Skip to content

Bug report: Spurious "Could not read a QR code from the image" console log messages when handling image data #2610

Closed

Description

@GCHQDeveloper581

Describe the bug
If the data being processed by CyberChef can be decoded as an image then spurious log messages appear on the browser console (if open) to the effect of:

[BGChefWorker]: Could not read a QR code from the image.
The root cause is an overly permissive regex pattern in the this.checks attribute for the ParseQR Operation which essentially matches any image, causing the Magic functionality to attempt to parse the image as a QR code, which in most cases fails resulting in this message.

To Reproduce

Open a new browser window, and open the browser console (eg for Chrome open the Developer Tools pane)

Open the URL:
https://gchq.github.io/CyberChef/#input=aVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUFFQUFBQUJDQVlBQUFBZkZjU0pBQUFBRFVsRVFWUjRBV05JVEV6OER3QUViUUlqTnQ0RERBQUFBQUJKUlU1RXJrSmdnZz09

(input is the base64 encoding of a single pixel PNG)

Console log messages will be seen

Expected behaviour
No logged warnings/errors

Additional context
IMHO there is no simple method for detecting whether an image contains a QR code, and therefore the "Parse QR Code" operation should not participate in the Magic functionality.

The Magic pipeline would then terminate at the rendering of the image, at which point it should be obvious to the user that the image contains a QR Code and that operation could be added manually.

Activity

  1. GCHQDeveloper581 commented on Jun 27, 2026

    @GCHQDeveloper581
    ContributorAuthor

    See #2597 for an initial report of this problem. This separate issue has been raised to allow the parameter validation in Generate Image to be dealt with separately.

  2. GCHQDeveloper581 commented on Jul 3, 2026

    @GCHQDeveloper581
    ContributorAuthor

    Supplementary commentary, since the fix of removing Parse QR from Magic has been queried.

    I believe the current behaviour breaches the Principle of Least Astonishment. When tracing the behaviour as first raised in #2597 I was concerned that there was some kind of stack overflow in Jimp as I simply couldn't understand how and why Parse QR was being called.

    I think the URL I've used above to illustrate demonstrates the point perfectly. There is no way that that URL should/could be expected to produce exception output in the console log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions