Merge branch 'master' into patch-1

.github/workflows/master.yml

@@ -16,7 +16,7 @@ jobs:
       pages: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/pull_requests.yml

@@ -12,7 +12,7 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -64,7 +64,7 @@ jobs:
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Production Image Build
         if: success()

.github/workflows/releases.yml

@@ -22,7 +22,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -64,7 +64,7 @@ jobs:
         uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Image Metadata
         id: image-metadata
@@ -110,7 +110,7 @@ jobs:
     needs: main
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set node version
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

CHANGELOG.md

@@ -13,6 +13,75 @@ All major and minor version changes will be documented in this file. Details of
 
 ## Details
 
+### [11.1.0] - 2026-06-13
+This release includes a security fix ([#2557])
+- Security: Add fix, and tests, for Lorem Ipsum DoS issue [@GCHQDeveloper581] | [#2557]
+- chore (deps): bump the patch-updates group with 4 updates  | [#2552]
+- chore (deps): bump the actions-dependencies group with 2 updates  | [#2551]
+- chore (deps): bump the docker-dependencies group with 2 updates  | [#2550]
+- chore (deps): bump protobufjs from 8.5.0 to 8.6.2 in the minor-updates group  | [#2553]
+- Security Policy Update [@C85297] | [#2547]
+- Fix spurious error messages generated during webpack build [@GCHQDeveloper581] | [#2545]
+- chore (deps): bump shell-quote from 1.8.3 to 1.8.4  | [#2543]
+- Implementing ROR13 feature [@Fufu-btw] | [#2539]
+- New operation improvements [@jl5193] [@GCHQDeveloper581] | [#1431]
+- Npm and yarn/major version updates [@GCHQDeveloper581] | [#2527]
+- Update README to reflect AES Decrypt changes [@andreasrtv] | [#2502]
+- feat: add Escape Smart Characters operation [@HarelKatz] | [#2391]
+- feat: Get AES IV from input (QoL) [@andreasrtv] | [#2471]
+- fix: validate text encoding options [@SyedIshmumAhnaf] | [#2497]
+- chore (deps): bump the minor-updates group with 5 updates [@GCHQDeveloper581] | [#2500]
+- chore (deps): bump the patch-updates group with 2 updates  | [#2499]
+- chore (deps): bump nginxinc/nginx-unprivileged from `df0e9ed` to `0a1e718` in the docker-dependencies group  | [#2498]
+- Add remove ANSI escape codes operation [@Louis-Ladd] [@GCHQDeveloper581] | [#2143]
+- Fix option ingredients being overwriten [@C85297] | [#2341]
+- chore (deps): bump qs and express  | [#2478]
+- chore (deps): bump tmp from 0.2.5 to 0.2.7  | [#2479]
+- chore (deps): bump the patch-updates group across 1 directory with 6 updates  | [#2463]
+- chore (deps): bump the docker-dependencies group across 1 directory with 2 updates  | [#2468]
+- chore (deps): bump terser from 5.46.2 to 5.48.0  | [#2385]
+- Make dependabot quieter [@GCHQDeveloper581] | [#2467]
+- update sitemap [@Blank0120] | [#2443]
+- Bump webpack-dev-server to 5.2.4 [@GCHQDeveloper581] | [#2417]
+- Fix pgp tests [@GCHQDeveloper581] [@C85297] | [#2461]
+- chore (deps): bump the patch-updates group across 1 directory with 4 updates  | [#2438]
+- chore (deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0  | [#2439]
+- chore (deps): bump docker/login-action from 4.1.0 to 4.2.0  | [#2441]
+- chore (deps): bump docker/metadata-action from 6.0.0 to 6.1.0  | [#2442]
+- update bson [@Blank0120] [@GCHQDeveloper581] | [#2425]
+- chore (deps): bump webpack from 5.106.2 to 5.107.1  | [#2428]
+- chore (deps): bump protobufjs from 7.5.8 to 7.6.0  | [#2429]
+- chore (deps): bump sql-formatter from 15.7.4 to 15.8.0  | [#2430]
+- chore (deps): bump docker/build-push-action from 7.1.0 to 7.2.0  | [#2431]
+- Fix flaky `npm run testui` [@lzandman] | [#2412]
+- Include git ref in website download zip name [@C85297] | [#2339]
+- Bump nginxinc/nginx-unprivileged from `808f784` to `b9f7ba1`  | [#2389]
+- Series Chart HTML Formatting fix [@C85297] | [#2403]
+- Parse Ethernet Frame HTML formatting fix [@C85297] | [#2402]
+- Parse IPv4 Header HTML formatting fix [@C85297] | [#2401]
+- Update chromedriver, and install corresponding chrome in workflows (fixes build) [@GCHQDeveloper581] | [#2387]
+- chore (deps): bump @codemirror/view from 6.41.1 to 6.43.0  | [#2384]
+- chore (deps): bump globals from 17.5.0 to 17.6.0  | [#2386]
+- chore (deps): bump the patch-updates group across 1 directory with 3 updates  | [#2388]
+- [StepSecurity] Apply security best practices [@GCHQDeveloper581] StepSecurity Bot <bot@stepsecurity.io> | [#2378]
+- Build docker container for arm v7 as well [@GCHQDeveloper581] | [#2379]
+- chore (deps): bump fast-uri from 3.1.0 to 3.1.2  | [#2372]
+- update bcryptjs [@C85297] [@GCHQDeveloper581] | [#2368]
+- chore (deps): bump picomatch from 2.3.1 to 2.3.2  | [#2370]
+- chore (deps): bump ip-address from 10.1.0 to 10.2.0  | [#2371]
+- chore (deps): bump axios from 1.15.0 to 1.16.0  | [#2369]
+- feat(operation-wrap): add new Wrap operation to format text at specified line width [@0xff1ce] | [#1882]
+- chore (deps): bump the patch-updates group across 1 directory with 5 updates  | [#2354]
+- chore (deps): bump docker/login-action from 3 to 4  | [#2363]
+- chore (deps): bump docker/setup-buildx-action from 3 to 4  | [#2364]
+- chore (deps): bump crazy-max/ghaction-github-pages from 3 to 5  | [#2365]
+- chore (deps): bump docker/metadata-action from 4 to 6  | [#2366]
+- chore (deps): bump docker/setup-qemu-action from 3 to 4  | [#2367]
+- Update dependabot for Node 24. [@GCHQDeveloper581] | [#2361]
+- chore (deps): bump uuid from 13.0.0 to 14.0.0  | [#2332]
+- chore (deps): bump webpack-bundle-analyzer from 5.2.0 to 5.3.0  | [#2353]
+- Fix all zeros after 16384 bytes with Blake3 [@zachbowden] [@GCHQDeveloper581] | [#2351]
+
 ## [11.0.0] - 2026-04-28
 - Revert sitemap to v8.0.X to fix build/deploy on master [@GCHQDeveloper581] | [#2348]
 - Node version update from 22 to 24 [@lzandman] [@GCHQDeveloper581] | [#2347]
@@ -638,6 +707,7 @@ Breaking changes:
 ## [4.0.0] - 2016-11-28
 -  Initial open source commit [@n1474335] | [b1d73a72](https://github.com/gchq/CyberChef/commit/b1d73a725dc7ab9fb7eb789296efd2b7e4b08306)
 
+[11.1.0]: https://github.com/gchq/CyberChef/releases/tag/v11.1.0
 [11.0.0]: https://github.com/gchq/CyberChef/releases/tag/v11.0.0
 [10.24.0]: https://github.com/gchq/CyberChef/releases/tag/v10.24.0
 [10.23.0]: https://github.com/gchq/CyberChef/releases/tag/v10.23.0
@@ -655,7 +725,7 @@ Breaking changes:
 [10.11.0]: https://github.com/gchq/CyberChef/releases/tag/v10.11.0
 [10.10.0]: https://github.com/gchq/CyberChef/releases/tag/v10.10.0
 [10.9.0]: https://github.com/gchq/CyberChef/releases/tag/v10.9.0
-[10.8.0]: https://github.com/gchq/CyberChef/releases/tag/v10.7.0
+[10.8.0]: https://github.com/gchq/CyberChef/releases/tag/v10.8.0
 [10.7.0]: https://github.com/gchq/CyberChef/releases/tag/v10.7.0
 [10.6.0]: https://github.com/gchq/CyberChef/releases/tag/v10.6.0
 [10.5.0]: https://github.com/gchq/CyberChef/releases/tag/v10.5.0
@@ -923,6 +993,14 @@ Breaking changes:
 [@hsolberg]: https://github.com/hsolberg
 [@lzandman]: https://github.com/lzandman
 [@engin0223]: https://github.com/engin0223
+[@Fufu-btw]: https://github.com/Fufu-btw
+[@jl5193]: https://github.com/jl5193
+[@andreasrtv]: https://github.com/andreasrtv
+[@HarelKatz]: https://github.com/HarelKatz
+[@SyedIshmumAhnaf]: https://github.com/SyedIshmumAhnaf
+[@Louis-Ladd]: https://github.com/Louis-Ladd
+[@Blank0120]: https://github.com/Blank0120
+[@zachbowden]: https://github.com/zachbowden
 
 
 [8ad18b]: https://github.com/gchq/CyberChef/commit/8ad18bc7db6d9ff184ba3518686293a7685bf7b7
@@ -1220,4 +1298,70 @@ Breaking changes:
 [#2273]: https://github.com/gchq/CyberChef/pull/2273
 [#2342]: https://github.com/gchq/CyberChef/pull/2342
 [#1922]: https://github.com/gchq/CyberChef/pull/1922
+[#2557]: https://github.com/gchq/CyberChef/pull/2557
+[#2552]: https://github.com/gchq/CyberChef/pull/2552
+[#2551]: https://github.com/gchq/CyberChef/pull/2551
+[#2550]: https://github.com/gchq/CyberChef/pull/2550
+[#2553]: https://github.com/gchq/CyberChef/pull/2553
+[#2547]: https://github.com/gchq/CyberChef/pull/2547
+[#2545]: https://github.com/gchq/CyberChef/pull/2545
+[#2543]: https://github.com/gchq/CyberChef/pull/2543
+[#2539]: https://github.com/gchq/CyberChef/pull/2539
+[#1431]: https://github.com/gchq/CyberChef/pull/1431
+[#2527]: https://github.com/gchq/CyberChef/pull/2527
+[#2502]: https://github.com/gchq/CyberChef/pull/2502
+[#2391]: https://github.com/gchq/CyberChef/pull/2391
+[#2471]: https://github.com/gchq/CyberChef/pull/2471
+[#2497]: https://github.com/gchq/CyberChef/pull/2497
+[#2500]: https://github.com/gchq/CyberChef/pull/2500
+[#2499]: https://github.com/gchq/CyberChef/pull/2499
+[#2498]: https://github.com/gchq/CyberChef/pull/2498
+[#2143]: https://github.com/gchq/CyberChef/pull/2143
+[#2341]: https://github.com/gchq/CyberChef/pull/2341
+[#2478]: https://github.com/gchq/CyberChef/pull/2478
+[#2479]: https://github.com/gchq/CyberChef/pull/2479
+[#2463]: https://github.com/gchq/CyberChef/pull/2463
+[#2468]: https://github.com/gchq/CyberChef/pull/2468
+[#2385]: https://github.com/gchq/CyberChef/pull/2385
+[#2467]: https://github.com/gchq/CyberChef/pull/2467
+[#2443]: https://github.com/gchq/CyberChef/pull/2443
+[#2417]: https://github.com/gchq/CyberChef/pull/2417
+[#2461]: https://github.com/gchq/CyberChef/pull/2461
+[#2438]: https://github.com/gchq/CyberChef/pull/2438
+[#2439]: https://github.com/gchq/CyberChef/pull/2439
+[#2441]: https://github.com/gchq/CyberChef/pull/2441
+[#2442]: https://github.com/gchq/CyberChef/pull/2442
+[#2425]: https://github.com/gchq/CyberChef/pull/2425
+[#2428]: https://github.com/gchq/CyberChef/pull/2428
+[#2429]: https://github.com/gchq/CyberChef/pull/2429
+[#2430]: https://github.com/gchq/CyberChef/pull/2430
+[#2431]: https://github.com/gchq/CyberChef/pull/2431
+[#2412]: https://github.com/gchq/CyberChef/pull/2412
+[#2339]: https://github.com/gchq/CyberChef/pull/2339
+[#2389]: https://github.com/gchq/CyberChef/pull/2389
+[#2403]: https://github.com/gchq/CyberChef/pull/2403
+[#2402]: https://github.com/gchq/CyberChef/pull/2402
+[#2401]: https://github.com/gchq/CyberChef/pull/2401
+[#2387]: https://github.com/gchq/CyberChef/pull/2387
+[#2384]: https://github.com/gchq/CyberChef/pull/2384
+[#2386]: https://github.com/gchq/CyberChef/pull/2386
+[#2388]: https://github.com/gchq/CyberChef/pull/2388
+[#2378]: https://github.com/gchq/CyberChef/pull/2378
+[#2379]: https://github.com/gchq/CyberChef/pull/2379
+[#2372]: https://github.com/gchq/CyberChef/pull/2372
+[#2368]: https://github.com/gchq/CyberChef/pull/2368
+[#2370]: https://github.com/gchq/CyberChef/pull/2370
+[#2371]: https://github.com/gchq/CyberChef/pull/2371
+[#2369]: https://github.com/gchq/CyberChef/pull/2369
+[#1882]: https://github.com/gchq/CyberChef/pull/1882
+[#2354]: https://github.com/gchq/CyberChef/pull/2354
+[#2363]: https://github.com/gchq/CyberChef/pull/2363
+[#2364]: https://github.com/gchq/CyberChef/pull/2364
+[#2365]: https://github.com/gchq/CyberChef/pull/2365
+[#2366]: https://github.com/gchq/CyberChef/pull/2366
+[#2367]: https://github.com/gchq/CyberChef/pull/2367
+[#2361]: https://github.com/gchq/CyberChef/pull/2361
+[#2332]: https://github.com/gchq/CyberChef/pull/2332
+[#2353]: https://github.com/gchq/CyberChef/pull/2353
+[#2351]: https://github.com/gchq/CyberChef/pull/2351
 

Dockerfile

@@ -4,7 +4,7 @@
 # Modifier --platform=$BUILDPLATFORM limits the platform to "BUILDPLATFORM" during buildx multi-platform builds
 # This is because npm "chromedriver" package is not compatiable with all platforms
 # For more info see: https://docs.docker.com/build/building/multi-platform/#cross-compilation
-FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14 AS builder
+FROM --platform=$BUILDPLATFORM node:24-alpine@sha256:fb71d01345f11b708a3553c66e7c74074f2d506400ea81973343d915cb64eef0 AS builder
 
 WORKDIR /app
 
@@ -27,7 +27,7 @@ RUN npm run build
 #########################################
 # Package static build files into nginx #
 #########################################
-FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:0a1e718ff1e1a22fc519d0c2e5b6872681f01e37c8a2817ec43ce6e716103929 AS cyberchef
+FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:37f356a5eba5d187365b4f59cd6cc29f1f922ad18146d554b576a80983377e6a AS cyberchef
 
 LABEL maintainer="GCHQ <oss@gchq.gov.uk>"
 

Gruntfile.js

@@ -144,7 +144,8 @@ module.exports = function (grunt) {
                     new BundleAnalyzerPlugin({
                         analyzerMode: "static",
                         reportFilename: "BundleAnalyzerReport.html",
-                        openAnalyzer: false
+                        openAnalyzer: false,
+                        excludeAssets: /.*Worker.js/
                     }),
                 ]
             };

SECURITY.md

@@ -2,25 +2,15 @@
 
 ## Supported Versions
 
-CyberChef is supported on a best endeavours basis. Patches will be applied to
+CyberChef is supported on a best endeavours basis.
-the latest version rather than retroactively to older versions. To ensure you
+Patches will be applied to the latest version rather than retroactively to older versions.
-are using the most secure version of CyberChef, please make sure you have the
+To ensure you are using the most secure version of CyberChef, please make sure you have the [latest release](https://github.com/gchq/CyberChef/releases/latest). [The official website](https://gchq.github.io/CyberChef/) is always up to date.
-[latest release](https://github.com/gchq/CyberChef/releases/latest). The
-official [live demo](https://gchq.github.io/CyberChef/) is always up to date.
 
 ## Reporting a Vulnerability
 
-In most scenarios, the most appropriate way to report a vulnerability is to
+If you discover a vulnerability in CyberChef, please do not publicly disclose it, and do not create a GitHub issue.
-[raise a new issue](https://github.com/gchq/CyberChef/issues/new/choose)
-describing the problem in as much detail as possible, ideally with examples.
-This will obviously be public. If you feel that the vulnerability is
-significant enough to warrant a private disclosure, please email
-[oss@gchq.gov.uk](mailto:oss@gchq.gov.uk) and
-[n1474335@gmail.com](mailto:n1474335@gmail.com).
 
-Disclosures of vulnerabilities in CyberChef are always welcomed. Whilst we aim
+Instead, send an email as soon as possible to [CyberChefSecurity@gchq.gov.uk](mailto:CyberChefSecurity@gchq.gov.uk).
-to write clean and secure code free from bugs, we recognise that this is an open
+The report will be acknowledged and actioned urgently by the CyberChef maintainers.
-source project written by analysts in their spare time, relying on dozens of
+
-open source libraries that are modified and updated on a regular basis. We hope
+If you do not receive a timely acknowledgement, please notify [oss@gchq.gov.uk](mailto:oss@gchq.gov.uk) and [CyberChef@gchq.gov.uk](mailto:CyberChef@gchq.gov.uk) of your vulnerability report.
-that the community will continue to support us as we endeavour to maintain and
-develop this tool together.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "cyberchef",
-  "version": "11.0.0",
+  "version": "11.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cyberchef",
-      "version": "11.0.0",
+      "version": "11.1.0",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -21,7 +21,7 @@
         "assert": "^2.1.0",
         "avsc": "^5.7.9",
         "bcryptjs": "^3.0.3",
-        "bignumber.js": "^11.1.2",
+        "bignumber.js": "^11.1.3",
         "blakejs": "^1.2.1",
         "bootstrap": "4.6.2",
         "bootstrap-colorpicker": "^3.4.0",
@@ -39,7 +39,7 @@
         "d3": "7.9.0",
         "d3-hexbin": "^0.2.2",
         "diff": "^9.0.0",
-        "dompurify": "^3.4.7",
+        "dompurify": "^3.4.8",
         "es6-promisify": "^7.0.0",
         "escodegen": "^2.1.0",
         "esprima": "^4.0.1",
@@ -85,7 +85,7 @@
         "path": "^0.12.7",
         "popper.js": "^1.16.1",
         "process": "^0.11.10",
-        "protobufjs": "^8.5.0",
+        "protobufjs": "^8.6.2",
         "punycode.js": "^2.3.1",
         "qr-image": "^3.2.0",
         "reflect-metadata": "^0.2.2",
@@ -94,7 +94,7 @@
         "snackbarjs": "^1.1.0",
         "sortablejs": "^1.15.7",
         "split.js": "^1.6.5",
-        "sql-formatter": "^15.8.0",
+        "sql-formatter": "^15.8.1",
         "ssdeep.js": "0.0.3",
         "stream-browserify": "^3.0.0",
         "tesseract.js": "^7.0.0",
@@ -118,7 +118,7 @@
         "@codemirror/language": "^6.12.3",
         "@codemirror/search": "^6.7.0",
         "@codemirror/state": "^6.5.4",
-        "@codemirror/view": "^6.43.0",
+        "@codemirror/view": "^6.43.1",
         "@puppeteer/browsers": "3.0.4",
         "autoprefixer": "^10.5.0",
         "babel-loader": "^10.1.1",
@@ -1898,9 +1898,9 @@
       }
     },
     "node_modules/@codemirror/view": {
-      "version": "6.43.0",
+      "version": "6.43.1",
-      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.0.tgz",
+      "resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.43.1.tgz",
-      "integrity": "sha512-V7ZCLQO3Jus9hzh2jVCCPW3mO4IBMr43O37PqSUYautJSnnJF41YlgLw21x0fLJTYvJ+Vkm6Gp+qKGH9pltgXA==",
+      "integrity": "sha512-+BIjw/AG3tDQ4pJgTLPYdAW25eDE66YsvM4LKyVPgGzVgZ4a9Wj1SRX8kPVKgBDdPt8oHtZ15F0qx7p0oOHdHw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5794,9 +5794,9 @@
       }
     },
     "node_modules/bignumber.js": {
-      "version": "11.1.2",
+      "version": "11.1.3",
-      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-11.1.2.tgz",
+      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-11.1.3.tgz",
-      "integrity": "sha512-9idDyC15Vpk+53w4OfxEu2PqHSKFQUffrH1oTvnkJ9fduTJ032tpuI2sxS04oCzocklokWUZmWVEkTEQdLmUOQ==",
+      "integrity": "sha512-+esZiNSo6VgFokTsYX6mYqNJfFd/IczzZCd4Z7cR8e+AQWhvIcj6nqQ1h9814D9u/TApU0jjTVmfWL0Pd1ZBdA==",
       "license": "MIT"
     },
     "node_modules/binary-extensions": {
@@ -8585,9 +8585,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.4.7",
+      "version": "3.4.8",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.7.tgz",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.8.tgz",
-      "integrity": "sha512-2jBxDJY4RR06tQNy4w5FlFH7kfxsQZlufd0sbv+chfHCxeJwrFw2baUDsSwvBISD4K4RDbd0PTfy3uNXsR6siA==",
+      "integrity": "sha512-yb1cEmaOum7wFvOCSQxyfgVlv5D47Rc30iZWoMpbDIWTnJ6grDDQyu2KFJzB2k7u0pMuJcQ1zphH//fFnw2tjQ==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -15086,10 +15086,9 @@
       "license": "MIT"
     },
     "node_modules/protobufjs": {
-      "version": "8.5.0",
+      "version": "8.6.2",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.5.0.tgz",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.2.tgz",
-      "integrity": "sha512-df1jWDPA5VIBNRtuAHjqr09f2qN5D4Vke1wYqOQg1XJ7ZDpA7BD6L7E4tyChgGRLB5hqk2m79Zsy0WHwV9a84A==",
+      "integrity": "sha512-CCERJxzRvKMeEdJSLwdQf40TXWNPc8M4RkN7j/lxY6FQB+4do8rETWqj60AqxP9n0XIsxnSefZ8uhAaGKg2njw==",
-      "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "long": "^5.3.2"
@@ -16373,9 +16372,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.3",
+      "version": "1.8.4",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
-      "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16775,9 +16774,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/sql-formatter": {
-      "version": "15.8.0",
+      "version": "15.8.1",
-      "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.8.0.tgz",
+      "resolved": "https://registry.npmjs.org/sql-formatter/-/sql-formatter-15.8.1.tgz",
-      "integrity": "sha512-HnjdRHlSsO4Ap2erB5YXAvWggrnk/S4TezUn8zmpq9J/hEKn9+6gGaqiKPyDtI10Xf4zJmHYPREGjMjZmmP1fg==",
+      "integrity": "sha512-nT2r90kTEYBuse9fe4r1Rp78v1mOBD35KsGc07Vo9eQSVa1TcTSnCS0zouf6BCmdzvmqBsBW+cYuBoYkHO/OWg==",
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1",

package.json

@@ -1,8 +1,8 @@
 {
   "name": "cyberchef",
-  "version": "11.0.0",
+  "version": "11.1.0",
   "description": "The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.",
-  "author": "n1474335 <n1474335@gmail.com>",
+  "author": "GCHQ <CyberChef@gchq.gov.uk>",
   "homepage": "https://gchq.github.io/CyberChef",
   "copyright": "Crown copyright 2016",
   "license": "Apache-2.0",
@@ -48,7 +48,7 @@
     "@codemirror/language": "^6.12.3",
     "@codemirror/search": "^6.7.0",
     "@codemirror/state": "^6.5.4",
-    "@codemirror/view": "^6.43.0",
+    "@codemirror/view": "^6.43.1",
     "@puppeteer/browsers": "3.0.4",
     "autoprefixer": "^10.5.0",
     "babel-loader": "^10.1.1",
@@ -105,7 +105,7 @@
     "assert": "^2.1.0",
     "avsc": "^5.7.9",
     "bcryptjs": "^3.0.3",
-    "bignumber.js": "^11.1.2",
+    "bignumber.js": "^11.1.3",
     "blakejs": "^1.2.1",
     "bootstrap": "4.6.2",
     "bootstrap-colorpicker": "^3.4.0",
@@ -123,7 +123,7 @@
     "d3": "7.9.0",
     "d3-hexbin": "^0.2.2",
     "diff": "^9.0.0",
-    "dompurify": "^3.4.7",
+    "dompurify": "^3.4.8",
     "es6-promisify": "^7.0.0",
     "escodegen": "^2.1.0",
     "esprima": "^4.0.1",
@@ -169,7 +169,7 @@
     "path": "^0.12.7",
     "popper.js": "^1.16.1",
     "process": "^0.11.10",
-    "protobufjs": "^8.5.0",
+    "protobufjs": "^8.6.2",
     "punycode.js": "^2.3.1",
     "qr-image": "^3.2.0",
     "reflect-metadata": "^0.2.2",
@@ -178,7 +178,7 @@
     "snackbarjs": "^1.1.0",
     "sortablejs": "^1.15.7",
     "split.js": "^1.6.5",
-    "sql-formatter": "^15.8.0",
+    "sql-formatter": "^15.8.1",
     "ssdeep.js": "0.0.3",
     "stream-browserify": "^3.0.0",
     "tesseract.js": "^7.0.0",

src/core/Chef.mjs

@@ -138,6 +138,8 @@ class Chef {
 
         if (!highlights) return false;
 
+        if (direction === "reverse") highlights.reverse();
+
         for (let i = 0; i < highlights.length; i++) {
             // Remove multiple highlights before processing again
             pos = [pos[0]];

src/core/config/Categories.json

@@ -119,6 +119,7 @@
             "GOST Verify",
             "GOST Key Wrap",
             "GOST Key Unwrap",
+            "ROR13",
             "ROT13",
             "ROT13 Brute Force",
             "ROT47",
@@ -240,6 +241,7 @@
             "Bit shift right",
             "Rotate left",
             "Rotate right",
+            "ROR13",
             "ROT13",
             "ROT8000"
         ]

src/core/dishTypes/DishType.mjs

@@ -11,7 +11,7 @@
 class DishType {
 
     /**
-     * Warn translations dont work without value from bind
+     * Warn translations don't work without value from bind
      */
     static checkForValue(value) {
         if (value === undefined) {

src/core/errors/ExcludedOperationError.mjs

@@ -1,5 +1,5 @@
 /**
- * Custom error type for handling operation that isnt included in node.js API
+ * Custom error type for handling operation that isn't included in node.js API
  *
  * @author d98762625 [d98762625@gmail.com]
  * @copyright Crown Copyright 2018

src/core/operations/GenerateDeBruijnSequence.mjs

@@ -50,6 +50,14 @@ class GenerateDeBruijnSequence extends Operation {
             throw new OperationError("Invalid alphabet size, required to be between 2 and 9 (inclusive).");
         }
 
+        if (!Number.isInteger(k)) {
+            throw new OperationError("Invalid alphabet size, required to be integer.");
+        }
+
+        if (!Number.isInteger(n)) {
+            throw new OperationError("Invalid key length, required to be integer.");
+        }
+
         if (n < 2) {
             throw new OperationError("Invalid key length, required to be at least 2.");
         }

src/core/operations/GenerateLoremIpsum.mjs

@@ -8,6 +8,10 @@ import Operation from "../Operation.mjs";
 import OperationError from "../errors/OperationError.mjs";
 import { GenerateParagraphs, GenerateSentences, GenerateWords, GenerateBytes } from "../lib/LoremIpsum.mjs";
 
+// arbitrary limits set to avoid DoS by requesting ridiculous amounts of data
+const maxLoremWords = 100_000; // same limit also used for paragraphs/sentences
+const maxLoremCharacters = 1_000_000;
+
 /**
  * Generate Lorem Ipsum operation
  */
@@ -47,9 +51,7 @@ class GenerateLoremIpsum extends Operation {
      */
     run(input, args) {
         const [length, lengthType] = args;
-        if (length < 1) {
+        checkLimits(lengthType, length);
-            throw new OperationError("Length must be greater than 0");
-        }
         switch (lengthType) {
             case "Paragraphs":
                 return GenerateParagraphs(length);
@@ -68,3 +70,32 @@ class GenerateLoremIpsum extends Operation {
 }
 
 export default GenerateLoremIpsum;
+
+/**
+ * check combined validity of lengthType and length arguments
+ * @param {string} lengthType
+ * @param {number} length
+ * @throws {OperationError}
+ */
+function checkLimits(lengthType, length) {
+    if (length < 1) {
+        throw new OperationError("Length must be greater than 0");
+    }
+
+    switch (lengthType) {
+        case "Paragraphs":
+        case "Sentences":
+        case "Words":
+            if (length > maxLoremWords) {
+                throw new OperationError("Length must be less than " + maxLoremWords);
+            }
+            break;
+        case "Bytes":
+            if (length > maxLoremCharacters) {
+                throw new OperationError("Length must be less than " + maxLoremCharacters);
+            }
+            break;
+        default:
+            throw new OperationError("Invalid length type");
+    }
+}

src/core/operations/ParityBit.mjs

@@ -20,7 +20,7 @@ class ParityBit extends Operation {
 
         this.name = "Parity Bit";
         this.module = "Default";
-        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurence of the delimiter character";
+        this.description = "A parity bit, or check bit, is the simplest form of error detection. It is a bit which is added to a string of bits and represents if the number of 1's in the binary string is an even number or odd number.<br><br>If a delimiter is specified, the parity bit calculation will be performed on each 'block' of the input data, where the blocks are created by slicing the input at each occurrence of the delimiter character";
         this.infoURL = "https://wikipedia.org/wiki/Parity_bit";
         this.inputType = "string";
         this.outputType = "string";

src/core/operations/ParseIPv4Header.mjs

@@ -74,7 +74,7 @@ class ParseIPv4Header extends Operation {
             checksum = input[10] << 8 | input[11],
             srcIP = input[12] << 24 | input[13] << 16 | input[14] << 8 | input[15],
             dstIP = input[16] << 24 | input[17] << 16 | input[18] << 8 | input[19],
-            checksumHeader = input.slice(0, 10).concat([0, 0]).concat(input.slice(12, 20));
+            checksumHeader = [...input.slice(0, 10), 0, 0, ...input.slice(12, 20)];
         let version = (input[0] >>> 4) & 0x0f,
             options = [];
 

src/core/operations/ROR13.mjs

@@ -0,0 +1,83 @@
+/**
+ * ROR13 Hash operation (Windows API hashing convention)
+ * @author fufu_btw
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+
+/**
+ * Implements a ROR13 hash used for API name hashing techniques.
+ */
+class ROR13 extends Operation {
+
+    /**
+     * Constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "ROR13";
+        this.module = "Default";
+        this.description = "Computes a ROR13 hash used in API hashing techniques.";
+        this.infoURL = "";
+        this.inputType = "byteArray";
+        this.outputType = "string";
+
+        this.args = [];
+    }
+
+    /**
+     * Rotate right (32-bit)
+     *
+     * @param {number} value - input value
+     * @param {number} bits - rotation bits
+     * @returns {number} rotated value
+     */
+    ror(value, bits) {
+        return ((value >>> bits) | (value << (32 - bits))) >>> 0;
+    }
+
+    /**
+     * Execute ROR13 hash
+     *
+     * @param {byteArray} input - input bytes
+     * @param {Object[]} args - operation arguments
+     * @returns {string} hex hash
+     */
+    run(input, args) {
+        let hash = 0;
+
+        for (let i = 0; i < input.length; i++) {
+            const chr = input[i] & 0xFF;
+            hash = this.ror(hash, 13);
+            hash = (hash + chr) >>> 0;
+        }
+
+        return "0x" + hash.toString(16).padStart(8, "0").toUpperCase();
+    }
+
+    /**
+     * Highlight input
+     *
+     * @param {Object[]} pos
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    highlight(pos, args) {
+        return pos;
+    }
+
+    /**
+     * Reverse highlight
+     *
+     * @param {Object[]} pos
+     * @param {Object[]} args
+     * @returns {Object[]}
+     */
+    highlightReverse(pos, args) {
+        return pos;
+    }
+}
+
+export default ROR13;

src/core/operations/SHA2.mjs

@@ -20,7 +20,7 @@ class SHA2 extends Operation {
 
         this.name = "SHA2";
         this.module = "Crypto";
-        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bytes.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bytes.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
+        this.description = "The SHA-2 (Secure Hash Algorithm 2) hash functions were designed by the NSA. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA224, SHA256, SHA384, SHA512.<br><br><ul><li>SHA-512 operates on 64-bit words.</li><li>SHA-256 operates on 32-bit words.</li><li>SHA-384 is largely identical to SHA-512 but is truncated to 384 bits.</li><li>SHA-224 is largely identical to SHA-256 but is truncated to 224 bits.</li><li>SHA-512/224 and SHA-512/256 are truncated versions of SHA-512, but the initial values are generated using the method described in Federal Information Processing Standards (FIPS) PUB 180-4.</li></ul> The message digest algorithm for SHA256 variants consists, by default, of 64 rounds, and for SHA512 variants, it is, by default, 160.";
         this.infoURL = "https://wikipedia.org/wiki/SHA-2";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";

src/core/operations/ToHexdump.mjs

@@ -8,6 +8,8 @@ import Operation from "../Operation.mjs";
 import Utils from "../Utils.mjs";
 import OperationError from "../errors/OperationError.mjs";
 
+const MAX_WIDTH = 65536;
+
 /**
  * To Hexdump operation
  */
@@ -30,7 +32,8 @@ class ToHexdump extends Operation {
                 "name": "Width",
                 "type": "number",
                 "value": 16,
-                "min": 1
+                "min": 1,
+                "max": MAX_WIDTH
             },
             {
                 "name": "Upper case hex",
@@ -63,6 +66,9 @@ class ToHexdump extends Operation {
         if (length < 1 || Math.round(length) !== length)
             throw new OperationError("Width must be a positive integer");
 
+        if (length > MAX_WIDTH)
+            throw new OperationError(`Width must be no more than ${MAX_WIDTH}`);
+
         const lines = [];
         for (let i = 0; i < data.length; i += length) {
             let lineNo = Utils.hex(i, 8);

tests/operations/tests/GenerateLoremIpsum.mjs

@@ -0,0 +1,80 @@
+/**
+ * Generate Lorem Ipsum tests
+ *
+ * @author GCHQDeveloper581
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Generate Lorem Ipsum: Exceeds Word Limit",
+        input: "",
+        expectedOutput: "Length must be less than 100000",
+        recipeConfig: [
+            {
+                "op": "Generate Lorem Ipsum",
+                "args": [999_999, "Words"]
+            },
+        ],
+    },
+    {
+        name: "Generate Lorem Ipsum: Within Word Limit",
+        input: "",
+        // each word is >= 3 characters long, so expect at least 3000 characters
+        expectedMatch: /.{3000,}/s,
+        recipeConfig: [
+            {
+                "op": "Generate Lorem Ipsum",
+                "args": [1000, "Words"]
+            },
+        ],
+    },
+    {
+        name: "Generate Lorem Ipsum: Exceeds Byte Limit",
+        input: "",
+        expectedOutput: "Length must be less than 1000000",
+        recipeConfig: [
+            {
+                "op": "Generate Lorem Ipsum",
+                "args": [1_000_001, "Bytes"]
+            },
+        ],
+    },
+    {
+        name: "Generate Lorem Ipsum: Exceeds Sentence Limit",
+        input: "",
+        expectedOutput: "Length must be less than 100000",
+        recipeConfig: [
+            {
+                "op": "Generate Lorem Ipsum",
+                "args": [999_999, "Sentences"]
+            },
+        ],
+    },
+    {
+        name: "Generate Lorem Ipsum: Exceeds Paragraph Limit",
+        input: "",
+        expectedOutput: "Length must be less than 100000",
+        recipeConfig: [
+            {
+                "op": "Generate Lorem Ipsum",
+                "args": [999_999, "Paragraphs"]
+            },
+        ],
+    },
+    {
+        name: "Generate Lorem Ipsum: Incorrect lengthType",
+        input: "",
+        expectedOutput: "Invalid length type",
+        recipeConfig: [
+            {
+                "op": "Generate Lorem Ipsum",
+                "args": [999_999, "Novels"]
+            },
+        ],
+    },
+
+
+]);

tests/operations/tests/Hexdump.mjs

@@ -126,6 +126,17 @@ TestRegister.addTests([
             }
         ],
     },
+    {
+        name: "To Hexdump: Width too large",
+        input: "H",
+        expectedOutput: "Width must be no more than 65536",
+        recipeConfig: [
+            {
+                op: "To Hexdump",
+                args: [155555555555555, false, false, false]
+            }
+        ],
+    },
     {
         name: "From Hexdump: xxd",
         input: `00000000: 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f  ................

tests/operations/tests/ParseIPv4Header.mjs

@@ -19,5 +19,16 @@ TestRegister.addTests([
                 args: ["Hex", "Data (raw)"]
             }
         ]
+    },
+    {
+        name: "Parse IPv4 header: regression for Uint8Array.concat crash on truncated raw input",
+        input: "\x45\x00\x00\x14\x00\x00\x00\x00\x40\x06\x00\x00",
+        expectedOutput: "",
+        recipeConfig: [
+            {
+                op: "Parse IPv4 header",
+                args: ["Raw", "Data (raw)"]
+            }
+        ]
     }
 ]);

tests/operations/tests/ROR13.mjs

@@ -0,0 +1,45 @@
+/**
+ * ROR13 tests.
+ *
+ * @author fufu_btw [contact@fufu.red]
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+
+TestRegister.addTests([
+    {
+        name: "ROR13: AddConsoleAliasW",
+        input: "AddConsoleAliasW",
+        expectedOutput: "0x9916128C",
+        recipeConfig: [
+            {
+                op: "ROR13",
+                args: []
+            },
+        ],
+    },
+    {
+        name: "ROR13 Hash: LoadLibraryA",
+        input: "LoadLibraryA",
+        expectedOutput: "0xEC0E4E8E",
+        recipeConfig: [
+            {
+                op: "ROR13",
+                args: []
+            },
+        ],
+    },
+    {
+        name: "ROR13 Hash: CloseHandle",
+        input: "CloseHandle",
+        expectedOutput: "0x0FFD97FB",
+        recipeConfig: [
+            {
+                op: "ROR13",
+                args: []
+            },
+        ],
+    },
+]);