cyberchef

History

Security improvements: Fix crypto RNG and add security audit

Comprehensive security analysis and fixes addressing multiple
vulnerabilities identified in code and dependencies.

Security Fixes:
- LS47: Replace Math.random() with crypto.getRandomValues() for padding
- GOST: Add warning when falling back to insecure Math.random()
- Both maintain backward compatibility with graceful fallbacks

Documentation:
- SECURITY_ANALYSIS.md: Comprehensive audit of 35 npm vulnerabilities
- SECURITY_FIXES_APPLIED.md: Detailed changelog of all security improvements
- scripts/security-fix.sh: Automated dependency update script

Key Findings:
- 35 npm vulnerabilities (8 critical, 8 high, 11 moderate, 8 low)
- Critical: eval() usage in OutputWaiter.mjs (requires review)
- Medium: 20+ innerHTML usages (most properly escaped)
- Low: Math.random() in crypto contexts (now fixed)

Recommendations:
1. Run ./scripts/security-fix.sh to update dependencies
2. Review eval() usage for CSP implementation
3. Audit innerHTML sources in App.mjs
4. Enable automated security scanning (Dependabot/Snyk)

Impact:
- Improved cryptographic security in LS47 and GOST operations
- Better visibility of fallback RNG usage
- Clear security documentation for maintainers
- Automated tools for dependency management

All changes are backward compatible with graceful degradation.

2025-12-18 23:04:08 +00:00

config

Merge branch 'master' into kgoto/add-handlebar

2025-05-16 11:03:44 +01:00

dishTypes

Removed treatAsUTF8 option

2023-01-13 14:38:50 +00:00

errors

Always use mjs imports

2021-09-17 08:48:04 +02:00

lib

Security improvements: Fix crypto RNG and add security audit