Repository: gchq/CyberChef
File: src/core/lib/FileSignatures.mjs (JavaScript)

Code before:
            mime: "vnd.ms-cab-compressed",
            description: "",
            signature: {
                0: 0x4d,
                1: 0x53,
                2: 0x43,
                3: 0x46,
                4: 0x00,
                5: 0x00,
                6: 0x00,
                7: 0x00
            },
            extractor: null
        },
        {
            name: "Jar Archive",
            extension: "jar",
            mime: "application/java-archive",
            description: "",
            signature: [
                {
                    0: 0x5f,
                    1: 0x27,
                    2: 0xa8,
                    3: 0x89
                },
                {
                    0: 0x50,
                    1: 0x4B,
                    2: 0x03,
                    3: 0x04,
                    4: 0x14,
                    5: 0x00,
                    6: 0x08,
                    7: 0x00,
                    8: 0x08,
                    9: 0x00
                }
            ],
            extractor: extractZIP
        },
        {
            name: "lzop compressed",
            extension: "lzop,lzo",
            mime: "application/x-lzop",
            description: "",
            signature: {
                0: 0x89,
                1: 0x4c, // LZO
                2: 0x5a,
                3: 0x4f,

Review comment (bug):
Presumably the ZIP extractor will only work when the JAR file is in a ZIP format, so this will fail when the other format is used. It might be worth splitting JAR into two definitions. One with an extractor and one without.

Is the signature you have here for a JAR file in a ZIP format specific to JAR files or will it fire on any ZIP file? If so, it might not be ideal as they will very rarely actually be JAR files.

Code after:
            mime: "vnd.ms-cab-compressed",
            description: "",
            signature: {
                0: 0x4d,
                1: 0x53,
                2: 0x43,
                3: 0x46,
                4: 0x00,
                5: 0x00,
                6: 0x00,
                7: 0x00
            },
            extractor: null
        },
        {
            name: "Jar Archive",
            extension: "jar",
            mime: "application/java-archive",
            description: "",
            signature: {
                0: 0x5f,
                1: 0x27,
                2: 0xa8,
                3: 0x89
            },
            extractor: extractZIP
        },
        {
            name: "Jar Archive",
            extension: "jar",
            mime: "application/java-archive",
            description: "",
            signature: {
                0: 0x50,
                1: 0x4B,
                2: 0x03,
                3: 0x04,
                4: 0x14,
                5: 0x00,
                6: 0x08,
                7: 0x00,
                8: 0x08,
                9: 0x00
            },
            extractor: null
        },
        {
            name: "lzop compressed",
            extension: "lzop,lzo",
            mime: "application/x-lzop",
            description: "",