Closes#2344.
`ShowBase64Offsets` writes the per-offset `staticSection` directly
into HTML output. On the highlighted branches (`showVariable=true`)
the static text was wrapped in an attribute-escaped tooltip and was
fine, but on the `showVariable=false` branches at lines 98, 128,
and 158 the raw Base64 string was assigned back to the offset
variable and emitted unescaped. Combined with the explicit `<script>`
eval in OutputWaiter.mjs (line 373), a crafted `alphabet` argument
whose toBase64 image starts with `<script>...` produced a working
XSS payload in the rendered output.
The reporter's repro:
https://gchq.github.io/CyberChef/#recipe=Show_Base64_offsets('%3Cscript%3Eale(1)/.ABCDEFGHIJKLMNOPQRSTUVWXYZbdfghjkmnoquvwxyz023456',false)&input=ABCDEFGHIJKDGLMNAOBCDEFGHPPP
Fix: route all three `if (!showVariable)` branches through
`Utils.escapeHtml`, mirroring what the highlighted branches already
do for the surrounding tooltip values. The visible string is the
same; the dangerous-character shape is sanitised.
Tests
- New `tests/operations/tests/ShowBase64Offsets.mjs` registered in
`tests/operations/index.mjs`:
- 'HTML escapes static output (#2344)' — alphabet whose toBase64
image starts with `<script>` must not appear verbatim in the
output; the encoded form `<script>` should appear instead.
- 'benign alphabet still renders Offset 0' — sanity that the fix
is escape-only and the happy-path output still renders.
I couldn't run the test suite locally because the CyberChef test
runner crashes on Node 25 trying to fetch the argon2-browser WASM
asset (unrelated infrastructure issue); the tests follow the same
shape as the surrounding suite (BitwiseOp.mjs etc.) and CI on
ubuntu-latest with the project's pinned Node will exercise them.
Signed-off-by: SAY-5 <say.apm35@gmail.com>
109f5064cc