Bug report: running magic recipe on .cer TLS file causes memory exhaustion
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the bug**
A memory exhaustion is caused when the `magic` recipe is run on a certificate file input (TLS)
**To Reproduce**
Steps to reproduce the behaviour or a link to the recipe / input used to cause the bug:
1. Firefox 137 Ubuntu, window with 17 tabs open
2. Run a local CC instance with the `magic` default recipe on this file input (attached below) `file:///home/analyst-chef/Documents/cyberchef/CyberChef_v10.19.4.html#recipe=Magic(3,false,false,'')Detect_File_Type(true,true,true,true,true,true,true/disabled)&input=MIIIYzCCBkugAwIBAgITMwDf7V%2BL88j24FagcAAAAN/tXzANBgkqhkiG9w0BAQwFADBZMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSowKAYDVQQDEyFNaWNyb3NvZnQgQXp1cmUgVExTIElzc3VpbmcgQ0EgMDUwHhcNMjMxMjEwMjIzMDM0WhcNMjQwNjI3MjM1OTU5WjBuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEgMB4GA1UEAxMXd3d3LnRyYW5zbGF0ZXRoZXdlYi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOh4as3SCeeGoPDeliRv3DTI4F%2B0CtMc6cNJFiV%2BSm4%2BtenVTJWqqyBRvMbnOpm6mqMz2Zw0KdnfRuRPOiGrR%2BjGORNBQ7tF1%2BnQwa7nk5xhvkq67H1fFAtiVykb%2B2FOF3SqntezjWSJfSVnqICnVWI8eNv5FnfGPr67WLF4NLNHe1Id9Qb0NhVObGtSZfBfVPSIZCn8Y3kyw4JYmkDuYGDGc0IhpBd3GaucKwI44fpEUfMvrgaq8D2BXOqX8U4JRiCmn/9vqxJk9s4TxdMSNmuiw0CNEdc8fKXT68IJ3gKH%2BT7LAx1BgvE6bpTiL%2BS8kXmb17HufwFKZ8EjphxHyVAgMBAAGjggQNMIIECTCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFoAHcAdv%2BIPwq2%2B5VRwmHM9Ye6NLSkzbsp3GhCCp/mZ0xaOnQAAAGMVeO7CwAABAMASDBGAiEAhz/rOwBDeoECscQ0sAJLJG3bg6Evx2ZRs%2BRPm7goiDkCIQCB0pjaeh8jie0wZ%2BcFg9LpBTTF7%2BBafT3Fup8iuEVbmgB1AEiw42vapkc0D%2BVqAvqdMOscUgHLVt0sgdm7v6s52IRzAAABjFXju%2BsAAAQDAEYwRAIgGI7UVUOc/pAw6o0jBJEdVoRSAfTGoG1aT8UpGxmL15YCIA4GuHToK0xKhfqdm9jupTX2KDQWBkbQLvMBwQ5W5PXnAHYAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAGMVeO76wAABAMARzBFAiEAycZCt1tMcAYqjs7l/Si7N%2ByG2%2Bsd4BR46YpeAOltxeYCIByfPlJIImtFT5slftUAHMtL6cbhSBDxIH/GpUWnWcG%2BMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGCNxUIh73XG4Hn60aCgZ0ujtAMh/DaHV2ChOVpgvOnPgIBZAIBJjCBrgYIKwYBBQUHAQEEgaEwgZ4wbQYIKwYBBQUHMAKGYWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQXp1cmUlMjBUTFMlMjBJc3N1aW5nJTIwQ0ElMjAwNSUyMC0lMjB4c2lnbi5jcnQwLQYIKwYBBQUHMAGGIWh0dHA6Ly9vbmVvY3NwLm1pY3Jvc29mdC5jb20vb2NzcDAdBgNVHQ4EFgQUnYCM9xSyX6u/MKcxBQfg9HgsgiAwDgYDVR0PAQH/BAQDAgWgMCIGA1UdEQQbMBmCF3d3dy50cmFuc2xhdGV0aGV3ZWIuY29tMAwGA1UdEwEB/wQCMAAwZAYDVR0fBF0wWzBZoFegVYZTaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwQXp1cmUlMjBUTFMlMjBJc3N1aW5nJTIwQ0ElMjAwNS5jcmwwZgYDVR0gBF8wXTBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMAgGBmeBDAECAjAfBgNVHSMEGDAWgBTHspx/HOO4Wu/paBqoXZTBJlJqaDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEMBQADggIBAA1UaQjIJKS1SO2RbJB2yjE1Dwm/HCkgctTVBAfhAGhPlSAgyvFgHP8TwvPfat5KaaiaQ6YogYS4Ne7Buudxn9HIu2BQV304fdghtUd99Ye8HuXoRUzJSupdkDbYsPO8z4/abE%2B%2BNAh3RsU4ot0d0ap%2B%2BADyobxB7dRGdU1zysk8dpVnGHCEMLJgPGZ5iIr4u%2B0mnV7SRrJGvqp9DoVNjZlUFfMOZMWVKmBLWIvpIK6/hOYOBlfK5qXpiizdkXR2lQtmlDbnbS3JwlXinkZ%2Bjzd2sx9nfDJHKIMFCW3W8v8DDBxYYVWZFwbl3RQ%2BDSmLzyt6PZcEXr70CjWMtv3kBHOWwE8okzyl7zbIErU22FRN%2B0DCdfpyvQsrRawY7MX/MQcJNrwK8MqOBOS7XJJK7wI0mwdZLck8GJ5Mtip%2B1HdjHeLJimlEGZzDNXOiigNBCwUS5E8gRiPYLAEqK1N59cEPM%2BTkC5HAnatACI2zrBIXDtKPuwTHjH8Rlgo6ILyCe8I7am1MIYNuYv%2Bdw7rSa5lxYYcsui4W6L6RbNozwpM7NYKGF5fL2%2BK0yn8dQ/rZ58oyEgM6/xmxdHGBPoaMCI63i4p/1OnOX5zbw59h0%2BZv0eWljfBxYnYbQk7xLizLEP6BE80k6IqAYuXFgxknLU%2B5HxN%2BABRZyj9viQTWUOpNcertwggXzMIIE26ADAgECAhANe%2B3pfYIJlnpSYxuL3Ri9MA0GCSqGSIb3DQEBDAUAMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMB4XDTIwMDcyOTEyMzAwMFoXDTI0MDYyNzIzNTk1OVowWTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEqMCgGA1UEAxMhTWljcm9zb2Z0IEF6dXJlIFRMUyBJc3N1aW5nIENBIDA1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqmUNOZD1p/BU9B6UO6742TE0nTzgI0qetnbUAF7AT5RTgYoOfDKBl0rpqA1IyzlShyFQQPPP0Kl1Xm10/MvXg78Z4TaA7n9pQVNQwb1zqd7LGTm2rVZ0qw%2BSK0/CzpXwxZrl3Uv/LhEWFkdSyDHFTJKViUak1weGGzKvsS8V5xkYDUx%2ByK0BZWnqGJYA2RYog19Fx23dnYDbeGYwf0xFIYFxweI%2B7PCtWxKYvC%2B3daVEOA5smQTjS0Vi8noZcBCJoYcIhZJU5uA7fOPrGR1sQUyYn/OvZZ63koRxQO1QGEDh1RSho9XPr27jpXnpWxzLeVe7ViWyTziPmVQ8t2wDG26W0/g49Cg5OmdjyTFaQfqSA7mBMoTcdG%2BhUiNTjEnQlDvjrPL/wZ1ADfpJo2LPhTe7XTMVmDZGS/Z0vUu/nwRcvTavmrkH%2BeFUf8zWOhO%2BlG9p4SkAmGQgD02Sm9sYSlJ1wDQ6u0454a2uyI7IwFiSOkHmfDRwljVAc6veci8nY6dj44olsNKuEWpayTz/WrpnVY2843Pu17WkC0d6t0%2BLmkId6JcI2m/59p3A/STxzNp/ZWzX2diyBafm4jItAvwR6F0HMJs4onL2yXzpLgWp7gcbIC2aoaVpY6yrYDo7%2BloyLcFKZZMNuA8sI8Fs%2B179uy4AQXhqOQ8QRLcYc/0CAwEAAaOCAa0wggGpMB0GA1UdDgQWBBTHspx/HOO4Wu/paBqoXZTBJlJqaDAfBgNVHSMEGDAWgBROIlQgGJXm427mD/r6uRLtBhePOTAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RHMi5jcnQwewYDVR0fBHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDAdBgNVHSAEFjAUMAgGBmeBDAECATAIBgZngQwBAgIwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEMBQADggEBAB74b4bZEV1a1jEsgoxHkf9pU0WM0/sl1676hlopoi7tTc2J3KQWv33iNLEwExXvry6Qnn%2BEtIqy6P9IuOYB/BEBn7DREaqL%2BQ689hSUGv%2Bwo7Cve1WSD1xxkF5ucFUb4MspOnY7HT6NgEI/GVrkU7bnaqmTv/rC3xJmTd2JJTXYmbuJ/%2BOOSGQYH97xR1%2BsqgvK0O%2BpV6LA8DkU/OoqhKo3vlvIuOwgokR02LTtJjjmE39FSeyYigB/3eqVodH9IlZVGGta3cmZ6gEnZEMrj3bMXpMa7WaiHhoTp7TRiTBM9at67C9osHbbS9aa2Bk%2Bz4NIhvZ32E8F0ImC9yGjVw`
[www.translatetheweb.com_download.cer.txt](https://github.com/user-attachments/files/19899423/www.translatetheweb.com_download.cer.txt)
Stuck on baking and leads to memory exhaustion
Notice the detect file type recipe works correctly without leading to OOM or freezing.
**Expected behaviour**
Doesn't lead to memory exhaustion in browser
[NO_TRAIN]::
**Desktop (if relevant, please complete the following information):**
- OS: Ubuntu
- Browser: Firefox 137
- CyberChef version: 10.19.4
Contributor guide
Research direction
Start by reproducing the issue in Firefox 137 on Ubuntu with the attached .cer input and the reported Magic(3,false,false,'')Detect_File_Type recipe. Compare it with Detect_File_Type alone, then trace the Magic recipe execution to identify the memory-exhaustion path; done means the certificate input no longer freezes the browser or exhausts memory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100