gchq / gchq/CyberChef

Bug report: protobuf decoder is parsing strings as integers

Open
#1,448 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Describe the bug**

when decoding a proto that has a string the string is shown as integer:

**To Reproduce**

decode this string with base64:
`CloKJgokN2I5ODk3OWMtOGQ5My00M2YxLTk5NTYtZTI3NzYyMjI2YjE2EglhcHBsZV9wYXmCfSQKBDY5MzcSFUFwcGxlIFBheSBQbGFjZUhvbGRlchgJIOYPKAU=`
we can see an `apple_pay` text:
```
Z
&
$7b98979c-8d93-43f1-9956-e27762226b16 apple_pay‚}$
6937Apple Pay PlaceHolder æ(
```
but when I add protobuf decoder I'm getting:

```
{
"1": {
"1": {
"1": "7b98979c-8d93-43f1-9956-e27762226b16"
},
"2": {
"12": 8746395506356023000
},
"2000": {
"1": "6937",
"2": "Apple Pay PlaceHolder",
"3": 9,
"4": 2022,
"5": 5
}
}
}
```
the `8746395506356023000` should be `apple_pay`
![image](https://user-images.githubusercontent.com/904179/198289838-9e389dbb-f323-4621-995b-5540f52a6a9d.png)

![image](https://user-images.githubusercontent.com/904179/198289684-fba88a42-68b0-4a7d-ac26-668806a2fae9.png)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the supplied base64 input with CyberChef's protobuf decoder and inspect the decoder entry point found by searching for its operation name. Compare the field producing 8746395506356023000 with the expected apple_pay value; done when the sample decodes that field as text without regressing the other shown fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
data
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.