Skip to content

Conversation

@varshard
Copy link
Contributor

@varshard varshard commented Oct 2, 2018

Buffer constructor has been deprecated because of security reasons and has been replaced with Buffer.from

https://nodesource.com/blog/understanding-the-buffer-deprecation-in-node-js-10/

lib/api.js Outdated
try {
buffer = Buffer.from(key);
} catch (e) {
if (e.message === 'this is not a typed array.') {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why need check this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Buffer.from suppose to officially replace new Buffer in v5.x, which suppose to support any parameter that is supported by Buffer(), however the oldest version that we still support (v4.4.6.) also implemented Buffer.from that which would throw this is not a typed array. if key isn't an array.

Copy link
Contributor

@phureewat29 phureewat29 Oct 25, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should check the existence method instead of catching and checking the error message when method is not exist in older version of node.

Copy link
Contributor

@phureewat29 phureewat29 Oct 25, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By the way, there was a backport of Buffer API to v4.x in v4.5.0. So, the Buffer.from() in versions prior is not the same thing. Please checking the existence of Buffer.allocUnsafe() instead.

// backward compatilibity for 4.x
if (typeof Buffer.allocUnsafe === "function"){
     buffer = Buffer.from(key);
} else {
     buffer = new Buffer(key);
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aquartier Checking for existence of Buffer.from isn't enough, because it exist in v4 as well.

allocUnsafe is a good idea. Thanks

@varshard varshard merged commit 27aea5e into master Nov 30, 2018
@danfowler danfowler deleted the replace_Buffer branch September 6, 2023 08:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants