gchq / gchq/CyberChef

Bug report: running magic recipe on .cer TLS file causes memory exhaustion

Open
#2,026 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Describe the bug**
A memory exhaustion is caused when the `magic` recipe is run on a certificate file input (TLS)

**To Reproduce**
Steps to reproduce the behaviour or a link to the recipe / input used to cause the bug:

1. Firefox 137 Ubuntu, window with 17 tabs open
2. Run a local CC instance with the `magic` default recipe on this file input (attached below) `file:///home/analyst-chef/Documents/cyberchef/CyberChef_v10.19.4.html#recipe=Magic(3,false,false,'')Detect_File_Type(true,true,true,true,true,true,true/disabled)&input=MIIIYzCCBkugAwIBAgITMwDf7V%2BL88j24FagcAAAAN/tXzANBgkqhkiG9w0BAQwFADBZMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSowKAYDVQQDEyFNaWNyb3NvZnQgQXp1cmUgVExTIElzc3VpbmcgQ0EgMDUwHhcNMjMxMjEwMjIzMDM0WhcNMjQwNjI3MjM1OTU5WjBuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEgMB4GA1UEAxMXd3d3LnRyYW5zbGF0ZXRoZXdlYi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOh4as3SCeeGoPDeliRv3DTI4F%2B0CtMc6cNJFiV%2BSm4%2BtenVTJWqqyBRvMbnOpm6mqMz2Zw0KdnfRuRPOiGrR%2BjGORNBQ7tF1%2BnQwa7nk5xhvkq67H1fFAtiVykb%2B2FOF3SqntezjWSJfSVnqICnVWI8eNv5FnfGPr67WLF4NLNHe1Id9Qb0NhVObGtSZfBfVPSIZCn8Y3kyw4JYmkDuYGDGc0IhpBd3GaucKwI44fpEUfMvrgaq8D2BXOqX8U4JRiCmn/9vqxJk9s4TxdMSNmuiw0CNEdc8fKXT68IJ3gKH%2BT7LAx1BgvE6bpTiL%2BS8kXmb17HufwFKZ8EjphxHyVAgMBAAGjggQNMIIECTCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFoAHcAdv%2BIPwq2%2B5VRwmHM9Ye6NLSkzbsp3GhCCp/mZ0xaOnQAAAGMVeO7CwAABAMASDBGAiEAhz/rOwBDeoECscQ0sAJLJG3bg6Evx2ZRs%2BRPm7goiDkCIQCB0pjaeh8jie0wZ%2BcFg9LpBTTF7%2BBafT3Fup8iuEVbmgB1AEiw42vapkc0D%2BVqAvqdMOscUgHLVt0sgdm7v6s52IRzAAABjFXju%2BsAAAQDAEYwRAIgGI7UVUOc/pAw6o0jBJEdVoRSAfTGoG1aT8UpGxmL15YCIA4GuHToK0xKhfqdm9jupTX2KDQWBkbQLvMBwQ5W5PXnAHYAVYHUwhaQNgFK6gubVzxT8MDkOHhwJQgXL6OqHQcT0wwAAAGMVeO76wAABAMARzBFAiEAycZCt1tMcAYqjs7l/Si7N%2ByG2%2Bsd4BR46YpeAOltxeYCIByfPlJIImtFT5slftUAHMtL6cbhSBDxIH/GpUWnWcG%2BMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGCNxUIh73XG4Hn60aCgZ0ujtAMh/DaHV2ChOVpgvOnPgIBZAIBJjCBrgYIKwYBBQUHAQEEgaEwgZ4wbQYIKwYBBQUHMAKGYWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQXp1cmUlMjBUTFMlMjBJc3N1aW5nJTIwQ0ElMjAwNSUyMC0lMjB4c2lnbi5jcnQwLQYIKwYBBQUHMAGGIWh0dHA6Ly9vbmVvY3NwLm1pY3Jvc29mdC5jb20vb2NzcDAdBgNVHQ4EFgQUnYCM9xSyX6u/MKcxBQfg9HgsgiAwDgYDVR0PAQH/BAQDAgWgMCIGA1UdEQQbMBmCF3d3dy50cmFuc2xhdGV0aGV3ZWIuY29tMAwGA1UdEwEB/wQCMAAwZAYDVR0fBF0wWzBZoFegVYZTaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwQXp1cmUlMjBUTFMlMjBJc3N1aW5nJTIwQ0ElMjAwNS5jcmwwZgYDVR0gBF8wXTBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMAgGBmeBDAECAjAfBgNVHSMEGDAWgBTHspx/HOO4Wu/paBqoXZTBJlJqaDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEMBQADggIBAA1UaQjIJKS1SO2RbJB2yjE1Dwm/HCkgctTVBAfhAGhPlSAgyvFgHP8TwvPfat5KaaiaQ6YogYS4Ne7Buudxn9HIu2BQV304fdghtUd99Ye8HuXoRUzJSupdkDbYsPO8z4/abE%2B%2BNAh3RsU4ot0d0ap%2B%2BADyobxB7dRGdU1zysk8dpVnGHCEMLJgPGZ5iIr4u%2B0mnV7SRrJGvqp9DoVNjZlUFfMOZMWVKmBLWIvpIK6/hOYOBlfK5qXpiizdkXR2lQtmlDbnbS3JwlXinkZ%2Bjzd2sx9nfDJHKIMFCW3W8v8DDBxYYVWZFwbl3RQ%2BDSmLzyt6PZcEXr70CjWMtv3kBHOWwE8okzyl7zbIErU22FRN%2B0DCdfpyvQsrRawY7MX/MQcJNrwK8MqOBOS7XJJK7wI0mwdZLck8GJ5Mtip%2B1HdjHeLJimlEGZzDNXOiigNBCwUS5E8gRiPYLAEqK1N59cEPM%2BTkC5HAnatACI2zrBIXDtKPuwTHjH8Rlgo6ILyCe8I7am1MIYNuYv%2Bdw7rSa5lxYYcsui4W6L6RbNozwpM7NYKGF5fL2%2BK0yn8dQ/rZ58oyEgM6/xmxdHGBPoaMCI63i4p/1OnOX5zbw59h0%2BZv0eWljfBxYnYbQk7xLizLEP6BE80k6IqAYuXFgxknLU%2B5HxN%2BABRZyj9viQTWUOpNcertwggXzMIIE26ADAgECAhANe%2B3pfYIJlnpSYxuL3Ri9MA0GCSqGSIb3DQEBDAUAMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMB4XDTIwMDcyOTEyMzAwMFoXDTI0MDYyNzIzNTk1OVowWTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEqMCgGA1UEAxMhTWljcm9zb2Z0IEF6dXJlIFRMUyBJc3N1aW5nIENBIDA1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqmUNOZD1p/BU9B6UO6742TE0nTzgI0qetnbUAF7AT5RTgYoOfDKBl0rpqA1IyzlShyFQQPPP0Kl1Xm10/MvXg78Z4TaA7n9pQVNQwb1zqd7LGTm2rVZ0qw%2BSK0/CzpXwxZrl3Uv/LhEWFkdSyDHFTJKViUak1weGGzKvsS8V5xkYDUx%2ByK0BZWnqGJYA2RYog19Fx23dnYDbeGYwf0xFIYFxweI%2B7PCtWxKYvC%2B3daVEOA5smQTjS0Vi8noZcBCJoYcIhZJU5uA7fOPrGR1sQUyYn/OvZZ63koRxQO1QGEDh1RSho9XPr27jpXnpWxzLeVe7ViWyTziPmVQ8t2wDG26W0/g49Cg5OmdjyTFaQfqSA7mBMoTcdG%2BhUiNTjEnQlDvjrPL/wZ1ADfpJo2LPhTe7XTMVmDZGS/Z0vUu/nwRcvTavmrkH%2BeFUf8zWOhO%2BlG9p4SkAmGQgD02Sm9sYSlJ1wDQ6u0454a2uyI7IwFiSOkHmfDRwljVAc6veci8nY6dj44olsNKuEWpayTz/WrpnVY2843Pu17WkC0d6t0%2BLmkId6JcI2m/59p3A/STxzNp/ZWzX2diyBafm4jItAvwR6F0HMJs4onL2yXzpLgWp7gcbIC2aoaVpY6yrYDo7%2BloyLcFKZZMNuA8sI8Fs%2B179uy4AQXhqOQ8QRLcYc/0CAwEAAaOCAa0wggGpMB0GA1UdDgQWBBTHspx/HOO4Wu/paBqoXZTBJlJqaDAfBgNVHSMEGDAWgBROIlQgGJXm427mD/r6uRLtBhePOTAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIGA1UdEwEB/wQIMAYBAf8CAQAwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RHMi5jcnQwewYDVR0fBHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdEcyLmNybDAdBgNVHSAEFjAUMAgGBmeBDAECATAIBgZngQwBAgIwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEMBQADggEBAB74b4bZEV1a1jEsgoxHkf9pU0WM0/sl1676hlopoi7tTc2J3KQWv33iNLEwExXvry6Qnn%2BEtIqy6P9IuOYB/BEBn7DREaqL%2BQ689hSUGv%2Bwo7Cve1WSD1xxkF5ucFUb4MspOnY7HT6NgEI/GVrkU7bnaqmTv/rC3xJmTd2JJTXYmbuJ/%2BOOSGQYH97xR1%2BsqgvK0O%2BpV6LA8DkU/OoqhKo3vlvIuOwgokR02LTtJjjmE39FSeyYigB/3eqVodH9IlZVGGta3cmZ6gEnZEMrj3bMXpMa7WaiHhoTp7TRiTBM9at67C9osHbbS9aa2Bk%2Bz4NIhvZ32E8F0ImC9yGjVw`

[www.translatetheweb.com_download.cer.txt](https://github.com/user-attachments/files/19899423/www.translatetheweb.com_download.cer.txt)

Stuck on baking and leads to memory exhaustion
Notice the detect file type recipe works correctly without leading to OOM or freezing.

**Expected behaviour**
Doesn't lead to memory exhaustion in browser

[NO_TRAIN]::

**Desktop (if relevant, please complete the following information):**
- OS: Ubuntu
- Browser: Firefox 137
- CyberChef version: 10.19.4

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue in Firefox 137 on Ubuntu with the attached .cer input and the reported Magic(3,false,false,'')Detect_File_Type recipe. Compare it with Detect_File_Type alone, then trace the Magic recipe execution to identify the memory-exhaustion path; done means the certificate input no longer freezes the browser or exhausts memory.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.