gchq/CyberChef · error · OperationError

Invalid ITA2 character : ${errltr}

Error message

Invalid ITA2 character : ${errltr}

What it means

Thrown by the Colossus operation when the input text contains a character not in the VALID_ITA2 alphabet. Colossus simulates the ITA2/Baudot-based Lorenz cipher, which only encodes a limited character set; any character outside VALID_ITA2 (after uppercasing) is rejected with its display name.

Source

Thrown at src/core/operations/Colossus.mjs:369

                type: "number",
                value: 1
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {Object}
     */
    run(input, args) {
        input = input.toUpperCase();
        for (const character of input) {
            if (VALID_ITA2.indexOf(character) === -1) {
                let errltr = character;
                if (errltr === "\n") errltr = "Carriage Return";
                if (errltr === " ") errltr = "Space";
                throw new OperationError("Invalid ITA2 character : " + errltr);
            }
        }

        const pattern = args[1];
        const qbusin = {
            "Z": args[2],
            "Chi": args[3],
            "Psi": args[4],
        };

        const limitation = args[5];
        const lm = [false, false, false];
        if (limitation.includes("Χ2")) lm[0] = true;
        if (limitation.includes("Ψ1")) lm[1] = true;
        if (limitation.includes("P5")) lm[2] = true;
        const limit = {
            X2: lm[0], S1: lm[1], P5: lm[2]
        };

View on GitHub (pinned to 4290ea7539)

Solutions

  1. Restrict input to the ITA2 character set (letters, space, and the few supported symbols in VALID_ITA2).
  2. Remove digits and unsupported punctuation before the operation.
  3. Uppercase is applied automatically; still avoid letters outside the ITA2 letter range.
  4. Consult VALID_ITA2 in the module for the authoritative allowed set.

Example fix

// before — contains a digit
// input: "ATTACK AT 0500"
// after — ITA2-safe text
// input: "ATTACK AT DAWN"
Defensive patterns

Strategy: validation

Validate before calling

const VALID_ITA2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ \r\n" /* consult module for full set */;
function isIta2Safe(text) {
  return text.toUpperCase().split("").every(c => VALID_ITA2.indexOf(c) !== -1);
}

Type guard

function isIta2Safe(text) { /* as above */ }

Try / catch

null

Prevention

When it happens

Trigger: Colossus.run uppercases input then scans each character against VALID_ITA2. Digits (0–9), punctuation not in ITA2, accented characters, or control chars throw. Newlines and spaces are mapped to friendly labels ('Carriage Return','Space') in the message before throwing.

Common situations: User feeds modern ASCII text containing digits, punctuation, or lowercase assumptions; pastes a file with non-ITA2 symbols; or forgets that ITA2 has no digits and expects numeric input to work.

Related errors


AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/89bd496df1aadc3e. Report an issue: GitHub.