{"record":{"id":"49b566a8b2bce03a","repo":"gchq/CyberChef","slug":"incorrectly-encoded-word","errorCode":null,"errorMessage":"Incorrectly Encoded Word","messagePattern":"Incorrectly Encoded Word","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/MIMEDecoding.mjs","lineNumber":152,"sourceCode":"            }\n        }\n\n        throw new OperationError(\"Unhandled Charset\");\n    }\n\n    /**\n     * Parses a Q encoded word\n     *\n     * @param encodedWord\n     */\n    parseQEncodedWord(encodedWord) {\n        let decodedWord = \"\";\n        for (let i = 0; i < encodedWord.length; i++) {\n            if (encodedWord[i] === \"_\") {\n                decodedWord += \" \";\n            // Parse hex encoding\n            } else if (encodedWord[i] === \"=\") {\n                if ((i + 2) >= encodedWord.length) throw new OperationError(\"Incorrectly Encoded Word\");\n                const decodedHex = Utils.byteArrayToChars(fromHex(encodedWord.substring(i + 1, i + 3)));\n                decodedWord += decodedHex;\n                i += 2;\n            } else if (\n                (encodedWord[i].charCodeAt(0) >= \" \".charCodeAt(0) && encodedWord[i].charCodeAt(0) <= \"~\".charCodeAt(0)) ||\n                encodedWord[i] === \"\\n\" ||\n                encodedWord[i] === \"\\r\" ||\n                encodedWord[i] === \"\\t\") {\n                decodedWord += encodedWord[i];\n            } else {\n                throw new OperationError(\"Incorrectly Encoded Word\");\n            }\n        }\n\n        return decodedWord;\n    }\n}\n","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/MIMEDecoding.mjs#L134-L170","documentation":"Thrown by the MIME Decoding operation while parsing a Q-encoded encoded word, when a '=' escape appears too close to the end of the word to contain the required two hex digits. RFC 2047 Q-encoding uses '=XX' for a byte value; if the '=' is at a position where fewer than two characters follow it (i + 2 >= length), parseQEncodedWord throws at MIMEDecoding.mjs:152. This indicates a truncated or malformed escape sequence.","triggerScenarios":"A Q-encoded word ending in a dangling '=', e.g. =?UTF-8?Q?abc= ?=, =?UTF-8?Q?ab=A?=, or =?UTF-8?Q?x=4?= — any case where '=' is not followed by exactly two hex digits before the closing '?='. Raised at MIMEDecoding.mjs:152.","commonSituations":"Headers truncated by a line-wrap/transport issue; a malformed '=' introduced by mis-escaping; copy/paste that chopped the end of the encoded word; an encoder bug that emitted an incomplete escape.","solutions":["Repair the encoded word so every '=' is followed by exactly two hexadecimal digits (e.g. complete '=2' to '=20', remove a stray trailing '=').","If the header is corrupt beyond repair, strip or replace the malformed encoded word before decoding.","Re-acquire the original message from the source to avoid transport truncation."],"exampleFix":"// before — dangling '=' (incomplete hex escape)\n// =?UTF-8?Q?Hello= world?=\n\n// after — complete the escape (=20 is space)\n// =?UTF-8?Q?Hello=20world?=","handlingStrategy":"validation","validationCode":"// Reject Q-words with a dangling '=' escape before decoding.\nfunction wellFormedQWord(w) {\n  for (let i = 0; i < w.length; i++) {\n    if (w[i] === '=' && i + 2 >= w.length) return false;\n  }\n  return true;\n}\nif (!wellFormedQWord(text)) {\n  // repair: pad/complete the escape, or strip the malformed word\n}","typeGuard":"function isWellFormedQWord(v: unknown): v is string {\n  if (typeof v !== 'string') return false;\n  for (let i = 0; i < v.length; i++) {\n    if (v[i] === '=' && i + 2 >= v.length) return false;\n  }\n  return true;\n}","tryCatchPattern":"try {\n  mimeDecoding.run(bytes, []);\n} catch (e) {\n  if (e instanceof OperationError && /Incorrectly Encoded Word/.test(e.message)) {\n    // strip or repair the malformed encoded word, then retry\n  } else throw e;\n}","preventionTips":["Re-acquire truncated headers from the original message source.","Validate that every '=' inside a Q-word is followed by two hex digits.","Strip malformed encoded words rather than letting them abort the whole decode."],"tags":["mime","rfc2047","q-encoding","validation","malformed-input"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}