0],
@@ -163,14 +163,14 @@ export function getSeriesValues(input, recordDelimiter, fieldDelimiter, columnHe
         if (Number.isNaN(val)) throw new OperationError("Values must be numbers in base 10.");
 
         xValues.add(xVal);
-        if (typeof series[serie] === "undefined") series[serie] = {};
+        if (typeof series[serie] === "undefined") series[serie] = Object.create(null);
         series[serie][xVal] = val;
     });
 
     xValues = new Array(...xValues);
 
     const seriesList = [];
-    for (const seriesName in series) {
+    for (const seriesName of Object.keys(series)) {
         const serie = series[seriesName];
         seriesList.push({name: seriesName, data: serie});
     }

src/core/lib/Extract.mjs

@@ -45,6 +45,11 @@ export function search(input, searchRegex, removeRegex=null, sortBy=null, unique
     return results;
 }
 
+/**
+ * Email regular expression
+ */
+export const EMAIL_REGEX = /(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?\.)+[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\])/ig;
+
 
 /**
  * URL regular expression

src/core/lib/Magic.mjs

@@ -1,4 +1,4 @@
-import OperationConfig from "../config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "../config/OperationConfig.json" with { type: "json" };
 import Utils, { isWorkerEnvironment } from "../Utils.mjs";
 import Recipe from "../Recipe.mjs";
 import Dish from "../Dish.mjs";

src/core/lib/ParityBit.mjs

@@ -0,0 +1,50 @@
+/**
+ * Parity Bit functions.
+ *
+ * @author j83305 [awz22@protonmail.com]
+ * @copyright Crown Copyright 2020
+ * @license Apache-2.0
+ *
+ */
+
+import OperationError from "../errors/OperationError.mjs";
+
+/**
+ * Function to take the user input and encode using the given arguments
+ * @param input string of binary
+ * @param args array
+ */
+export function calculateParityBit(input, args) {
+    let count1s = 0;
+    for (let i = 0; i < input.length; i++) {
+        const character = input.charAt(i);
+        if (character === "1") {
+            count1s++;
+        } else if (character !== args[3] && character !== "0" && character !== " ") {
+            throw new OperationError("unexpected character encountered: \"" + character + "\"");
+        }
+    }
+    let parityBit = "1";
+    const flipflop = args[0] === "Even Parity" ? 0 : 1;
+    if (count1s % 2 === flipflop) {
+        parityBit = "0";
+    }
+    if (args[1] === "End") {
+        return input + parityBit;
+    } else {
+        return parityBit + input;
+    }
+}
+
+/**
+ * just removes the parity bit to return the original data
+ * @param input string of binary, encoded
+ * @param args array
+ */
+export function decodeParityBit(input, args) {
+    if (args[1] === "End") {
+        return input.slice(0, -1);
+    } else {
+        return input.slice(1);
+    }
+}

src/core/lib/Protocol.mjs

@@ -8,6 +8,7 @@
 
 import BigNumber from "bignumber.js";
 import {toHexFast} from "../lib/Hex.mjs";
+import Utils from "../Utils.mjs";
 
 /**
  * Recursively displays a JSON object as an HTML table
@@ -25,15 +26,16 @@ export function objToTable(obj, nested=false) {
             <th>Value</th>
         </tr>`;
 
-    for (const key in obj) {
+    for (const key of Object.keys(obj)) {
-        if (typeof obj[key] === "function")
+        const value = obj[key];
+        if (typeof value === "function")
             continue;
 
-        html += `<tr><td style='word-wrap: break-word'>${key}</td>`;
+        html += `<tr><td style='word-wrap: break-word'>${Utils.escapeHtml(String(key))}</td>`;
-        if (typeof obj[key] === "object")
+        if (value !== null && typeof value === "object")
-            html += `<td style='padding: 0'>${objToTable(obj[key], true)}</td>`;
+            html += `<td style='padding: 0'>${objToTable(value, true)}</td>`;
         else
-            html += `<td>${obj[key]}</td>`;
+            html += `<td>${Utils.escapeHtml(String(value))}</td>`;
         html += "</tr>";
     }
     html += "</table>";

src/core/lib/TLVParser.mjs

@@ -33,20 +33,29 @@ export default class TLVParser {
      * @returns {number}
      */
     getLength() {
+        let bytesInLength = this.bytesInLength;
+        let bigEndian = false;
+
         if (this.basicEncodingRules) {
-            const bit = this.input[this.location];
+            const firstLengthByte = this.input[this.location];
-            if (bit & 0x80) {
-                this.bytesInLength = bit & ~0x80;
-            } else {
             this.location++;
-                return bit & ~0x80;
+
+            if (firstLengthByte & 0x80) {
+                bytesInLength = firstLengthByte & ~0x80;
+                bigEndian = true;
+            } else {
+                return firstLengthByte & ~0x80;
             }
         }
 
         let length = 0;
 
-        for (let i = 0; i < this.bytesInLength; i++) {
+        for (let i = 0; i < bytesInLength; i++) {
+            if (bigEndian) {
+                length = (length << 8) + this.input[this.location];
+            } else {
                 length += this.input[this.location] * Math.pow(Math.pow(2, 8), i);
+            }
             this.location++;
         }
 

src/core/operations/AESDecrypt.mjs

@@ -39,41 +39,46 @@ class AESDecrypt extends Operation {
                 "value": "",
                 "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
             },
+            {
+                "name": "IV Length",
+                "type": "number",
+                "value": 16
+            },
             {
                 "name": "Mode",
                 "type": "argSelector",
                 "value": [
                     {
                         name: "CBC",
-                        off: [5, 6]
+                        off: [6, 7]
                     },
                     {
                         name: "CFB",
-                        off: [5, 6]
+                        off: [6, 7]
                     },
                     {
                         name: "OFB",
-                        off: [5, 6]
+                        off: [6, 7]
                     },
                     {
                         name: "CTR",
-                        off: [5, 6]
+                        off: [6, 7]
                     },
                     {
                         name: "GCM",
-                        on: [5, 6]
+                        on: [6, 7]
                     },
                     {
                         name: "ECB",
-                        off: [5, 6]
+                        off: [6, 7]
                     },
                     {
                         name: "CBC/NoPadding",
-                        off: [5, 6]
+                        off: [6, 7]
                     },
                     {
                         name: "ECB/NoPadding",
-                        off: [5, 6]
+                        off: [6, 7]
                     }
                 ]
             },
@@ -98,6 +103,26 @@ class AESDecrypt extends Operation {
                 "type": "toggleString",
                 "value": "",
                 "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "IV from input",
+                "type": "argSelector",
+                "value": [
+                    {
+                        name: "Off",
+                        on: [1],
+                        off: [2]
+                    },
+                    {
+                        name: "From start",
+                        on: [2],
+                        off: [1]
+                    }, {
+                        name: "From end",
+                        on: [2],
+                        off: [1]
+                    }
+                ]
             }
         ];
     }
@@ -110,14 +135,18 @@ class AESDecrypt extends Operation {
      * @throws {OperationError} if cannot decrypt input or invalid key length
      */
     run(input, args) {
+        let iv;
+
         const key = Utils.convertToByteString(args[0].string, args[0].option),
-            iv = Utils.convertToByteString(args[1].string, args[1].option),
+            ivLength = args[2],
-            mode = args[2].split("/")[0],
+            mode = args[3].split("/")[0],
-            noPadding = args[2].endsWith("NoPadding"),
+            noPadding = args[3].endsWith("NoPadding"),
-            inputType = args[3],
+            inputType = args[4],
-            outputType = args[4],
+            outputType = args[5],
-            gcmTag = Utils.convertToByteString(args[5].string, args[5].option),
+            gcmTag = Utils.convertToByteString(args[6].string, args[6].option),
-            aad = Utils.convertToByteString(args[6].string, args[6].option);
+            aad = Utils.convertToByteString(args[7].string, args[7].option),
+            ivFromInput = args[8];
+
 
         if ([16, 24, 32].indexOf(key.length) < 0) {
             throw new OperationError(`Invalid key length: ${key.length} bytes
@@ -130,6 +159,22 @@ The following algorithms will be used based on the size of the key:
 
         input = Utils.convertToByteString(input, inputType);
 
+        if (ivFromInput !== "Off") {
+            if (input.length <= ivLength) {
+                throw new OperationError(`Input is too short to contain an IV of ${ivLength} bytes.`);
+            }
+
+            if (ivFromInput === "From start") {
+                iv = input.substr(0, ivLength);
+                input = input.substr(ivLength);
+            } else {
+                iv = input.substr(input.length - ivLength);
+                input = input.substr(0, input.length - ivLength);
+            }
+        } else {
+            iv = Utils.convertToByteString(args[1].string, args[1].option);
+        }
+
         const decipher = forge.cipher.createDecipher("AES-" + mode, key);
 
         /* Allow for a "no padding" mode */

src/core/operations/AESEncrypt.mjs

@@ -8,6 +8,7 @@ import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import forge from "node-forge";
 import OperationError from "../errors/OperationError.mjs";
+import { toHexFast } from "../lib/Hex.mjs";
 
 /**
  * AES Encrypt operation
@@ -92,6 +93,11 @@ class AESEncrypt extends Operation {
                 "type": "toggleString",
                 "value": "",
                 "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "Include IV in output",
+                "type": "option",
+                "value": ["Off", "Prepend", "Append"]
             }
         ];
     }
@@ -110,7 +116,8 @@ class AESEncrypt extends Operation {
             noPadding = args[2].endsWith("NoPadding"),
             inputType = args[3],
             outputType = args[4],
-            aad = Utils.convertToByteString(args[5].string, args[5].option);
+            aad = Utils.convertToByteString(args[5].string, args[5].option),
+            includeIV = args[6];
 
         if ([16, 24, 32].indexOf(key.length) < 0) {
             throw new OperationError(`Invalid key length: ${key.length} bytes
@@ -140,19 +147,27 @@ The following algorithms will be used based on the size of the key:
         cipher.update(forge.util.createBuffer(input));
         cipher.finish();
 
+        let output = cipher.output.getBytes();
+
+        if (includeIV === "Prepend") {
+            output = iv + output;
+        } else if (includeIV === "Append") {
+            output = output + iv;
+        }
+
         if (outputType === "Hex") {
+            output = toHexFast(Utils.strToByteArray(output));
+
             if (mode === "GCM") {
-                return cipher.output.toHex() + "\n\n" +
+                return output + "\n\n" +
                     "Tag: " + cipher.mode.tag.toHex();
             }
-            return cipher.output.toHex();
+        } else if (mode === "GCM") {
-        } else {
+            return output + "\n\n" +
-            if (mode === "GCM") {
-                return cipher.output.getBytes() + "\n\n" +
                 "Tag: " + cipher.mode.tag.getBytes();
         }
-            return cipher.output.getBytes();
+
-        }
+        return output;
     }
 
 }

src/core/operations/AnalyseUUID.mjs

@@ -1,5 +1,6 @@
 /**
  * @author n1474335 [n1474335@gmail.com]
+ * @author ko80240 [csk.dev@proton.me]
  * @copyright Crown Copyright 2023
  * @license Apache-2.0
  */
@@ -8,6 +9,7 @@ import * as uuid from "uuid";
 
 import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
+import { toHex } from "../lib/Hex.mjs";
 
 /**
  * Analyse UUID operation
@@ -22,27 +24,128 @@ class AnalyseUUID extends Operation {
 
         this.name = "Analyse UUID";
         this.module = "Crypto";
-        this.description = "Tries to determine information about a given UUID and suggests which version may have been used to generate it";
+        this.description = "Operation for extracting metadata and detecting the version of a given UUID.";
         this.infoURL = "https://wikipedia.org/wiki/Universally_unique_identifier";
         this.inputType = "string";
         this.outputType = "string";
-        this.args = [];
+        this.args = [
+            {
+                name: "Include Metadata",
+                type: "boolean",
+                value: true
+            }
+        ];
     }
 
     /**
-     * @param {string} input
+     * @param {string} input - Expects a valid UUID string
      * @param {Object[]} args
      * @returns {string}
      */
     run(input, args) {
+        input = input.trim();
+
+        let uuidVersion, uuidBytes;
         try {
-            const uuidVersion = uuid.version(input);
+            uuidVersion = uuid.version(input); // Re-using the uuid library to extract version
-            return "UUID version: " + uuidVersion;
+            uuidBytes = uuid.parse(input);     // Re-using the uuid library to parse bytes
         } catch (error) {
             throw new OperationError("Invalid UUID");
         }
+
+        const [includeMetadata] = args;
+        const dv = new DataView(uuidBytes.buffer, uuidBytes.byteOffset, uuidBytes.byteLength); // Dataview helps handle the multi-byte ints
+        const uuidInteger = (dv.getBigUint64(0) << 64n) | dv.getBigUint64(8);
+
+        const sections = [`Version:\n${uuidVersion}`];
+
+        if (includeMetadata) {
+            const parser = UUID_PARSERS[uuidVersion];
+            const decoded = parser?.(uuidBytes, dv);
+            sections.push(formatDecoded(decoded));
         }
 
+        sections.push(`UUID Integer:\n${uuidInteger}`);
+
+        return sections.filter(Boolean).join("\n\n");
+    }
 }
 
 export default AnalyseUUID;
+
+/**
+ * Metadata can be extracted for versions 1, 6, and 7.
+ * Enum-like frozen mapping of UUID version to parser function.
+ */
+const UUID_PARSERS = Object.freeze({
+    1: parsev1v6,
+    6: parsev1v6,
+    7: parsev7,
+});
+
+/**
+ * Versions 1 and 6. Note 6 is a re-order of 1.
+ * Version 1 == layout: timeLow(32) | timeMid(16) | timeHi(12)
+ * Version 6 == layout: timeHi(32)  | timeMid(16) | timeLow(12)
+ */
+function parsev1v6(uuidBytes, dv) {
+    const isV1 = (uuidBytes[6] >> 4) === 1;
+
+    const timeStamp =
+        isV1 ? (
+            (BigInt(dv.getUint16(6) & 0x0fff) << 48n) | // mask off version bits
+            (BigInt(dv.getUint16(4)) << 32n) |
+            BigInt(dv.getUint32(0))
+        ) : (
+            (BigInt(dv.getUint32(0)) << 28n) |
+            (BigInt(dv.getUint16(4)) << 12n) |
+            (BigInt(dv.getUint16(6) & 0x0fff))
+        );
+
+    // Convert to Unix time
+    const milliseconds =
+        Number(
+            (timeStamp - 122192928000000000n) / 10000n
+        );
+
+    return {
+        timestamp: milliseconds,
+        isoTimestamp: new Date(milliseconds).toISOString(),
+        clock: ((uuidBytes[8] & 0x3f) << 8) | uuidBytes[9],
+        node: toHex(uuidBytes.slice(10), ":").toUpperCase()
+    };
+}
+
+/** Version 7 */
+function parsev7(uuidBytes, dv) {
+    const milliseconds = Number((BigInt(dv.getUint32(0)) << 16n) | BigInt(dv.getUint16(4)));
+
+    return {
+        timestamp: milliseconds,
+        isoTimestamp: new Date(milliseconds).toISOString(),
+        randA: ((uuidBytes[6] & 0x0f) << 8) | uuidBytes[7],
+        randB: toHex(uuidBytes.slice(8), "").toUpperCase()
+    };
+}
+
+/**
+ * Formats metadata
+ *
+ * @param {Object|undefined} decoded
+ * @returns {string}
+ */
+function formatDecoded(decoded) {
+    if (!decoded) return "No metadata available. Only versions 1, 6, 7 are supported.";
+
+    return Object.entries({
+        "Timestamp": decoded.timestamp,
+        "Timestamp (ISO)": decoded.isoTimestamp,
+        "Node": decoded.node,
+        "Clock": decoded.clock,
+        "Rand A": decoded.randA,
+        "Rand B": decoded.randB
+    })
+        .filter(([, value]) => value !== undefined)
+        .map(([label, value]) => `${label}:\n${value}`)
+        .join("\n\n");
+}

src/core/operations/AutomatedValidationTestOp.mjs

@@ -0,0 +1,78 @@
+/**
+ * @author CyberChef
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Automated validation test operation
+ */
+class AutomatedValidationTestOp extends Operation {
+
+    /**
+     * AutomatedValidationTestOp constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Automated Validation Test Op";
+        this.module = "Default";
+        this.description = "Operation used specifically to test automated parameter validation.";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Integer Number",
+                "type": "number",
+                "value": 5,
+                "min": 5,
+                "max": 10,
+                "integer": true
+            },
+            {
+                "name": "Real Number",
+                "type": "number",
+                "value": 1.5,
+                "min": 1.5,
+                "max": 5.5
+            },
+            {
+                "name": "Non Empty String",
+                "type": "string",
+                "value": "hello",
+                "maxLength": 5,
+                "allowEmpty": false
+            },
+            {
+                "name": "Empty Allowed String",
+                "type": "string",
+                "value": "",
+                "allowEmpty": true
+            },
+            {
+                "name": "Non Empty Toggle String",
+                "type": "toggleString",
+                "value": {
+                    "option": "Option A",
+                    "string": "test"
+                },
+                "toggleValues": ["Option A", "Option B"],
+                "allowEmpty": false
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        return "Success";
+    }
+
+}
+
+export default AutomatedValidationTestOp;

src/core/operations/BLAKE3.mjs

@@ -6,7 +6,10 @@
 
 import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
-import { blake3 } from "hash-wasm";
+import Utils from "../Utils.mjs";
+import { blake3 } from "@noble/hashes/blake3.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+
 /**
  * BLAKE3 operation
  */
@@ -44,13 +47,16 @@ class BLAKE3 extends Operation {
     run(input, args) {
         const key = args[1];
         const size = args[0];
-        // Check if the user want a key hash or not
+        const opts = { dkLen: size };
-        if (key === "") {
+        const inputBytes = new Uint8Array(Utils.strToArrayBuffer(input));
-            return blake3(input, size*8);
+        if (key !== "") {
-        } if (key.length !== 32) {
+            const keyBytes = new Uint8Array(Utils.strToArrayBuffer(key));
+            if (keyBytes.length !== 32) {
                 throw new OperationError("The key must be exactly 32 bytes long");
             }
-        return blake3(input, size*8, key);
+            opts.key = keyBytes;
+        }
+        return bytesToHex(blake3(inputBytes, opts));
     }
 
 }

src/core/operations/BSONDeserialise.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import bson from "bson";
+import { deserialize } from "bson";
 import OperationError from "../errors/OperationError.mjs";
 
 /**
@@ -37,7 +37,7 @@ class BSONDeserialise extends Operation {
         if (!input.byteLength) return "";
 
         try {
-            const data = bson.deserialize(new Buffer(input));
+            const data = deserialize(new Uint8Array(input));
             return JSON.stringify(data, null, 2);
         } catch (err) {
             throw new OperationError(err.toString());

src/core/operations/BSONSerialise.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import bson from "bson";
+import { serialize } from "bson";
 import OperationError from "../errors/OperationError.mjs";
 
 /**
@@ -38,7 +38,8 @@ class BSONSerialise extends Operation {
 
         try {
             const data = JSON.parse(input);
-            return bson.serialize(data).buffer;
+            const result = serialize(data);
+            return result.buffer.slice(result.byteOffset, result.byteOffset + result.byteLength);
         } catch (err) {
             throw new OperationError(err.toString());
         }

src/core/operations/Bcrypt.mjs

@@ -43,7 +43,7 @@ class Bcrypt extends Operation {
         const rounds = args[0];
         const salt = await bcrypt.genSalt(rounds);
 
-        return await bcrypt.hash(input, salt, null, p => {
+        return await bcrypt.hash(input, salt, undefined, p => {
             // Progress callback
             if (isWorkerEnvironment())
                 self.sendStatusMessage(`Progress: ${(p * 100).toFixed(0)}%`);

src/core/operations/BcryptCompare.mjs

@@ -43,7 +43,7 @@ class BcryptCompare extends Operation {
     async run(input, args) {
         const hash = args[0];
 
-        const match = await bcrypt.compare(input, hash, null, p => {
+        const match = await bcrypt.compare(input, hash, undefined, p => {
             // Progress callback
             if (isWorkerEnvironment())
                 self.sendStatusMessage(`Progress: ${(p * 100).toFixed(0)}%`);

src/core/operations/DecodeText.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import cptable from "codepage";
 import {CHR_ENC_CODE_PAGES} from "../lib/ChrEnc.mjs";
 
@@ -48,6 +49,9 @@ class DecodeText extends Operation {
      */
     run(input, args) {
         const format = CHR_ENC_CODE_PAGES[args[0]];
+        if (!format) {
+            throw new OperationError("Invalid encoding");
+        }
         return cptable.utils.decode(format, new Uint8Array(input));
     }
 

src/core/operations/EncodeText.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import cptable from "codepage";
 import {CHR_ENC_CODE_PAGES} from "../lib/ChrEnc.mjs";
 
@@ -48,6 +49,9 @@ class EncodeText extends Operation {
      */
     run(input, args) {
         const format = CHR_ENC_CODE_PAGES[args[0]];
+        if (!format) {
+            throw new OperationError("Invalid encoding");
+        }
         const encoded = cptable.utils.encode(format, input);
         return new Uint8Array(encoded).buffer;
     }

src/core/operations/EscapeSmartCharacters.mjs

@@ -0,0 +1,129 @@
+/**
+ * @author HarelKatz [github.com/HarelKatz]
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Escape Smart Characters operation
+ */
+class EscapeSmartCharacters extends Operation {
+
+    /**
+     * EscapeSmartCharacters constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Escape Smart Characters";
+        this.module = "Default";
+        this.description = "Converts smart (typographic) Unicode characters — e.g. smart quotes, em/en dashes, ellipses, ©, ®, ™, arrows — into their plain ASCII equivalents.<br><br>Characters with no ASCII mapping (e.g. <code>☣</code>) are handled according to the 'Unmappable characters' option.<br><br>e.g. <code>“Hello” — world…</code> becomes <code>\"Hello\" -- world...</code>";
+        this.infoURL = "";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Unmappable characters",
+                type: "option",
+                value: ["Include", "Remove", "Replace with '.'"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const [unmappable] = args;
+        let result = "";
+        for (const ch of input) {
+            if (ch.codePointAt(0) < 128) {
+                result += ch;
+            } else if (Object.prototype.hasOwnProperty.call(SMART_MAP, ch)) {
+                result += SMART_MAP[ch];
+            } else {
+                switch (unmappable) {
+                    case "Remove":
+                        break;
+                    case "Replace with '.'":
+                        result += ".";
+                        break;
+                    case "Include":
+                    default:
+                        result += ch;
+                        break;
+                }
+            }
+        }
+        return result;
+    }
+
+}
+
+const SMART_MAP = {
+    // Smart double quotes
+    "“": "\"",   // “ left double quotation mark
+    "”": "\"",   // ” right double quotation mark
+    "„": "\"",   // „ double low-9 quotation mark
+    "‟": "\"",   // ‟ double high-reversed-9 quotation mark
+    "″": "\"",   // ″ double prime
+
+    // Smart single quotes / apostrophes
+    "‘": "'",    // ‘ left single quotation mark
+    "’": "'",    // ’ right single quotation mark / apostrophe
+    "‚": "'",    // ‚ single low-9 quotation mark
+    "‛": "'",    // ‛ single high-reversed-9 quotation mark
+    "′": "'",    // ′ prime
+
+    // Dashes & hyphens
+    "‐": "-",    // ‐ hyphen
+    "‑": "-",    // ‑ non-breaking hyphen
+    "‒": "-",    // ‒ figure dash
+    "–": "-",    // – en dash
+    "—": "--",   // — em dash
+    "―": "--",   // ― horizontal bar
+
+    // Ellipsis
+    "…": "...",  // …
+
+    // Trademark / copyright symbols
+    "©": "(c)",  // ©
+    "®": "(r)",  // ®
+    "™": "(tm)", // ™
+
+    // Arrows
+    "←": "<--",  // ←
+    "→": "-->",  // →
+    "↑": "^",    // ↑
+    "↓": "v",    // ↓
+    "↔": "<->",  // ↔
+    "⇐": "<==",  // ⇐
+    "⇒": "==>",  // ⇒
+    "⇔": "<=>",  // ⇔
+
+    // Guillemets
+    "«": "<<",   // «
+    "»": ">>",   // »
+    "‹": "<",    // ‹
+    "›": ">",    // ›
+
+    // Math & misc symbols
+    "×": "x",    // ×
+    "÷": "/",    // ÷
+    "±": "+/-",  // ±
+    "•": "*",    // •
+    "·": ".",    // ·
+
+    // Non-ASCII spaces
+    "\u00A0": " ",    // NBSP
+    "\u2002": " ",    // en space
+    "\u2003": " ",    // em space
+    "\u2009": " ",    // thin space
+    "\u200A": " "     // hair space
+};
+
+export default EscapeSmartCharacters;

src/core/operations/ExtractEmailAddresses.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import { search } from "../lib/Extract.mjs";
+import { EMAIL_REGEX, search } from "../lib/Extract.mjs";
 import { caseInsensitiveSort } from "../lib/Sort.mjs";
 
 /**
@@ -50,8 +50,7 @@ class ExtractEmailAddresses extends Operation {
      */
     run(input, args) {
         const [displayTotal, sort, unique] = args,
-            // email regex from: https://www.regextester.com/98066
+            regex = EMAIL_REGEX;
-            regex = /(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?\.)+[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9](?:[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9-]*[\u00A0-\uD7FF\uE000-\uFFFFa-z0-9])?|\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\.){3}(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\])/ig;
 
         const results = search(
             input,

src/core/operations/FromBase.mjs

@@ -51,9 +51,10 @@ class FromBase extends Operation {
         if (number.length === 1) return result;
 
         // Fractional part
+        const radixBN = new BigNumber(radix);
         for (let i = 0; i < number[1].length; i++) {
             const digit = new BigNumber(number[1][i], radix);
-            result += digit.div(Math.pow(radix, i+1));
+            result = result.plus(digit.div(radixBN.pow(i + 1)));
         }
 
         return result;

src/core/operations/FromPunycode.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import punycode from "punycode";
+import punycode from "punycode.js";
 
 /**
  * From Punycode operation

src/core/operations/GenerateDeBruijnSequence.mjs

@@ -50,6 +50,14 @@ class GenerateDeBruijnSequence extends Operation {
             throw new OperationError("Invalid alphabet size, required to be between 2 and 9 (inclusive).");
         }
 
+        if (!Number.isInteger(k)) {
+            throw new OperationError("Invalid alphabet size, required to be integer.");
+        }
+
+        if (!Number.isInteger(n)) {
+            throw new OperationError("Invalid key length, required to be integer.");
+        }
+
         if (n < 2) {
             throw new OperationError("Invalid key length, required to be at least 2.");
         }

src/core/operations/GenerateLoremIpsum.mjs

@@ -8,6 +8,10 @@ import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
 import { GenerateParagraphs, GenerateSentences, GenerateWords, GenerateBytes } from "../lib/LoremIpsum.mjs";
 
+// arbitrary limits set to avoid DoS by requesting ridiculous amounts of data
+const maxLoremWords = 100_000; // same limit also used for paragraphs/sentences
+const maxLoremCharacters = 1_000_000;
+
 /**
  * Generate Lorem Ipsum operation
  */
@@ -47,9 +51,7 @@ class GenerateLoremIpsum extends Operation {
      */
     run(input, args) {
         const [length, lengthType] = args;
-        if (length < 1) {
+        checkLimits(lengthType, length);
-            throw new OperationError("Length must be greater than 0");
-        }
         switch (lengthType) {
             case "Paragraphs":
                 return GenerateParagraphs(length);
@@ -68,3 +70,32 @@ class GenerateLoremIpsum extends Operation {
 }
 
 export default GenerateLoremIpsum;
+
+/**
+ * check combined validity of lengthType and length arguments
+ * @param {string} lengthType
+ * @param {number} length
+ * @throws {OperationError}
+ */
+function checkLimits(lengthType, length) {
+    if (length < 1) {
+        throw new OperationError("Length must be greater than 0");
+    }
+
+    switch (lengthType) {
+        case "Paragraphs":
+        case "Sentences":
+        case "Words":
+            if (length > maxLoremWords) {
+                throw new OperationError("Length must be less than " + maxLoremWords);
+            }
+            break;
+        case "Bytes":
+            if (length > maxLoremCharacters) {
+                throw new OperationError("Length must be less than " + maxLoremCharacters);
+            }
+            break;
+        default:
+            throw new OperationError("Invalid length type");
+    }
+}

src/core/operations/GeneratePGPKeyPair.mjs

@@ -12,6 +12,7 @@ import { getSubkeySize, ASP } from "../lib/PGP.mjs";
 import { cryptNotice } from "../lib/Crypt.mjs";
 import * as es6promisify from "es6-promisify";
 const promisify = es6promisify.default ? es6promisify.default.promisify : es6promisify.promisify;
+const KEY_FLAGS = kbpgp.const.openpgp.key_flags;
 
 
 /**
@@ -73,11 +74,11 @@ class GeneratePGPKeyPair extends Operation {
         if (name) userIdentifier += name;
         if (email) userIdentifier += ` <${email}>`;
 
-        let flags = kbpgp.const.openpgp.certify_keys;
+        let flags = KEY_FLAGS.certify_keys;
-        flags |= kbpgp.const.openpgp.sign_data;
+        flags |= KEY_FLAGS.sign_data;
-        flags |= kbpgp.const.openpgp.auth;
+        flags |= KEY_FLAGS.auth;
-        flags |= kbpgp.const.openpgp.encrypt_comm;
+        flags |= KEY_FLAGS.encrypt_comm;
-        flags |= kbpgp.const.openpgp.encrypt_storage;
+        flags |= KEY_FLAGS.encrypt_storage;
 
         const keyGenerationOptions = {
             userid: userIdentifier,
@@ -89,11 +90,11 @@ class GeneratePGPKeyPair extends Operation {
             },
             subkeys: [{
                 "nbits": getSubkeySize(keySize),
-                "flags": kbpgp.const.openpgp.sign_data,
+                "flags": KEY_FLAGS.sign_data,
                 "expire_in": 86400 * 365 * 8
             }, {
                 "nbits": getSubkeySize(keySize),
-                "flags": kbpgp.const.openpgp.encrypt_comm | kbpgp.const.openpgp.encrypt_storage,
+                "flags": KEY_FLAGS.encrypt_comm | KEY_FLAGS.encrypt_storage,
                 "expire_in": 86400 * 365 * 2
             }],
             asp: ASP

src/core/operations/Gzip.mjs

@@ -74,13 +74,11 @@ class Gzip extends Operation {
         }
         if (comment.length) {
             options.flags.comment = true;
+            options.flags.fcomment = true;
             options.comment = comment;
         }
         const gzipObj = new Zlib.Gzip(new Uint8Array(input), options);
         const compressed = new Uint8Array(gzipObj.compress());
-        if (options.flags.comment && !(compressed[3] & 0x10)) {
-            compressed[3] |= 0x10;
-        }
         return compressed.buffer;
     }
 

src/core/operations/OffsetChecker.mjs

@@ -99,7 +99,7 @@ class OffsetChecker extends Operation {
             }
         }
 
-        return outputs.join(sampleDelim);
+        return outputs.join(Utils.escapeHtml(sampleDelim));
     }
 
 }

src/core/operations/PGPSign.mjs

@@ -0,0 +1,83 @@
+/**
+ * @author GCHQDeveloper581
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import kbpgp from "kbpgp";
+import { ASP, importPrivateKey } from "../lib/PGP.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import * as es6promisify from "es6-promisify";
+const promisify = es6promisify.default ? es6promisify.default.promisify : es6promisify.promisify;
+
+/**
+ * PGP Sign operation
+ */
+class PGPSign extends Operation {
+
+    /**
+     * PGPSign constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "PGP Sign";
+        this.module = "PGP";
+        this.description = [
+            "Input: the message you want to sign",
+            "<br><br>",
+            "Arguments: the ASCII-armoured PGP private key of the sender.",
+            "<br><br>",
+            "Pretty Good Privacy is an encryption standard (OpenPGP) used for encrypting, decrypting, and signing messages.",
+            "<br><br>",
+            "This function uses the Keybase implementation of PGP.",
+        ].join("\n");
+        this.infoURL = "https://wikipedia.org/wiki/Pretty_Good_Privacy"; // Usually a Wikipedia link. Remember to remove localisation (i.e. https://wikipedia.org/etc rather than https://en.wikipedia.org/etc)
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Private key of signer",
+                "type": "text",
+                "value": ""
+            },
+            {
+                "name": "Private key passphrase (optional)",
+                "type": "string",
+                "value": ""
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     *
+     * @throws {OperationError} if failed private key import or failed encryption
+     */
+    async run(input, args) {
+        const message = input,
+            [privateKey, passphrase] = args;
+        let signedMessage;
+
+        if (!privateKey) throw new OperationError("Enter the private key of the signer.");
+        const privKey = await importPrivateKey(privateKey, passphrase);
+
+        try {
+            signedMessage = await promisify(kbpgp.box)({
+                "msg": message,
+                "sign_with": privKey,
+                "asp": ASP
+            });
+        } catch (err) {
+            throw new OperationError(`Couldn't sign message: ${err}`);
+        }
+
+        return signedMessage;
+    }
+
+}
+
+export default PGPSign;

src/core/operations/ParityBit.mjs

@@ -0,0 +1,128 @@
+/**
+ * @author j83305 [awz22@protonmail.com]
+ * @copyright Crown Copyright 2020
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import { calculateParityBit, decodeParityBit } from "../lib/ParityBit.mjs";
+
+/**
+ * Parity Bit operation
+ */
+class ParityBit extends Operation {
+
+    /**
+     * ParityBit constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Parity Bit";
+        this.module = "Default";
+        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurrence of the delimiter character";
+        this.infoURL = "https://wikipedia.org/wiki/Parity_bit";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Mode",
+                type: "option",
+                value: [
+                    "Even Parity",
+                    "Odd Parity"
+                ]
+            },
+            {
+                name: "Postion",
+                type: "option",
+                value: [
+                    "Start",
+                    "End"
+                ]
+            },
+            {
+                name: "Encode or Decode",
+                type: "option",
+                value: [
+                    "Encode",
+                    "Decode"
+                ]
+            },
+            {
+                name: "Delimiter",
+                type: "shortString",
+                value: ""
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        if (input.length === 0) {
+            return input;
+        }
+        /**
+         * determines weather to use the encode or decode method based off args[2]
+         * @param input input to be encoded or decoded
+         * @param args array
+         */
+        const method = (input, args) => args[2] === "Encode" ? calculateParityBit(input, args) : decodeParityBit(input, args);
+        if (args[3].length > 0) {
+            const byteStrings = input.split(args[3]);
+            for (let byteStringsArrayIndex = 0; byteStringsArrayIndex < byteStrings.length; byteStringsArrayIndex++) {
+                byteStrings[byteStringsArrayIndex] = method(byteStrings[byteStringsArrayIndex], args);
+            }
+            return byteStrings.join(args[3]);
+        }
+        return method(input, args);
+    }
+
+    /**
+     * Highlight Parity Bit
+     *
+     * @param {Object[]} pos
+     * @param {number} pos[].start
+     * @param {number} pos[].end
+     * @param {Object[]} args
+     * @returns {Object[]} pos
+     */
+    highlight(pos, args) {
+        if (args[3].length === 0) {
+            if (args[1] === "Prepend") {
+                pos[0].start += 1;
+                pos[0].end += 1;
+            }
+            return pos;
+        }
+        // need to be able to read input to do the highlighting when there is a delimiter
+    }
+
+    /**
+     * Highlight Parity Bit in reverse
+     *
+     * @param {Object[]} pos
+     * @param {number} pos[].start
+     * @param {number} pos[].end
+     * @param {Object[]} args
+     * @returns {Object[]} pos
+     */
+    highlightReverse(pos, args) {
+        if (args[3].length === 0) {
+            if (args[1] === "Prepend") {
+                if (pos[0].start > 0) {
+                    pos[0].start -= 1;
+                }
+                pos[0].end -= 1;
+            }
+            return pos;
+        }
+    }
+
+}
+
+export default ParityBit;

src/core/operations/ParseEthernetFrame.mjs

@@ -74,17 +74,14 @@ class ParseEthernetFrame extends Operation {
             const ethType = Utils.byteArrayToChars(input.slice(offset, offset+2));
             offset += 2;
 
-
+            if (ethType === "\x81\x00" || ethType === "\x88\xA8") {
-            if (ethType === "\x08\x00") {
-                break;
-            } else if (ethType === "\x81\x00" || ethType === "\x88\xA8") {
                 // Parse the VLAN tag:
                 // [0000] 0000 0000 0000
                 //  ^^^ PRIO  - Ignored
                 //     ^ DEI  - Ignored
                 //        ^^^^ ^^^^ ^^^^ VLAN ID
-                const vlanTag = input.slice(offset+2, offset+4);
+                const vlanTag = input.slice(offset, offset+2);
-                vlans.push((vlanTag[0] & 0b00001111) << 4 | vlanTag[1]);
+                vlans.push(((vlanTag[0] & 0b00001111) << 8) | vlanTag[1]);
 
                 offset += 2;
             } else {
@@ -95,7 +92,7 @@ class ParseEthernetFrame extends Operation {
         const packetData = input.slice(offset);
 
         if (outputFormat === "Packet data") {
-            return Utils.byteArrayToChars(packetData);
+            return Utils.escapeHtml(Utils.byteArrayToChars(packetData));
         } else if (outputFormat === "Packet data (hex)") {
             return toHex(packetData);
         } else if (outputFormat === "Text output") {

src/core/operations/ParseIPv4Header.mjs

@@ -74,7 +74,7 @@ class ParseIPv4Header extends Operation {
             checksum = input[10] << 8 | input[11],
             srcIP = input[12] << 24 | input[13] << 16 | input[14] << 8 | input[15],
             dstIP = input[16] << 24 | input[17] << 16 | input[18] << 8 | input[19],
-            checksumHeader = input.slice(0, 10).concat([0, 0]).concat(input.slice(12, 20));
+            checksumHeader = [...input.slice(0, 10), 0, 0, ...input.slice(12, 20)];
         let version = (input[0] >>> 4) & 0x0f,
             options = [];
 
@@ -138,7 +138,7 @@ class ParseIPv4Header extends Operation {
         } else if (outputFormat === "Data (hex)") {
             return toHex(data);
         } else if (outputFormat === "Data (raw)") {
-            return Utils.byteArrayToChars(data);
+            return Utils.escapeHtml(Utils.byteArrayToChars(data));
         }
     }
 

src/core/operations/ParseObjectIDTimestamp.mjs

@@ -6,7 +6,7 @@
 
 import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
-import BSON from "bson";
+import { ObjectId } from "bson";
 
 /**
  * Parse ObjectID timestamp operation
@@ -35,7 +35,7 @@ class ParseObjectIDTimestamp extends Operation {
      */
     run(input, args) {
         try {
-            const objectId = new BSON.ObjectID(input);
+            const objectId = new ObjectId(input);
             return objectId.getTimestamp().toISOString();
         } catch (err) {
             throw new OperationError(err);

src/core/operations/ParseUserAgent.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import UAParser from "ua-parser-js";
+import { UAParser } from "ua-parser-js";
 
 /**
  * Parse User Agent operation

src/core/operations/ROR13.mjs

@@ -0,0 +1,83 @@
+/**
+ * ROR13 Hash operation (Windows API hashing convention)
+ * @author fufu_btw
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Implements a ROR13 hash used for API name hashing techniques.
+ */
+class ROR13 extends Operation {
+
+    /**
+     * Constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "ROR13";
+        this.module = "Default";
+        this.description = "Computes a ROR13 hash used in API hashing techniques.";
+        this.infoURL = "";
+        this.inputType = "byteArray";
+        this.outputType = "string";
+
+        this.args = [];
+    }
+
+    /**
+     * Rotate right (32-bit)
+     *
+     * @param {number} value - input value
+     * @param {number} bits - rotation bits
+     * @returns {number} rotated value
+     */
+    ror(value, bits) {
+        return ((value >>> bits) | (value << (32 - bits))) >>> 0;
+    }
+
+    /**
+     * Execute ROR13 hash
+     *
+     * @param {byteArray} input - input bytes
+     * @param {Object[]} args - operation arguments
+     * @returns {string} hex hash
+     */
+    run(input, args) {
+        let hash = 0;
+
+        for (let i = 0; i < input.length; i++) {
+            const chr = input[i] & 0xFF;
+            hash = this.ror(hash, 13);
+            hash = (hash + chr) >>> 0;
+        }
+
+        return "0x" + hash.toString(16).padStart(8, "0").toUpperCase();
+    }
+
+    /**
+     * Highlight input
+     *
+     * @param {Object[]} pos
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    highlight(pos, args) {
+        return pos;
+    }
+
+    /**
+     * Reverse highlight
+     *
+     * @param {Object[]} pos
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    highlightReverse(pos, args) {
+        return pos;
+    }
+}
+
+export default ROR13;

src/core/operations/RegularExpression.mjs

@@ -7,6 +7,7 @@
 import XRegExp from "xregexp";
 import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
+import { EMAIL_REGEX } from "../lib/Extract.mjs";
 import OperationError from "../errors/OperationError.mjs";
 
 /**
@@ -45,7 +46,7 @@ class RegularExpression extends Operation {
                     },
                     {
                         name: "Email address",
-                        value: "(?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9](?:[\\u00A0-\\uD7FF\\uE000-\\uFFFF-a-z0-9-]*[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9])?\\.)+[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9](?:[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9-]*[\\u00A0-\\uD7FF\\uE000-\\uFFFFa-z0-9])?|\\[(?:(?:(2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}\\])"
+                        value: EMAIL_REGEX.source // We use a different regex library, so just take the source regex string here
                     },
                     {
                         name: "URL",

src/core/operations/RemoveANSIEscapeCodes.mjs

@@ -0,0 +1,41 @@
+/**
+ * @author Louis-Ladd [lewisharshman1@gmail.com]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Remove ANSI Escape Codes operation
+ */
+class RemoveANSIEscapeCodes extends Operation {
+
+    /**
+     * RemoveANSIEscapeCodes constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Remove ANSI Escape Codes";
+        this.module = "Default";
+        this.description = "Removes ANSI Escape Codes.";
+        this.infoURL = "https://wikipedia.org/wiki/ANSI_escape_code";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const ansiRegex = /\x1B\[[0-?]*[ -/]*[@-~]/g;
+        return input.replace(ansiRegex, "");
+    }
+
+}
+
+export default RemoveANSIEscapeCodes;

src/core/operations/RenderMarkdown.mjs

@@ -35,6 +35,11 @@ class RenderMarkdown extends Operation {
                 name: "Enable syntax highlighting",
                 type: "boolean",
                 value: true
+            },
+            {
+                name: "Open links in new tab.",
+                type: "boolean",
+                value: false
             }
         ];
     }
@@ -45,7 +50,7 @@ class RenderMarkdown extends Operation {
      * @returns {html}
      */
     run(input, args) {
-        const [convertLinks, enableHighlighting] = args,
+        const [convertLinks, enableHighlighting, openLinksBlank] = args,
             md = new MarkdownIt({
                 linkify: convertLinks,
                 html: false, // Explicitly disable HTML rendering
@@ -58,12 +63,38 @@ class RenderMarkdown extends Operation {
 
                     return "";
                 }
-            }),
+            });
-            rendered = md.render(input);
+        if (openLinksBlank) {
-
+            this.makeLinksOpenInNewTab(md);
+        }
+        const rendered = md.render(input);
         return `<div style="font-family: var(--primary-font-family)">${rendered}</div>`;
     }
 
+    /**
+     * Adds target="_blank" to links.
+     * @param {MarkdownIt} md
+     */
+    makeLinksOpenInNewTab(md) {
+        // Adapted from: https://github.com/markdown-it/markdown-it/blob/master/docs/architecture.md#renderer
+        // Remember old renderer, if overridden, or proxy to default renderer
+        const defaultRender = md.renderer.rules.link_open || function(tokens, idx, options, env, self) {
+            return self.renderToken(tokens, idx, options);
+        };
+
+        // eslint-disable-next-line camelcase
+        md.renderer.rules.link_open = function (tokens, idx, options, env, self) {
+            const token = tokens[idx];
+            if (token.attrIndex("target") >= 0) {
+                // Target attribute already set, do not replace.
+                return;
+            }
+            token.attrPush(["target", "_blank"]); // add new attribute
+
+            // pass token to default renderer.
+            return defaultRender(tokens, idx, options, env, self);
+        };
+    }
 }
 
 export default RenderMarkdown;

src/core/operations/RenderPDF.mjs

@@ -0,0 +1,100 @@
+/**
+ * @author Shailendra [singhshailendra.in]
+ * @copyright Crown Copyright 2017
+ * @license Apache-2.0
+ */
+
+import { fromBase64, toBase64 } from "../lib/Base64.mjs";
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import Utils from "../Utils.mjs";
+
+/**
+ * Render PDF operation
+ */
+class RenderPDF extends Operation {
+
+    /**
+     * RenderPDF constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Render PDF";
+        this.module = "File";
+        this.description = "Displays the input as a PDF preview. Supports Raw and Base64 input formats.";
+        this.inputType = "string";
+        this.outputType = "byteArray";
+        this.presentType = "html";
+        this.args = [
+            {
+                "name": "Input format",
+                "type": "option",
+                "value": ["Base64", "Raw"],
+            }
+        ];
+        this.checks = [
+            {
+                pattern: "^%PDF-",
+                flags: "",
+                args: ["Raw"],
+                useful: true,
+                output: {
+                    mime: "application/pdf"
+                }
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {byteArray}
+     */
+    run(input, args) {
+        const inputFormat = args[0];
+
+        if (!input.length) return [];
+
+        // Convert input to raw bytes
+        switch (inputFormat) {
+            case "Base64":
+                input = fromBase64(input, undefined, "byteArray");
+                break;
+            case "Raw":
+            default:
+                input = Utils.strToByteArray(input);
+                break;
+        }
+
+        // Check PDF signature
+        if (
+            input[0] !== 0x25 || // %
+            input[1] !== 0x50 || // P
+            input[2] !== 0x44 || // D
+            input[3] !== 0x46    // F
+        ) {
+            throw new OperationError("Input does not appear to be a PDF file.");
+        }
+
+        return input;
+    }
+
+    /**
+     * Displays the PDF using HTML for web apps.
+     *
+     * @param {byteArray} data
+     * @returns {html}
+     */
+    async present(data) {
+        if (!data.length) return "";
+
+        const base64 = toBase64(data);
+        const dataURI = "data:application/pdf;base64," + base64;
+
+        return `<iframe src="${dataURI}" style="width:100%;height:100%;border:1px solid #ccc;"></iframe>`;
+    }
+
+}
+
+export default RenderPDF;

src/core/operations/SHA2.mjs

@@ -20,7 +20,7 @@ class SHA2 extends Operation {
 
         this.name = "SHA2";
         this.module = "Crypto";
-        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bytes.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bytes.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
+        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bits.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bits.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
         this.infoURL = "https://wikipedia.org/wiki/SHA-2";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";

src/core/operations/SeriesChart.mjs

@@ -15,6 +15,20 @@ import Utils from "../Utils.mjs";
 const d3 = d3temp.default ? d3temp.default : d3temp;
 const nodom = nodomtemp.default ? nodomtemp.default: nodomtemp;
 
+/**
+ * Removes D3's internal bound data from a nodom tree before serialization.
+ * nodom serializes enumerable expando properties such as __data__ as attributes,
+ * so leaving them on attacker-controlled values can create executable markup.
+ *
+ * @param {Object} node
+ */
+function clearD3BoundData(node) {
+    delete node.__data__;
+
+    if (!node.childNodes) return;
+    node.childNodes.forEach(clearD3BoundData);
+}
+
 /**
  * Series chart operation
  */
@@ -222,6 +236,8 @@ class SeriesChart extends Operation {
                 .text(serie.name);
         });
 
+        clearD3BoundData(svg.node());
+
         return svg._groups[0][0].outerHTML;
     }
 

src/core/operations/SetDifference.mjs

@@ -75,9 +75,16 @@ class SetDifference extends Operation {
      * @returns {Object[]}
      */
     runSetDifference(a, b) {
+        const excluded = new Set(b);
+        const seen = new Set();
+
         return a
             .filter((item) => {
-                return b.indexOf(item) === -1;
+                if (excluded.has(item) || seen.has(item)) {
+                    return false;
+                }
+                seen.add(item);
+                return true;
             })
             .join(this.itemDelimiter);
     }

src/core/operations/SetIntersection.mjs

@@ -75,9 +75,16 @@ class SetIntersection extends Operation {
      * @returns {Object[]}
      */
     runIntersect(a, b) {
+        const included = new Set(b);
+        const seen = new Set();
+
         return a
             .filter((item) => {
-                return b.indexOf(item) > -1;
+                if (!included.has(item) || seen.has(item)) {
+                    return false;
+                }
+                seen.add(item);
+                return true;
             })
             .join(this.itemDelimiter);
     }

src/core/operations/ShowBase64Offsets.mjs

@@ -77,84 +77,84 @@ class ShowBase64Offsets extends Operation {
             staticSection = offset0.slice(0, -3);
             offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64(staticSection, alphabet).slice(0, -2)) + "'>" +
-                staticSection + "</span>" +
+                Utils.escapeHtml(staticSection) + "</span>" +
-                "<span class='hl5'>" + offset0.substr(offset0.length - 3, 1) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset0.substr(offset0.length - 3, 1)) + "</span>" +
-                "<span class='hl3'>" + offset0.substr(offset0.length - 2) + "</span>";
+                "<span class='hl3'>" + Utils.escapeHtml(offset0.substr(offset0.length - 2)) + "</span>";
         } else if (len0 % 4 === 3) {
             staticSection = offset0.slice(0, -2);
             offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64(staticSection, alphabet).slice(0, -1)) + "'>" +
-                staticSection + "</span>" +
+                Utils.escapeHtml(staticSection) + "</span>" +
-                "<span class='hl5'>" + offset0.substr(offset0.length - 2, 1) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset0.substr(offset0.length - 2, 1)) + "</span>" +
-                "<span class='hl3'>" + offset0.substr(offset0.length - 1) + "</span>";
+                "<span class='hl3'>" + Utils.escapeHtml(offset0.substr(offset0.length - 1)) + "</span>";
         } else {
             staticSection = offset0;
             offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64(staticSection, alphabet)) + "'>" +
-                staticSection + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>";
         }
 
         if (!showVariable) {
-            offset0 = staticSection;
+            offset0 = Utils.escapeHtml(staticSection);
         }
 
 
         // Highlight offset 1
-        padding = "<span class='hl3'>" + offset1.substr(0, 1) + "</span>" +
+        padding = "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(0, 1)) + "</span>" +
-            "<span class='hl5'>" + offset1.substr(1, 1) + "</span>";
+            "<span class='hl5'>" + Utils.escapeHtml(offset1.substr(1, 1)) + "</span>";
         offset1 = offset1.substr(2);
         if (len1 % 4 === 2) {
             staticSection = offset1.slice(0, -3);
             offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1, -2)) + "'>" +
-                staticSection + "</span>" +
+                Utils.escapeHtml(staticSection) + "</span>" +
-                "<span class='hl5'>" + offset1.substr(offset1.length - 3, 1) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset1.substr(offset1.length - 3, 1)) + "</span>" +
-                "<span class='hl3'>" + offset1.substr(offset1.length - 2) + "</span>";
+                "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(offset1.length - 2)) + "</span>";
         } else if (len1 % 4 === 3) {
             staticSection = offset1.slice(0, -2);
             offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1, -1)) + "'>" +
-                staticSection + "</span>" +
+                Utils.escapeHtml(staticSection) + "</span>" +
-                "<span class='hl5'>" + offset1.substr(offset1.length - 2, 1) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset1.substr(offset1.length - 2, 1)) + "</span>" +
-                "<span class='hl3'>" + offset1.substr(offset1.length - 1) + "</span>";
+                "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(offset1.length - 1)) + "</span>";
         } else {
             staticSection = offset1;
             offset1 = padding +  "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1)) + "'>" +
-                staticSection + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>";
         }
 
         if (!showVariable) {
-            offset1 = staticSection;
+            offset1 = Utils.escapeHtml(staticSection);
         }
 
         // Highlight offset 2
-        padding = "<span class='hl3'>" + offset2.substr(0, 2) + "</span>" +
+        padding = "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(0, 2)) + "</span>" +
-            "<span class='hl5'>" + offset2.substr(2, 1) + "</span>";
+            "<span class='hl5'>" + Utils.escapeHtml(offset2.substr(2, 1)) + "</span>";
         offset2 = offset2.substr(3);
         if (len2 % 4 === 2) {
             staticSection = offset2.slice(0, -3);
             offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2, -2)) + "'>" +
-                staticSection + "</span>" +
+                Utils.escapeHtml(staticSection) + "</span>" +
-                "<span class='hl5'>" + offset2.substr(offset2.length - 3, 1) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset2.substr(offset2.length - 3, 1)) + "</span>" +
-                "<span class='hl3'>" + offset2.substr(offset2.length - 2) + "</span>";
+                "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(offset2.length - 2)) + "</span>";
         } else if (len2 % 4 === 3) {
             staticSection = offset2.slice(0, -2);
             offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2, -2)) + "'>" +
-                staticSection + "</span>" +
+                Utils.escapeHtml(staticSection) + "</span>" +
-                "<span class='hl5'>" + offset2.substr(offset2.length - 2, 1) + "</span>" +
+                "<span class='hl5'>" + Utils.escapeHtml(offset2.substr(offset2.length - 2, 1)) + "</span>" +
-                "<span class='hl3'>" + offset2.substr(offset2.length - 1) + "</span>";
+                "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(offset2.length - 1)) + "</span>";
         } else {
             staticSection = offset2;
             offset2 = padding +  "<span data-toggle='tooltip' data-placement='top' title='" +
                 Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2)) + "'>" +
-                staticSection + "</span>";
+                Utils.escapeHtml(staticSection) + "</span>";
         }
 
         if (!showVariable) {
-            offset2 = staticSection;
+            offset2 = Utils.escapeHtml(staticSection);
         }
 
         return (showVariable ? "Characters highlighted in <span class='hl5'>green</span> could change if the input is surrounded by more data." +

src/core/operations/ToHexdump.mjs

@@ -8,6 +8,8 @@ import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import OperationError from "../errors/OperationError.mjs";
 
+const MAX_WIDTH = 65536;
+
 /**
  * To Hexdump operation
  */
@@ -30,7 +32,8 @@ class ToHexdump extends Operation {
                 "name": "Width",
                 "type": "number",
                 "value": 16,
-                "min": 1
+                "min": 1,
+                "max": MAX_WIDTH
             },
             {
                 "name": "Upper case hex",
@@ -63,6 +66,9 @@ class ToHexdump extends Operation {
         if (length < 1 || Math.round(length) !== length)
             throw new OperationError("Width must be a positive integer");
 
+        if (length > MAX_WIDTH)
+            throw new OperationError(`Width must be no more than ${MAX_WIDTH}`);
+
         const lines = [];
         for (let i = 0; i < data.length; i += length) {
             let lineNo = Utils.hex(i, 8);

src/core/operations/ToPunycode.mjs

@@ -5,7 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
-import punycode from "punycode";
+import punycode from "punycode.js";
 
 /**
  * To Punycode operation

src/core/operations/URLEncode.mjs

@@ -21,7 +21,7 @@ class URLEncode extends Operation {
         this.module = "URL";
         this.description = "Encodes problematic characters into percent-encoding, a format supported by URIs/URLs.<br><br>e.g. <code>=</code> becomes <code>%3d</code>";
         this.infoURL = "https://wikipedia.org/wiki/Percent-encoding";
-        this.inputType = "string";
+        this.inputType = "byteArray";
         this.outputType = "string";
         this.args = [
             {
@@ -33,34 +33,38 @@ class URLEncode extends Operation {
     }
 
     /**
-     * @param {string} input
+     * @param {byteArray} input
      * @param {Object[]} args
      * @returns {string}
      */
     run(input, args) {
         const encodeAll = args[0];
-        return encodeAll ? this.encodeAllChars(input) : encodeURI(input);
+        return this.encodeBytes(input, encodeAll);
     }
 
     /**
-     * Encode characters in URL outside of encodeURI() function spec
+     * Encode bytes in URL using percent encoding.
      *
-     * @param {string} str
+     * @param {byteArray} bytes
+     * @param {boolean} encodeAll
      * @returns {string}
      */
-    encodeAllChars (str) {
+    encodeBytes(bytes, encodeAll) {
-        // TODO Do this programmatically
+        const safeChars = encodeAll ?
-        return encodeURIComponent(str)
+            /^[A-Za-z0-9]$/ :
-            .replace(/!/g, "%21")
+            /^[A-Za-z0-9:/?#[\]@!$&'()*+,;=%]$/;
-            .replace(/#/g, "%23")
+
-            .replace(/'/g, "%27")
+        let output = "";
-            .replace(/\(/g, "%28")
+
-            .replace(/\)/g, "%29")
+        for (const byte of bytes) {
-            .replace(/\*/g, "%2A")
+            const char = String.fromCharCode(byte);
-            .replace(/-/g, "%2D")
+
-            .replace(/\./g, "%2E")
+            output += safeChars.test(char) ?
-            .replace(/_/g, "%5F")
+                char :
-            .replace(/~/g, "%7E");
+                "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+        }
+
+        return output;
     }
 
 }

src/core/operations/UnescapeUnicodeCharacters.mjs

@@ -56,7 +56,8 @@ class UnescapeUnicodeCharacters extends Operation {
      */
     run(input, args) {
         const prefix = prefixToRegex[args[0]],
-            regex = new RegExp(prefix+"([a-f\\d]{4})", "ig");
+            quantifier = args[0] === "U+" ? "{4,6}" : "{4}",
+            regex = new RegExp(prefix+"([a-f\\d]"+quantifier+")", "ig");
         let output = "",
             m,
             i = 0;

src/core/operations/Wrap.mjs

@@ -0,0 +1,47 @@
+/**
+ * @author 0xff1ce [github.com/0xff1ce]
+ * @copyright Crown Copyright 2024
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Wrap operation
+ */
+class Wrap extends Operation {
+
+    /**
+     * Wrap constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Wrap";
+        this.module = "Default";
+        this.description = "Wraps the input text at a specified number of characters per line.";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Line Width",
+                "type": "number",
+                "value": 64,
+            },
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        if (!input) return "";  // Handle empty input
+        const lineWidth = args[0];
+        const regex = new RegExp(`.{1,${lineWidth}}`, "g");
+        return input.match(regex).join("\n");
+    }
+}
+
+export default Wrap;

src/core/operations/XORChecksum.mjs

@@ -7,12 +7,12 @@
 import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import { toHex } from "../lib/Hex.mjs";
+import OperationError from "../errors/OperationError.mjs"; 
 
 /**
  * XOR Checksum operation
  */
 class XORChecksum extends Operation {
-
     /**
      * XORChecksum constructor
      */
@@ -21,7 +21,8 @@ class XORChecksum extends Operation {
 
         this.name = "XOR Checksum";
         this.module = "Crypto";
-        this.description = "XOR Checksum splits the input into blocks of a configurable size and performs the XOR operation on these blocks.";
+        this.description =
+            "XOR Checksum splits the input into blocks of a configurable size and performs the XOR operation on these blocks.";
         this.infoURL = "https://wikipedia.org/wiki/XOR";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -29,7 +30,7 @@ class XORChecksum extends Operation {
             {
                 name: "Blocksize",
                 type: "number",
-                value: 4
+                value: 4,
             },
         ];
     }
@@ -41,6 +42,12 @@ class XORChecksum extends Operation {
      */
     run(input, args) {
         const blocksize = args[0];
+
+    
+        if (!Number.isInteger(blocksize) || blocksize <= 0) {
+            throw new OperationError("Blocksize must be a positive integer.");
+        }
+
         input = new Uint8Array(input);
 
         const res = Array(blocksize);

src/node/NodeRecipe.mjs

@@ -88,16 +88,17 @@ class NodeRecipe {
      * @param {NodeDish} dish
      * @returns {NodeDish}
      */
-    execute(dish) {
+    async execute(dish) {
-        return this.opList.reduce((prev, curr) => {
+        let prev = dish;
-            // CASE where opList item is op and args
+        for (const curr of this.opList) {
             if (Object.prototype.hasOwnProperty.call(curr, "op") &&
                 Object.prototype.hasOwnProperty.call(curr, "args")) {
-                return curr.op(prev, curr.args);
+                prev = await curr.op(prev, curr.args);
+            } else {
+                prev = await curr(prev);
             }
-            // CASE opList item is just op.
+        }
-            return curr(prev);
+        return prev;
-        }, dish);
     }
 }
 

src/node/api.mjs

@@ -10,7 +10,7 @@
 
 import NodeDish from "./NodeDish.mjs";
 import NodeRecipe from "./NodeRecipe.mjs";
-import OperationConfig from "../core/config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "../core/config/OperationConfig.json" with { type: "json" };
 import { sanitise, removeSubheadingsFromArray, sentenceToCamelCase } from "./apiUtils.mjs";
 import ExcludedOperationError from "../core/errors/ExcludedOperationError.mjs";
 
@@ -193,6 +193,8 @@ export function _wrap(OpClass) {
         wrapped = async (input, args=null) => {
             const {transformedInput, transformedArgs} = prepareOp(opInstance, input, args);
 
+            opInstance.validateIngredients(transformedArgs);
+
             // SPECIAL CASE for Magic. Other flowControl operations will
             // not work because the opList is not passed in.
             if (isFlowControl) {
@@ -229,6 +231,7 @@ export function _wrap(OpClass) {
          */
         wrapped = (input, args=null) => {
             const {transformedInput, transformedArgs} = prepareOp(opInstance, input, args);
+            opInstance.validateIngredients(transformedArgs);
             const result = opInstance.run(transformedInput, transformedArgs);
             return new NodeDish({
                 value: result,
@@ -324,10 +327,10 @@ export function help(input) {
  * @returns {NodeDish} of the result
  * @throws {TypeError} if invalid recipe given.
  */
-export function bake(input, recipeConfig) {
+export async function bake(input, recipeConfig) {
     const recipe = new NodeRecipe(recipeConfig);
     const dish = ensureIsDish(input);
-    return recipe.execute(dish);
+    return await recipe.execute(dish);
 }
 
 

src/web/App.mjs

@@ -42,6 +42,14 @@ class App {
         this.progress      = 0;
         this.ingId         = 0;
 
+        // stateChangeId increments on every statechange dispatch; bakeStateId records
+        // the stateChangeId captured when the most recent bake started. autoBake uses
+        // these to decide whether the output is genuinely stale, so a debounced
+        // autoBake firing shortly after a manual bake doesn't clobber the bake's
+        // hideStaleIndicator with a redundant showStaleIndicator.
+        this.stateChangeId = 0;
+        this.bakeStateId   = -1;
+
         this.appLoaded     = false;
         this.workerLoaded  = false;
         this.waitersLoaded = false;
@@ -136,6 +144,9 @@ class App {
     bake(step=false) {
         if (this.baking) return;
 
+        // Record which state version this bake is covering.
+        this.bakeStateId = this.stateChangeId;
+
         // Reset attemptHighlight flag
         this.options.attemptHighlight = true;
 
@@ -166,7 +177,10 @@ class App {
                 nums: [this.manager.tabs.getActiveTab("input")],
                 step: false
             });
-        } else {
+        } else if (this.bakeStateId < this.stateChangeId) {
+            // Only show stale-indicator if the most recent bake didn't cover the
+            // current state. Without this guard, a debounced autoBake firing after
+            // a manual bake completed would re-show the indicator on fresh output.
             this.manager.controls.showStaleIndicator();
         }
     }
@@ -768,6 +782,10 @@ class App {
      * @param {event} e
      */
     stateChange(e) {
+        // Bump the state-change counter synchronously so a manual bake invoked between
+        // here and the debounced autoBake firing can record it via bakeStateId.
+        this.stateChangeId++;
+
         debounce(function() {
             this.progress = 0;
             this.autoBake();

src/web/HTMLIngredient.mjs

@@ -166,6 +166,7 @@ class HTMLIngredient {
                         id="${this.id}"
                         tabindex="${this.tabIndex}"
                         arg-name="${this.name}"
+                        data-target="${this.target}"
                         ${this.disabled ? "disabled" : ""}>`;
                 for (i = 0; i < this.value.length; i++) {
                     if ((m = this.value[i].name.match(/\[([a-z0-9 -()^]+)\]/i))) {

src/web/HTMLOperation.mjs

@@ -43,17 +43,24 @@ class HTMLOperation {
     /**
      * Renders the operation in HTML as a stub operation with no ingredients.
      *
+     * @param {boolean} removeIcon - show icon for removing operation
+     * @param {string} elementId - element ID for aria usage
      * @returns {string}
      */
-    toStubHtml(removeIcon) {
+    toStubHtml(removeIcon = false, elementId = null) {
         let html = "<li class='operation'";
 
+        if (elementId) {
+            html += ` id='${elementId}'`;
+        }
+
         if (this.description) {
             const infoLink = this.infoURL ? `<hr>${titleFromWikiLink(this.infoURL)}` : "";
+            const content = Utils.escapeHtml(this.description + infoLink);
 
             html += ` data-container='body' data-toggle='popover' data-placement='right'
-                data-content="${this.description}${infoLink}" data-html='true' data-trigger='hover'
+                data-content="${content}" data-html='true' data-trigger='hover'
-                data-boundary='viewport'`;
+                data-boundary='viewport' role='button'`;
         }
 
         html += ">" + this.name;

src/web/html/index.html

@@ -173,7 +173,7 @@
                         Operations
                         <span class="op-count"></span>
                     </div>
-                    <input id="search" type="search" class="form-control" placeholder="Search..." autocomplete="off" tabindex="0" data-help-title="Searching for operations" data-help="<p>Use the search box to find useful operations.</p><p>Both operation names and descriptions are queried using a fuzzy matching algorithm.</p>">
+                    <input id="search" type="search" class="form-control" placeholder="Search..." autocomplete="off" tabindex="0" data-help-title="Searching for operations" data-help="<p>Use the search box to find useful operations.</p><p>Both operation names and descriptions are queried using a fuzzy matching algorithm.</p>" aria-owns="search-results">
                     <ul id="search-results" class="op-list"></ul>
                     <div id="categories" class="panel-group no-select"></div>
                 </div>
@@ -868,15 +868,15 @@
                             Be aware that the standalone version will never update itself, meaning it will not receive bug fixes or new features until you re-download newer versions manually.
                         </p>
 
-                        <h6>CyberChef v<%= htmlWebpackPlugin.options.version %></h6>
+                        <h6>CyberChef <%= htmlWebpackPlugin.options.version %></h6>
                         <ul>
                             <li>Build time: <%= htmlWebpackPlugin.options.compileTime %></li>
-                            <li>The changelog for this version can be viewed <a href="https://github.com/gchq/CyberChef/blob/v<%= htmlWebpackPlugin.options.version %>/CHANGELOG.md">here</a></li>
+                            <li>The changelog for this version can be viewed <a href="https://github.com/gchq/CyberChef/blob/v<%= htmlWebpackPlugin.options.latestReleaseVersion %>/CHANGELOG.md">here</a></li>
                             <li>&copy; Crown Copyright 2016-<%= htmlWebpackPlugin.options.compileYear %></li>
                             <li>Released under the Apache Licence, Version 2.0</li>
                             <li>SHA256 hash: DOWNLOAD_HASH_PLACEHOLDER</li>
                         </ul>
-                        <a href="CyberChef_v<%= htmlWebpackPlugin.options.version %>.zip" download class="btn btn-outline-primary">Download ZIP file</a>
+                        <a href="<%= htmlWebpackPlugin.options.downloadZipFilename %>" download class="btn btn-outline-primary">Download ZIP file</a>
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-primary" data-dismiss="modal">Ok</button>

src/web/index.js

@@ -17,8 +17,8 @@ import * as CanvasComponents from "../core/lib/CanvasComponents.mjs";
 
 // CyberChef
 import App from "./App.mjs";
-import Categories from "../core/config/Categories.json" assert {type: "json"};
+import Categories from "../core/config/Categories.json" with { type: "json" };
-import OperationConfig from "../core/config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "../core/config/OperationConfig.json" with { type: "json" };
 
 
 /**

src/web/static/sitemap.mjs

@@ -1,5 +1,5 @@
-import sm from "sitemap";
+import { SitemapStream, streamToPromise } from "sitemap";
-import OperationConfig from "../../core/config/OperationConfig.json" assert { type: "json" };
+import OperationConfig from "../../core/config/OperationConfig.json" with { type: "json" };
 
 /**
  * Generates an XML sitemap for all CyberChef operations and a number of recipes.
@@ -11,7 +11,7 @@ import OperationConfig from "../../core/config/OperationConfig.json" assert { ty
 
 const baseUrl = "https://gchq.github.io/CyberChef/";
 
-const smStream = new sm.SitemapStream({});
+const smStream = new SitemapStream({});
 
 smStream.write({
     url: baseUrl,
@@ -28,6 +28,6 @@ for (const op in OperationConfig) {
 }
 smStream.end();
 
-sm.streamToPromise(smStream).then(
+streamToPromise(smStream).then(
     (buffer) => console.log(buffer.toString()), // eslint-disable-line no-console
 );

src/web/stylesheets/layout/_io.css

@@ -24,6 +24,14 @@
     height: 100%;
     user-select: auto;
 }
+
+#output-html > img {
+    display: block;
+    max-width: 100%;
+    max-height: 100%;
+    margin: auto;
+}
+
 #output-text.html-output .cm-line .cm-widgetBuffer,
 #output-text.html-output .cm-line>br {
     display: none;

src/web/waiters/OperationsWaiter.mjs

@@ -28,17 +28,16 @@ class OperationsWaiter {
         this.removeIntent = false;
     }
 
-
     /**
      * Handler for search events.
      * Finds operations which match the given search term and displays them under the search box.
      *
-     * @param {event} e
+     * @param {KeyboardEvent | ClipboardEvent | Event} e
      */
     searchOperations(e) {
         let ops, selected;
 
-        if (e.type === "search" || e.keyCode === 13) { // Search or Return
+        if ((e.type === "search" && e.target.value !== "") || e.keyCode === 13) { // Search (non-empty) or Return
             e.preventDefault();
             ops = document.querySelectorAll("#search-results li");
             if (ops.length) {
@@ -49,27 +48,43 @@ class OperationsWaiter {
             }
         }
 
+        /**
+         * Sets up the operation element with the correct attributes when selected
+         * @param {HTMLElement} element
+         */
+        const _selectOperation = (element) => {
+            element.classList.add("selected-op");
+            element.scrollIntoView({block: "nearest"});
+            $(element).popover("show");
+            e.target.setAttribute("aria-activedescendant", element.id);
+        };
+
+        /**
+         * Sets up the operation element with the correct attributes when deselected
+         * @param {HTMLElement} element
+         */
+        const _deselectOperation = (element) => {
+            element.classList.remove("selected-op");
+            $(element).popover("hide");
+        };
+
         if (e.keyCode === 40) { // Down
             e.preventDefault();
             ops = document.querySelectorAll("#search-results li");
             if (ops.length) {
                 selected = this.getSelectedOp(ops);
-                if (selected > -1) {
+                if (selected > -1) _deselectOperation(ops[selected]);
-                    ops[selected].classList.remove("selected-op");
-                }
                 if (selected === ops.length-1) selected = -1;
-                ops[selected+1].classList.add("selected-op");
+                _selectOperation(ops[selected+1]);
             }
         } else if (e.keyCode === 38) { // Up
             e.preventDefault();
             ops = document.querySelectorAll("#search-results li");
             if (ops.length) {
                 selected = this.getSelectedOp(ops);
-                if (selected > -1) {
+                if (selected > -1) _deselectOperation(ops[selected]);
-                    ops[selected].classList.remove("selected-op");
-                }
                 if (selected === 0) selected = ops.length;
-                ops[selected-1].classList.add("selected-op");
+                _selectOperation(ops[selected-1]);
             }
         } else {
             const searchResultsEl = document.getElementById("search-results");
@@ -83,11 +98,13 @@ class OperationsWaiter {
                 searchResultsEl.removeChild(searchResultsEl.firstChild);
             }
 
+            document.querySelector("#search").removeAttribute("aria-activedescendant");
+
             $("#categories .show").collapse("hide");
             if (str) {
                 const matchedOps = this.filterOperations(str, true);
                 const matchedOpsHtml = matchedOps
-                    .map(v => v.toStubHtml())
+                    .map((operation, idx) => operation.toStubHtml(false, `search-result-${idx}`))
                     .join("");
 
                 searchResultsEl.innerHTML = matchedOpsHtml;
@@ -103,7 +120,7 @@ class OperationsWaiter {
      * @param {string} searchStr
      * @param {boolean} highlight - Whether or not to highlight the matching string in the operation
      *   name and description
-     * @returns {string[]}
+     * @returns {HTMLOperation[]}
      */
     filterOperations(inStr, highlight) {
         const matchedOps = [];

src/web/waiters/RecipeWaiter.mjs

@@ -487,11 +487,19 @@ class RecipeWaiter {
      * @param {HTMLElement} op
      */
     triggerArgEvents(op) {
-        // Trigger populateOption and argSelector events
+        // Trigger argSelector events and populateOption events only where the target is empty.
+        // When loading a saved recipe, arguments are populated before this method is called, so
+        // re-triggering populateOption events would overwrite saved custom values with defaults.
+        const args = op.querySelectorAll(".arg");
         const triggerableOptions = op.querySelectorAll(".populate-option, .arg-selector");
         const evt = new Event("change", {bubbles: true});
+
         if (triggerableOptions.length) {
             for (const el of triggerableOptions) {
+                if (el.classList.contains("populate-option")) {
+                    const target = args[el.getAttribute("data-target")];
+                    if (target && target.value !== "") continue;
+                }
                 el.dispatchEvent(evt);
             }
         }

tests/browser/00_nightwatch.js

@@ -56,6 +56,32 @@ module.exports = {
         browser.expect.element("//li[contains(@class, 'operation') and text()='Play Media']").to.be.present;
         browser.expect.element("//li[contains(@class, 'operation') and text()='Disassemble x86']").to.be.present;
         browser.expect.element("//li[contains(@class, 'operation') and text()='Register']").to.be.present;
+        browser.expect.element("//li[contains(@class, 'operation') and text()='Escape Smart Characters']").to.be.present;
+    },
+
+    "Operation popover descriptions render HTML safely": browser => {
+        const favouritesCat = "//a[contains(@class, 'category-title') and contains(@data-target, '#catFavourites')]",
+            op = "//ul[@id='search-results']//li[contains(@class, 'operation') and contains(., 'Escape Smart Characters')]";
+
+        browser
+            .useCss()
+            .clearValue("#search")
+            .setValue("#search", "Escape Smart Characters")
+            .useXpath()
+            .waitForElementVisible(op, 1000)
+            .moveToElement(op, 10, 10)
+            .useCss()
+            .waitForElementVisible(".popover-body code:last-of-type", 1000)
+            .expect.element(".popover-body code:last-of-type").text.to.contain("\"Hello\" -- world...");
+
+        browser
+            .useCss()
+            .moveToElement("#operations .title", 1, 1)
+            .waitForElementNotPresent(".popover-body", 1000)
+            .clearValue("#search")
+            .useXpath()
+            .getLocationInView(favouritesCat)
+            .click(favouritesCat);
     },
 
     "Recipe can be run": browser => {

tests/browser/02_ops.js

@@ -30,8 +30,8 @@ module.exports = {
         testOp(browser, "A1Z26 Cipher Decode", "20 5 19 20 15 21 20 16 21 20", "testoutput");
         testOp(browser, "A1Z26 Cipher Encode", "test input", "20 5 19 20 9 14 16 21 20");
         testOp(browser, "ADD", "test input", "Ê»ÉÊv¿ÄÆËÊ", [{ "option": "Hex", "string": "56" }]);
-        testOp(browser, "AES Decrypt", "b443f7f7c16ac5396a34273f6f639caa", "test output", [{ "option": "Hex", "string": "00112233445566778899aabbccddeeff" }, { "option": "Hex", "string": "00000000000000000000000000000000" }, "CBC", "Hex", "Raw", { "option": "Hex", "string": "" }]);
+        testOp(browser, "AES Decrypt", "b443f7f7c16ac5396a34273f6f639caa", "test output", [{ "option": "Hex", "string": "00112233445566778899aabbccddeeff" }, { "option": "Hex", "string": "00000000000000000000000000000000" }, 16, "CBC", "Hex", "Raw", { "option": "Hex", "string": "" }, { "option": "Hex", "string": "" }, "Off"]);
-        testOp(browser, "AES Encrypt", "test input", "e42eb8fbfb7a98fff061cd2c1a794d92", [{"option": "Hex", "string": "00112233445566778899aabbccddeeff"}, {"option": "Hex", "string": "00000000000000000000000000000000"}, "CBC", "Raw", "Hex"]);
+        testOp(browser, "AES Encrypt", "test input", "e42eb8fbfb7a98fff061cd2c1a794d92", [{"option": "Hex", "string": "00112233445566778899aabbccddeeff"}, {"option": "Hex", "string": "00000000000000000000000000000000"}, "CBC", "Raw", "Hex", "Off"]);
         testOp(browser, "AND", "test input", "4$04  $044", [{ "option": "Hex", "string": "34" }]);
         testOp(browser, "Add line numbers", "test input", "1 test input");
         testOp(browser, ["From Hex", "Add Text To Image", "SHA2"], Images.PNG_HEX, "50cdf8ea483c55564a091650c2bccb4586f919b721e5fe9d6a61660505b4346d6ebdb2ef0cf075a7728cd84cb26ea3e477b5bd86a94a49a27d79423994afb60a", [[], ["Chef", "Center", "Middle", 0, 0, 16, "Roboto"], []]);
@@ -64,7 +64,7 @@ module.exports = {
         testOp(browser, "BSON serialise", '{"a":"test"}', "\u0011\u0000\u0000\u0000\u0002a\u0000\u0005\u0000\u0000\u0000test\u0000\u0000");
         // testOp(browser, "Bacon Cipher Decode", "test input", "test_output");
         // testOp(browser, "Bacon Cipher Encode", "test input", "test_output");
-        testOp(browser, "Bcrypt", "test input", /^\$2a\$06\$.{53}$/, [6]);
+        testOp(browser, "Bcrypt", "test input", /^\$2b\$06\$.{53}$/, [6]);
         testOp(browser, "Bcrypt compare", "test input", "Match: test input", ["$2a$05$FCfBSVX7OeRkK.9kQVFCiOYu9XtwtIbePqUiroD1lkASW9q5QClzG"]);
         testOp(browser, "Bcrypt parse", "$2a$05$kXWtAIGB/R8VEzInoM5ocOTBtyc0m2YTIwFiBU/0XoW032f9QrkWW", /Rounds: 5/);
         testOp(browser, "Bifid Cipher Decode", "qblb tfovy", "test input", ["pass"]);
@@ -80,8 +80,8 @@ module.exports = {
         testOpHtml(browser, "Bombe", "XTSYN WAEUG EZALY NRQIM AMLZX MFUOD AWXLY LZCUZ QOQBQ JLCPK NDDRW F", "table tr:last-child td:first-child", "ECG", ["3-rotor", "LEYJVCNIXWPBQMDRTAKZGFUHOS", "BDFHJLCPRTXVZNYEIWGAKMUSQO<W", "AJDKSIRUXBLHWTMCQGZNPYFVOE<F", "ESOVPZJAYQUIRHXLNFTGKDCMWB<K", "AY BR CU DH EQ FS GL IP JX KN MO TZ VW", "HELLO CYBER CHEFU SER", 0, true]);
         testOp(browser, ["Bzip2 Compress", "To Hex"], "test input", "42 5a 68 39 31 41 59 26 53 59 cf 96 82 1d 00 00 03 91 80 40 00 02 21 4e 00 20 00 21 90 c2 10 c0 88 33 92 8e df 17 72 45 38 50 90 cf 96 82 1d");
         testOp(browser, ["From Hex", "Bzip2 Decompress"], "425a68393141592653597b0884b7000003038000008200ce00200021a647a4218013709517c5dc914e14241ec2212dc0", "test_output", [[], [true]]);
-    // testOp(browser, "CBOR Decode", "test input", "test output");
+        testOp(browser, ["From Hex", "CBOR Decode"], "f9 3e 00", "1.5");
-    // testOp(browser, "CBOR Encode", "test input", "test output");
+        testOp(browser, ["CBOR Encode", "To Hex"], "1.5", "f9 3e 00");
         testOp(browser, "CRC Checksum", "test input", "77c7", ["CRC-16"]);
         testOp(browser, "CRC Checksum", "test input", "29822bc8", ["CRC-32"]);
         testOp(browser, "CRC Checksum", "test input", "9d", ["CRC-8"]);
@@ -278,11 +278,11 @@ module.exports = {
         testOpHtml(browser, "Parse UDP", "04 89 00 35 00 2c 01 01", "tr:last-child td:last-child", "0x0101");
         // testOp(browser, "Parse UNIX file permissions", "test input", "test_output");
         // testOp(browser, "Parse URI", "test input", "test_output");
-    // testOp(browser, "Parse User Agent", "test input", "test_output");
+        testOp(browser, "Parse User Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0 ", /Architecture: amd64/);
         // testOp(browser, "Parse X.509 certificate", "test input", "test_output");
         testOpFile(browser, "Play Media", "files/mp3example.mp3", "audio", "");
         // testOp(browser, "Power Set", "test input", "test_output");
-    // testOp(browser, "Protobuf Decode", "test input", "test_output");
+        testOp(browser, ["From Hex", "Protobuf Decode"], "0d1c0000001203596f751a024d65202b2a0a0a066162633132331200", /"1": "abc123"/, [[], ["", false, false]]);
         // testOp(browser, "Pseudo-Random Number Generator", "test input", "test_output");
     // testOp(browser, "RC2 Decrypt", "test input", "test_output");
     // testOp(browser, "RC2 Encrypt", "test input", "test_output");
@@ -354,6 +354,7 @@ module.exports = {
         // testOp(browser, "Tail", "test input", "test_output");
         // testOp(browser, "Take bytes", "test input", "test_output");
         testOp(browser, "Tar", "test input", /^file\.txt\x00{92}/);
+        testOp(browser, "Template", "{\"one\": 1, \"two\": 2}", "1 2", ["{{ one }} {{ two }}"]);
         testOpHtml(browser, "Text Encoding Brute Force", "test input", "tr:nth-of-type(4) td:last-child", /t\u2400e\u2400s\u2400t\u2400/);
         // testOp(browser, "To BCD", "test input", "test_output");
         // testOp(browser, "To Base", "test input", "test_output");
@@ -491,7 +492,22 @@ function testOpImage(browser, opName, filename, args=[]) {
 
     browser
         .waitForElementVisible("#output-html img")
-        .expect.element("#output-html img").to.have.css("width").which.matches(/^[^0]\d*px/);
+        .expect.element("#output-html img").to.have.css("width").which.matches(/^(?!0+(?:\.0+)?px$)\d+(?:\.\d+)?px$/);
+
+    browser.execute(function() {
+        const output = document.getElementById("output-html");
+        const img = output.querySelector("img");
+        const outputRect = output.getBoundingClientRect();
+        const imgRect = img.getBoundingClientRect();
+
+        return {
+            imageFitsWidth: imgRect.width <= outputRect.width,
+            imageFitsHeight: imgRect.height <= outputRect.height,
+        };
+    }, [], function({value}) {
+        browser.expect(value.imageFitsWidth).to.be.equal(true);
+        browser.expect(value.imageFitsHeight).to.be.equal(true);
+    });
 }
 
 /** @function

tests/browser/03_recipe_load.js

@@ -0,0 +1,48 @@
+/**
+ * Regression tests for recipe loading behaviour.
+ *
+ * @author C85297 [95289555+C85297@users.noreply.github.com]
+ * @copyright Crown Copyright
+ * @license Apache-2.0
+ */
+
+const utils = require("./browserUtils.js");
+
+module.exports = {
+    before: browser => {
+        browser
+            .resizeWindow(1280, 800)
+            .url(browser.launchUrl)
+            .useCss()
+            .waitForElementNotPresent("#preloader", 10000);
+    },
+
+    "Recipe load preserves populated arguments": browser => {
+        const inputFormat = "HH:mm:ss a MMM DD, YYYY ";
+        const input = "10:20:30 pm Sep 26, 2019 ";
+
+        utils.loadRecipe(
+            browser,
+            "Translate DateTime Format",
+            input,
+            [
+                "Standard date and time",
+                inputFormat,
+                "UTC",
+                "DD/MM/YYYY HH:mm:ss",
+                "UTC"
+            ]
+        );
+
+        browser.execute(() => {
+            return Array.from(document.querySelectorAll("#rec-list li.operation .arg"))
+                .map(arg => arg.value);
+        }, [], function({value}) {
+            browser.expect(value[1]).to.equal(inputFormat);
+        });
+    },
+
+    after: browser => {
+        browser.end();
+    }
+};

tests/browser/browserUtils.js

@@ -51,14 +51,17 @@ function setInput(browser, input, type=true) {
  */
 function bake(browser) {
     browser
+        // Let any pending debounced inputChange/stateChange (~20ms each) fire so the
+        // worker has the latest input buffer before we ask it to bake.
+        .pause(50)
         // Ensure we're not currently busy
-        .waitForElementNotVisible("#output-loader", 5000)
+        .waitForElementNotVisible("#output-loader", 10000)
         .expect.element("#bake span").text.to.equal("BAKE!");
 
     browser
         .click("#bake")
-        .waitForElementNotVisible("#stale-indicator", 5000)
+        .waitForElementNotVisible("#stale-indicator", 10000)
-        .waitForElementNotVisible("#output-loader", 5000);
+        .waitForElementNotVisible("#output-loader", 10000);
 }
 
 /** @function

tests/lib/wasmFetchPolyfill.mjs

@@ -0,0 +1,31 @@
+/**
+ * Polyfill for Node.js 22+ where globalThis.fetch is built-in but rejects
+ * bare filesystem paths. WASM libraries like argon2-browser call fetch() with
+ * an absolute path (e.g. "/path/to/argon2.wasm") expecting a browser-style
+ * fallback, but Node.js 22's fetch throws synchronously for non-URL strings.
+ *
+ * This wrapper intercepts such calls and serves the file via Node's fs module,
+ * returning a synthetic Response so the WASM module loads correctly.
+ */
+
+import { readFile } from "fs/promises";
+
+if (globalThis.fetch) {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = async function patchedFetch(url, options) {
+        const urlStr = typeof url === "string" ?
+            url :
+            url instanceof URL ?
+                url.href :
+                String(url);
+        // Intercept bare filesystem paths (absolute POSIX or Windows)
+        if (urlStr.startsWith("/") || /^[A-Za-z]:[/\\]/.test(urlStr)) {
+            const buffer = await readFile(urlStr);
+            return new Response(buffer, {
+                status: 200,
+                headers: { "Content-Type": "application/wasm" },
+            });
+        }
+        return originalFetch(url, options);
+    };
+}

tests/node/consumers/cjs-consumer.js

@@ -8,9 +8,9 @@
 
 const assert = require("assert");
 
-require("cyberchef").then(chef => {
+require("cyberchef").then(async chef => {
 
-    const d = chef.bake("Testing, 1 2 3", [
+    const d = await chef.bake("Testing, 1 2 3", [
         chef.toHex,
         chef.reverse,
         {

tests/node/consumers/esm-consumer.mjs

@@ -9,7 +9,7 @@ import assert from "assert";
 import chef from "cyberchef";
 import { bake, toHex, reverse, unique, multiply } from "cyberchef";
 
-const a = bake("Testing, 1 2 3", [
+const a = await bake("Testing, 1 2 3", [
     toHex,
     reverse,
     {
@@ -28,7 +28,7 @@ const a = bake("Testing, 1 2 3", [
 
 assert.equal(a.value, "630957449041920");
 
-const b = chef.bake("Testing, 1 2 3", [
+const b = await chef.bake("Testing, 1 2 3", [
     chef.toHex,
     chef.reverse,
     {

tests/node/index.mjs

@@ -18,12 +18,14 @@ import {
 import TestRegister from "../lib/TestRegister.mjs";
 import "./tests/nodeApi.mjs";
 import "./tests/operations.mjs";
+import "./tests/PGP.mjs";
 import "./tests/File.mjs";
 import "./tests/Dish.mjs";
 import "./tests/NodeDish.mjs";
 import "./tests/Utils.mjs";
 import "./tests/Categories.mjs";
 import "./tests/lib/BigIntUtils.mjs";
+import "./tests/lib/ChartsProtocolPrototypePollution.mjs";
 
 const testStatus = {
     allTestsPassing: true,

tests/node/tests/Categories.mjs

@@ -1,6 +1,6 @@
 import TestRegister from "../../lib/TestRegister.mjs";
-import Categories from "../../../src/core/config/Categories.json" assert {type: "json"};
+import Categories from "../../../src/core/config/Categories.json" with { type: "json" };
-import OperationConfig from "../../../src/core/config/OperationConfig.json" assert {type: "json"};
+import OperationConfig from "../../../src/core/config/OperationConfig.json" with { type: "json" };
 import it from "../assertionHandler.mjs";
 import assert from "assert";
 

tests/node/tests/PGP.mjs

@@ -0,0 +1,69 @@
+/**
+ * PGP node tests.
+ *
+ * @author C85297 [95289555+C85297@users.noreply.github.com]
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import assert from "assert";
+import kbpgp from "kbpgp";
+import * as es6promisify from "es6-promisify";
+
+import TestRegister from "../../lib/TestRegister.mjs";
+import it from "../assertionHandler.mjs";
+import GeneratePGPKeyPair from "../../../src/core/operations/GeneratePGPKeyPair.mjs";
+
+const promisify = es6promisify.default ? es6promisify.default.promisify : es6promisify.promisify;
+
+const PUBLIC_KEY_BLOCK = /-----BEGIN PGP PUBLIC KEY BLOCK-----[\s\S]*-----END PGP PUBLIC KEY BLOCK-----/;
+
+/**
+ * Generate a PGP key pair and import the generated public key.
+ *
+ * @param {string} keyType
+ * @returns {Promise<Object>}
+ */
+async function generateAndImportPublicKey(keyType) {
+    const operation = new GeneratePGPKeyPair();
+    const generatedKeyPair = await operation.run("", [
+        keyType,
+        "",
+        "User",
+        "akb@notreal.gchq.gov.uk"
+    ]);
+
+    const publicKey = generatedKeyPair.match(PUBLIC_KEY_BLOCK);
+
+    assert(publicKey, "Generated key pair should contain an ASCII-armoured public key");
+
+    return promisify(kbpgp.KeyManager.import_from_armored_pgp)({
+        armored: publicKey[0],
+        opts: {
+            "no_check_keys": true
+        }
+    });
+}
+
+TestRegister.addApiTests([
+    it("Generate PGP Key Pair: ECC keys should include ECDSA signing and ECDH encryption subkeys", async () => {
+        const publicKey = await generateAndImportPublicKey("ECC-256");
+        const subkeyAlgorithms = publicKey.subkeys.map(subkey => subkey.key.type);
+
+        assert.strictEqual(
+            publicKey.primary.key.type,
+            kbpgp.const.openpgp.public_key_algorithms.ECDSA,
+            "Generated ECC PGP primary key should use ECDSA"
+        );
+
+        assert(
+            subkeyAlgorithms.includes(kbpgp.const.openpgp.public_key_algorithms.ECDSA),
+            "Generated ECC PGP key should include an ECDSA signing subkey"
+        );
+
+        assert(
+            subkeyAlgorithms.includes(kbpgp.const.openpgp.public_key_algorithms.ECDH),
+            "Generated ECC PGP key should include an ECDH encryption subkey"
+        );
+    })
+]);

tests/node/tests/lib/ChartsProtocolPrototypePollution.mjs

@@ -0,0 +1,90 @@
+import TestRegister from "../../../lib/TestRegister.mjs";
+import {getSeriesValues} from "../../../../src/core/lib/Charts.mjs";
+import {objToTable} from "../../../../src/core/lib/Protocol.mjs";
+import SeriesChart from "../../../../src/core/operations/SeriesChart.mjs";
+import ParseUDP from "../../../../src/core/operations/ParseUDP.mjs";
+import it from "../../assertionHandler.mjs";
+import assert from "assert";
+
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
+TestRegister.addApiTests([
+    it("Charts: should not pollute Object.prototype from a __proto__ series name", () => {
+        const xVal = "<img src=x onerror=alert(1)>";
+        delete Object.prototype[xVal];
+
+        try {
+            const result = getSeriesValues(`__proto__,${xVal},1`, "\n", ",", false);
+
+            assert.equal(Object.prototype[xVal], undefined);
+            assert.deepEqual(result.xValues, [xVal]);
+            assert.equal(result.series.length, 1);
+            assert.equal(result.series[0].name, "__proto__");
+            assert.equal(Object.getPrototypeOf(result.series[0].data), null);
+            assert(hasOwn(result.series[0].data, xVal));
+            assert.equal(result.series[0].data[xVal], 1);
+        } finally {
+            delete Object.prototype[xVal];
+        }
+    }),
+
+    it("Charts: should keep __proto__ x-axis names as own data keys", () => {
+        const result = getSeriesValues("safe,__proto__,1", "\n", ",", false);
+
+        assert.equal(result.series.length, 1);
+        assert.equal(Object.getPrototypeOf(result.series[0].data), null);
+        assert(hasOwn(result.series[0].data, "__proto__"));
+        assert.equal(result.series[0].data.__proto__, 1);
+    }),
+
+    it("Protocol: should ignore inherited properties when rendering tables", () => {
+        const inheritedKey = "<img src=x onerror=alert(1)>";
+        delete Object.prototype[inheritedKey];
+
+        try {
+            Object.prototype[inheritedKey] = "polluted";
+
+            const html = objToTable({safe: "value"});
+
+            assert(!html.includes(inheritedKey));
+            assert(!html.includes("polluted"));
+            assert(html.includes("safe"));
+            assert(html.includes("value"));
+        } finally {
+            delete Object.prototype[inheritedKey];
+        }
+    }),
+
+    it("Protocol: should escape table keys and scalar values", () => {
+        const obj = {
+            "<b>field</b>": "<img src=x onerror=alert(1)>",
+        };
+
+        const html = objToTable(obj);
+
+        assert(!html.includes("<b>field</b>"));
+        assert(!html.includes("<img src=x onerror=alert(1)>"));
+        assert(html.includes("&lt;b&gt;field&lt;/b&gt;"));
+        assert(html.includes("&lt;img src=x onerror=alert(1)&gt;"));
+    }),
+
+    it("Series chart and Parse UDP: should not expose polluted prototype data as HTML", () => {
+        const xVal = "<img src=x onerror=alert(document.domain)>";
+        delete Object.prototype[xVal];
+
+        try {
+            const chartHtml = new SeriesChart().run(
+                `__proto__,${xVal},1`,
+                ["Line feed", "Comma", "", 1, "red"]
+            );
+            assert.equal(Object.prototype[xVal], undefined);
+
+            const parseUDP = new ParseUDP();
+            const tableHtml = parseUDP.present(parseUDP.run(chartHtml, ["Raw"]));
+
+            assert(!/<img|onerror|alert\(/.test(tableHtml));
+        } finally {
+            delete Object.prototype[xVal];
+        }
+    }),
+]);

tests/node/tests/nodeApi.mjs

@@ -136,7 +136,7 @@ TestRegister.addApiTests([
 
     it("chef.help: returns multiple results", () => {
         const result = chef.help("base 64");
-        assert.strictEqual(result.length, 13);
+        assert.strictEqual(result.length, 14);
     }),
 
     it("chef.help: looks in description for matches too", () => {
@@ -170,77 +170,77 @@ TestRegister.addApiTests([
         assert(chef.bake);
     }),
 
-    it("chef.bake: should return NodeDish", () => {
+    it("chef.bake: should return NodeDish", async () => {
-        const result = chef.bake("input", "to base 64");
+        const result = await chef.bake("input", "to base 64");
         assert(result instanceof NodeDish);
     }),
 
-    it("chef.bake: should take an input and an op name and perform it", () => {
+    it("chef.bake: should take an input and an op name and perform it", async () => {
-        const result = chef.bake("some input", "to base 32");
+        const result = await chef.bake("some input", "to base 32");
         assert.strictEqual(result.toString(), "ONXW2ZJANFXHA5LU");
     }),
 
-    it("chef.bake: should complain if recipe isnt a valid object", () => {
+    it("chef.bake: should complain if recipe isnt a valid object", async () => {
-        assert.throws(() => chef.bake("some input", 3264), {
+        await assert.rejects(() => chef.bake("some input", 3264), {
             name: "TypeError",
             message: "Recipe can only contain function names or functions"
         });
     }),
 
-    it("chef.bake: Should complain if string op is invalid", () => {
+    it("chef.bake: Should complain if string op is invalid", async () => {
-        assert.throws(() => chef.bake("some input", "not a valid operation"), {
+        await assert.rejects(() => chef.bake("some input", "not a valid operation"), {
             name: "TypeError",
             message: "Couldn't find an operation with name 'not a valid operation'."
         });
     }),
 
-    it("chef.bake: Should take an input and an operation and perform it", () => {
+    it("chef.bake: Should take an input and an operation and perform it", async () => {
-        const result = chef.bake("https://google.com/search?q=help", chef.parseURI);
+        const result = await chef.bake("https://google.com/search?q=help", chef.parseURI);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = help\n");
     }),
 
-    it("chef.bake: Should complain if an invalid operation is inputted", () => {
+    it("chef.bake: Should complain if an invalid operation is inputted", async () => {
-        assert.throws(() => chef.bake("https://google.com/search?q=help", () => {}), {
+        await assert.rejects(() => chef.bake("https://google.com/search?q=help", () => {}), {
             name: "TypeError",
             message: "Inputted function not a Chef operation."
         });
     }),
 
-    it("chef.bake: accepts an array of operation names and performs them all in order", () => {
+    it("chef.bake: accepts an array of operation names and performs them all in order", async () => {
-        const result = chef.bake("https://google.com/search?q=that's a complicated question", ["URL encode", "URL decode", "Parse URI"]);
+        const result = await chef.bake("https://google.com/search?q=that's a complicated question", ["URL encode", "URL decode", "Parse URI"]);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = that's a complicated question\n");
     }),
 
-    it("chef.bake: forgiving with operation names", () =>{
+    it("chef.bake: forgiving with operation names", async () =>{
-        const result = chef.bake("https://google.com/search?q=that's a complicated question", ["urlencode", "url decode", "parseURI"]);
+        const result = await chef.bake("https://google.com/search?q=that's a complicated question", ["urlencode", "url decode", "parseURI"]);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = that's a complicated question\n");
     }),
 
-    it("chef.bake: forgiving with operation names", () =>{
+    it("chef.bake: forgiving with operation names", async () =>{
-        const result = chef.bake("hello", ["to base 64"]);
+        const result = await chef.bake("hello", ["to base 64"]);
         assert.strictEqual(result.toString(), "aGVsbG8=");
     }),
 
-    it("chef.bake: if recipe is empty array, return input as dish", () => {
+    it("chef.bake: if recipe is empty array, return input as dish", async () => {
-        const result = chef.bake("some input", []);
+        const result = await chef.bake("some input", []);
         assert.strictEqual(result.toString(), "some input");
         assert(result instanceof NodeDish, "Result is not instance of NodeDish");
     }),
 
-    it("chef.bake: accepts an array of operations as recipe", () => {
+    it("chef.bake: accepts an array of operations as recipe", async () => {
-        const result = chef.bake("https://google.com/search?q=that's a complicated question", [chef.URLEncode, chef.URLDecode, chef.parseURI]);
+        const result = await chef.bake("https://google.com/search?q=that's a complicated question", [chef.URLEncode, chef.URLDecode, chef.parseURI]);
         assert.strictEqual(result.toString(), "Protocol:\thttps:\nHostname:\tgoogle.com\nPath name:\t/search\nArguments:\n\tq = that's a complicated question\n");
     }),
 
-    it("should complain if an invalid operation is inputted as part of array", () => {
+    it("should complain if an invalid operation is inputted as part of array", async () => {
-        assert.throws(() => chef.bake("something", [() => {}]), {
+        await assert.rejects(() => chef.bake("something", [() => {}]), {
             name: "TypeError",
             message: "Inputted function not a Chef operation."
         });
     }),
 
-    it("chef.bake: should take single JSON object describing op and args OBJ", () => {
+    it("chef.bake: should take single JSON object describing op and args OBJ", async () => {
-        const result = chef.bake("some input", {
+        const result = await chef.bake("some input", {
             op: chef.toHex,
             args: {
                 Delimiter: "Colon"
@@ -249,23 +249,23 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "73:6f:6d:65:20:69:6e:70:75:74");
     }),
 
-    it("chef.bake: should take single JSON object desribing op with optional args", () => {
+    it("chef.bake: should take single JSON object desribing op with optional args", async () => {
-        const result = chef.bake("some input", {
+        const result = await chef.bake("some input", {
             op: chef.toHex,
         });
         assert.strictEqual(result.toString(), "73 6f 6d 65 20 69 6e 70 75 74");
     }),
 
-    it("chef.bake: should take single JSON object describing op and args ARRAY", () => {
+    it("chef.bake: should take single JSON object describing op and args ARRAY", async () => {
-        const result = chef.bake("some input", {
+        const result = await chef.bake("some input", {
             op: chef.toHex,
             args: ["Colon"]
         });
         assert.strictEqual(result.toString(), "73:6f:6d:65:20:69:6e:70:75:74");
     }),
 
-    it("chef.bake: should error if op in JSON is not chef op", () => {
+    it("chef.bake: should error if op in JSON is not chef op", async () => {
-        assert.throws(() => chef.bake("some input", {
+        await assert.rejects(() => chef.bake("some input", {
             op: () => {},
             args: ["Colon"],
         }), {
@@ -274,8 +274,8 @@ TestRegister.addApiTests([
         });
     }),
 
-    it("chef.bake: should take multiple ops in JSON object form, some ops by string", () => {
+    it("chef.bake: should take multiple ops in JSON object form, some ops by string", async () => {
-        const result = chef.bake("some input", [
+        const result = await chef.bake("some input", [
             {
                 op: chef.toHex,
                 args: ["Colon"]
@@ -290,8 +290,8 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "67;63;72;66;146;72;66;144;72;66;65;72;62;60;72;66;71;72;66;145;72;67;60;72;67;65;72;67;64");
     }),
 
-    it("chef.bake: should take multiple ops in JSON object form, some without args", () => {
+    it("chef.bake: should take multiple ops in JSON object form, some without args", async () => {
-        const result = chef.bake("some input", [
+        const result = await chef.bake("some input", [
             {
                 op: chef.toHex,
             },
@@ -305,8 +305,8 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "67;63;40;66;146;40;66;144;40;66;65;40;62;60;40;66;71;40;66;145;40;67;60;40;67;65;40;67;64");
     }),
 
-    it("chef.bake: should handle op with multiple args", () => {
+    it("chef.bake: should handle op with multiple args", async () => {
-        const result = chef.bake("some input", {
+        const result = await chef.bake("some input", {
             op: "to morse code",
             args: {
                 formatOptions: "Dash/Dot",
@@ -317,13 +317,13 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "DotDotDot\\DashDashDash\\DashDash\\Dot,DotDot\\DashDot\\DotDashDashDot\\DotDotDash\\Dash");
     }),
 
-    it("chef.bake: should take compact JSON format from Chef Website as recipe", () => {
+    it("chef.bake: should take compact JSON format from Chef Website as recipe", async () => {
-        const result = chef.bake("some input", [{"op": "To Morse Code", "args": ["Dash/Dot", "Backslash", "Comma"]}, {"op": "Hex to PEM", "args": ["SOMETHING"]}, {"op": "To Snake case", "args": [false]}]);
+        const result = await chef.bake("some input", [{"op": "To Morse Code", "args": ["Dash/Dot", "Backslash", "Comma"]}, {"op": "Hex to PEM", "args": ["SOMETHING"]}, {"op": "To Snake case", "args": [false]}]);
         assert.strictEqual(result.toString(), "begin_something_anananaaaaak_da_aaak_da_aaaaananaaaaaaan_da_aaaaaaanan_da_aaak_end_something");
     }),
 
-    it("chef.bake: should accept Clean JSON format from Chef website as recipe", () => {
+    it("chef.bake: should accept Clean JSON format from Chef website as recipe", async () => {
-        const result = chef.bake("some input", [
+        const result = await chef.bake("some input", [
             { "op": "To Morse Code",
                 "args": ["Dash/Dot", "Backslash", "Comma"] },
             { "op": "Hex to PEM",
@@ -334,8 +334,8 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "begin_something_anananaaaaak_da_aaak_da_aaaaananaaaaaaan_da_aaaaaaanan_da_aaak_end_something");
     }),
 
-    it("chef.bake: should accept Clean JSON format from Chef website - args optional", () => {
+    it("chef.bake: should accept Clean JSON format from Chef website - args optional", async () => {
-        const result = chef.bake("some input", [
+        const result = await chef.bake("some input", [
             { "op": "To Morse Code" },
             { "op": "Hex to PEM",
                 "args": ["SOMETHING"] },
@@ -345,31 +345,28 @@ TestRegister.addApiTests([
         assert.strictEqual(result.toString(), "begin_something_aaaaaaaaaaaaaa_end_something");
     }),
 
-    it("chef.bake: should accept operation names from Chef Website which contain forward slash", () => {
+    it("chef.bake: should accept operation names from Chef Website which contain forward slash", async () => {
-        const result = chef.bake("I'll have the test salmon", [
+        const result = await chef.bake("I'll have the test salmon", [
             { "op": "Find / Replace",
                 "args": [{ "option": "Regex", "string": "test" }, "good", true, false, true, false]}
         ]);
         assert.strictEqual(result.toString(), "I'll have the good salmon");
     }),
 
-    it("chef.bake: should accept operation names from Chef Website which contain a hyphen", () => {
+    it("chef.bake: should accept operation names from Chef Website which contain a hyphen", async () => {
-        const result = chef.bake("I'll have the test salmon", [
+        const result = await chef.bake("I'll have the test salmon", [
             { "op": "Adler-32 Checksum",
                 "args": [] }
         ]);
         assert.strictEqual(result.toString(), "6e4208f8");
     }),
 
-    it("chef.bake: should accept operation names from Chef Website which contain a period", () => {
+    it("chef.bake: should accept operation names from Chef Website which contain a period", async () => {
-        const result = chef.bake("30 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 65 3f", [
+        const result = await chef.bake("30 13 02 01 05 16 0e 41 6e 79 62 6f 64 79 20 74 68 65 72 65 3f", [
             { "op": "Parse ASN.1 hex string",
                 "args": [0, 32] }
         ]);
-        assert.strictEqual(result.toString(), `SEQUENCE
+        assert.strictEqual(result.toString(), `SEQUENCE\n  INTEGER 05\n  IA5String 'Anybody there?'\n`);
-  INTEGER 05
-  IA5String 'Anybody there?'
-`);
     }),
 
     it("Excluded operations: throw a sensible error when you try and call one", () => {
@@ -381,16 +378,16 @@ TestRegister.addApiTests([
         }
     }),
 
-    it("chef.bake: cannot accept flowControl operations in recipe", () => {
+    it("chef.bake: cannot accept flowControl operations in recipe", async () => {
-        assert.throws(() => chef.bake("some input", "magic"), {
+        await assert.rejects(() => chef.bake("some input", "magic"), {
             name: "TypeError",
             message: "flowControl operations like Magic are not currently allowed in recipes for chef.bake in the Node API"
         });
-        assert.throws(() => chef.bake("some input", magic), {
+        await assert.rejects(() => chef.bake("some input", magic), {
             name: "TypeError",
             message: "flowControl operations like Magic are not currently allowed in recipes for chef.bake in the Node API"
         });
-        assert.throws(() => chef.bake("some input", ["to base 64", "magic"]), {
+        await assert.rejects(() => chef.bake("some input", ["to base 64", "magic"]), {
             name: "TypeError",
             message: "flowControl operations like Magic are not currently allowed in recipes for chef.bake in the Node API"
         });