Exclude Delete character from hex dump output (#2086 )

Co-authored-by: GCHQ Developer C85297 <95289555+C85297@users.noreply.github.com>
Tiny typo fix in "To Base85" operation (#2118 )
2026-01-29 15:53:36 +00:00 · 2026-01-29 15:00:17 +00:00 · 2026-01-29 14:32:38 +00:00 · 2026-01-29 13:40:34 +00:00
6 changed files with 31 additions and 12 deletions
--- a/package-lock.json
+++ b/package-lock.json
@@ -57,7 +57,7 @@
        "jsesc": "^3.0.2",
        "json5": "^2.2.3",
        "jsonata": "^2.0.3",
-        "jsonpath-plus": "^9.0.0",
+        "jsonpath-plus": "^10.3.0",
        "jsonwebtoken": "8.5.1",
        "jsqr": "^1.4.0",
        "jsrsasign": "^11.1.0",
@@ -12503,21 +12503,21 @@
      }
    },
    "node_modules/jsonpath-plus": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-9.0.0.tgz",
-      "integrity": "sha512-bqE77VIDStrOTV/czspZhTn+o27Xx9ZJRGVkdVShEtPoqsIx5yALv3lWVU6y+PqYvWPJNWE7ORCQheQkEe0DDA==",
+      "version": "10.3.0",
+      "resolved": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.3.0.tgz",
+      "integrity": "sha512-8TNmfeTCk2Le33A3vRRwtuworG/L5RrgMvdjhKZxvyShO+mBu2fP50OWUjRLNtvw344DdDarFh9buFAZs5ujeA==",
      "license": "MIT",
      "dependencies": {
-        "@jsep-plugin/assignment": "^1.2.1",
-        "@jsep-plugin/regex": "^1.0.3",
-        "jsep": "^1.3.8"
+        "@jsep-plugin/assignment": "^1.3.0",
+        "@jsep-plugin/regex": "^1.0.4",
+        "jsep": "^1.4.0"
      },
      "bin": {
        "jsonpath": "bin/jsonpath-cli.js",
        "jsonpath-plus": "bin/jsonpath-cli.js"
      },
      "engines": {
-        "node": ">=14.0.0"
+        "node": ">=18.0.0"
      }
    },
    "node_modules/jsonwebtoken": {
--- a/package.json
+++ b/package.json
@@ -143,7 +143,7 @@
    "jsesc": "^3.0.2",
    "json5": "^2.2.3",
    "jsonata": "^2.0.3",
-    "jsonpath-plus": "^9.0.0",
+    "jsonpath-plus": "^10.3.0",
    "jsonwebtoken": "8.5.1",
    "jsqr": "^1.4.0",
    "jsrsasign": "^11.1.0",
--- a/src/core/Utils.mjs
+++ b/src/core/Utils.mjs
@@ -177,7 +177,7 @@ class Utils {
     */
    static printable(str, preserveWs=false, onlyAscii=false) {
        if (onlyAscii) {
-            return str.replace(/[^\x20-\x7f]/g, ".");
+            return str.replace(/[^\x20-\x7e]/g, ".");
        }

        // eslint-disable-next-line no-misleading-character-class
--- a/src/core/operations/ToBase85.mjs
+++ b/src/core/operations/ToBase85.mjs
@@ -33,7 +33,7 @@ class ToBase85 extends Operation {
                value: ALPHABET_OPTIONS
            },
            {
-                name: "Include delimeter",
+                name: "Include delimiter",
                type: "boolean",
                value: false
            }
--- a/tests/node/tests/Utils.mjs
+++ b/tests/node/tests/Utils.mjs
@@ -20,4 +20,10 @@ TestRegister.addApiTests([
        assert.equal(Utils.parseEscapedChars("\\\\\\'"), "\\'");
    }),

+    it("Utils: should replace delete character", () => {
+        assert.equal(
+            Utils.printable("\x7e\x7f\x80\xa7", false, true),
+            "\x7e...",
+        );
+    }),
 ]);
--- a/tests/operations/tests/Code.mjs
+++ b/tests/operations/tests/Code.mjs
@@ -322,8 +322,21 @@ TestRegister.addTests([
                ]
            }
        ],
-        expectedMatch: /^Invalid JPath expression: jsonPath: self is not defined:/
+        expectedMatch: /^Invalid JPath expression: Unexpected "{" at character 1/
    },
+    {
+        name: "JPath Expression: Script-based RCE",
+        input: "[{}]",
+        recipeConfig: [
+            {
+                "op": "JPath expression",
+                "args": [
+                    "$..[?(p=\"console.log(this.process.mainModule.require('child_process').execSync('id').toString())\";a=''[['constructor']][['constructor']](p);a())]",
+                    "\n"
+                ]
+            }
+        ],
+        expectedMatch: /^Invalid JPath expression: jsonPath: Cannot read properties of {2}\(reading 'constructor'\): /    },
    {
        name: "CSS selector",
        input: '<div id="test">\n<p class="a">hello</p>\n<p>world</p>\n<p class="a">again</p>\n</div>',
Author	SHA1	Message	Date
みけCAT	dd26c09003	Exclude Delete character from hex dump output (#2086 ) Co-authored-by: GCHQ Developer C85297 <95289555+C85297@users.noreply.github.com>	2026-01-29 15:00:17 +00:00
Paul Hudson	a30f5f1b50	Tiny typo fix in "To Base85" operation (#2118 ) This adjusts spelling in the "To Base85" operation from "delimeter" to "delimiter". Co-authored-by: GCHQ Developer C85297 <95289555+C85297@users.noreply.github.com>	2026-01-29 14:32:38 +00:00
GCHQ Developer C85297	b885e8423d	Bump jsonpath-plus (#2166 ) Closes #1928 #1926	2026-01-29 13:40:34 +00:00