gchq / gchq/CyberChef

Feature request: Implement JavaScript unescape function

Open
#1,507 0 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Is your feature request related to a problem? Please describe.**
While analyzing recent html smuggling attacks, I found a file that uses the `unescape` JavaScript function like so:

`document.write( unescape( '%3Chtml%20dir%3D%22ltr%22%20lang%3D%22en [...]`

Usually I use `URL Decode` for this task. But in the given file there were calculations that use the `+` (plus) sign. The plus sign is replaced by the URL Decode with a space character. Hence I am asking for a new Operation for the JS unescape function.

Obfuscated code:
```js
parseInt%28K%280x5d7%2C0x6b9%2C0x457%2C0x531%2C0x54a%29%29/%280x19c7+0x1c38+-0x35fe%29
```

URL Decode will decode to this result, which leads to syntax errors:
```js
parseInt(K(0x5d7,0x6b9,0x457,0x531,0x54a))/(0x19c7 0x1c38 -0x35fe)
```

Expected result:
```js
parseInt(K(0x5d7,0x6b9,0x457,0x531,0x54a))/(0x19c7+0x1c38+-0x35fe)
```

**Describe the solution you'd like**
Implement the JS unescape function as a new Operation in order to make HTML smuggling analysis easier.

**Describe alternatives you've considered**
Alternatively add a switch for the `URL Decode` Operation to leave e.g. the plus sign (maybe even other chars?) as they are and not replace them with a space.

Apart from that, two workarounds would be:

1) just run the `unescape( '%3Chtml%20dir%3D%22ltr%22%20lang%3D%22en [...]` directly in a browser's console and copy/paste the result to your editor again to analyze the unescaped code

2) `Find/Replace` the plus signs with some unique char sequence (such as `@@@`) then do `URL Decode`, then again `Find/Replace` the unique char sequence with a plus sign again

These do the job, but they don't prevent me from running into issues in the first place, because at first I did not notice the syntax errors in the decoded result.

**Additional context**
N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.