Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

buffer: runtime-deprecate Buffer constructor everywhere by default #21351

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions doc/api/deprecations.md
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ be used.
<a id="DEP0005"></a>
### DEP0005: Buffer() constructor

Type: Runtime (supports [`--pending-deprecation`][])
Type: Runtime

The `Buffer()` function and `new Buffer()` constructor are deprecated due to
API usability issues that can potentially lead to accidental security issues.
Expand All @@ -93,10 +93,6 @@ is strongly recommended:
* [`Buffer.from(string[, encoding])`][from_string_encoding] - Create a `Buffer`
that copies `string`.

As of v10.0.0, a deprecation warning is printed at runtime when
`--pending-deprecation` is used or when the calling code is
outside `node_modules` in order to better target developers, rather than users.

<a id="DEP0006"></a>
### DEP0006: child\_process options.customFds

Expand Down
32 changes: 8 additions & 24 deletions lib/buffer.js
Original file line number Diff line number Diff line change
Expand Up @@ -48,17 +48,13 @@ try {
}
const {
customInspectSymbol,
isInsideNodeModules,
normalizeEncoding,
kIsEncodingSymbol
} = require('internal/util');
const {
isArrayBufferView,
isUint8Array
} = require('internal/util/types');
const {
pendingDeprecation
} = process.binding('config');
const {
ERR_BUFFER_OUT_OF_BOUNDS,
ERR_INDEX_OUT_OF_RANGE,
Expand Down Expand Up @@ -137,22 +133,12 @@ function alignPool() {
}

let bufferWarningAlreadyEmitted = false;
let nodeModulesCheckCounter = 0;
const bufferWarning = 'Buffer() is deprecated due to security and usability ' +
'issues. Please use the Buffer.alloc(), ' +
'Buffer.allocUnsafe(), or Buffer.from() methods instead.';

function showFlaggedDeprecation() {
if (bufferWarningAlreadyEmitted ||
++nodeModulesCheckCounter > 10000 ||
(!pendingDeprecation &&
isInsideNodeModules())) {
// We don't emit a warning, because we either:
// - Already did so, or
// - Already checked too many times whether a call is coming
// from node_modules and want to stop slowing down things, or
// - We aren't running with `--pending-deprecation` enabled,
// and the code is inside `node_modules`.
function showDeprecation() {
if (bufferWarningAlreadyEmitted) {
return;
}

Expand All @@ -161,17 +147,15 @@ function showFlaggedDeprecation() {
}

/**
* The Buffer() constructor is deprecated in documentation and should not be
* used moving forward. Rather, developers should use one of the three new
* factory APIs: Buffer.from(), Buffer.allocUnsafe() or Buffer.alloc() based on
* their specific needs. There is no runtime deprecation because of the extent
* to which the Buffer constructor is used in the ecosystem currently -- a
* runtime deprecation would introduce too much breakage at this time. It's not
* likely that the Buffer constructors would ever actually be removed.
* The Buffer() constructor is deprecated and should not be used moving forward.
* Rather, developers should use one of the three new factory APIs:
* Buffer.from(), Buffer.allocUnsafe() or Buffer.alloc() based on their specific
* needs. It's not likely that the Buffer constructors would ever actually be
* removed.
* Deprecation Code: DEP0005
*/
function Buffer(arg, encodingOrOffset, length) {
showFlaggedDeprecation();
showDeprecation();
// Common case.
if (typeof arg === 'number') {
if (typeof encodingOrOffset === 'string') {
Expand Down
42 changes: 0 additions & 42 deletions lib/internal/util.js
Original file line number Diff line number Diff line change
Expand Up @@ -330,47 +330,6 @@ function spliceOne(list, index) {
list.pop();
}

const kNodeModulesRE = /^(.*)[\\/]node_modules[\\/]/;

let getStructuredStack;

function isInsideNodeModules() {
if (getStructuredStack === undefined) {
// Lazy-load to avoid a circular dependency.
const { runInNewContext } = require('vm');
// Use `runInNewContext()` to get something tamper-proof and
// side-effect-free. Since this is currently only used for a deprecated API,
// the perf implications should be okay.
getStructuredStack = runInNewContext(`(function() {
Error.prepareStackTrace = function(err, trace) {
err.stack = trace;
};
Error.stackTraceLimit = Infinity;

return function structuredStack() {
return new Error().stack;
};
})()`, {}, { filename: 'structured-stack' });
}

const stack = getStructuredStack();

// Iterate over all stack frames and look for the first one not coming
// from inside Node.js itself:
if (Array.isArray(stack)) {
for (const frame of stack) {
const filename = frame.getFileName();
// If a filename does not start with / or contain \,
// it's likely from Node.js core.
if (!/^\/|\\/.test(filename))
continue;
return kNodeModulesRE.test(filename);
}
}
return false;
}


module.exports = {
assertCrypto,
cachedResult,
Expand All @@ -383,7 +342,6 @@ module.exports = {
getConstructorOf,
getSystemErrorName,
isError,
isInsideNodeModules,
join,
normalizeEncoding,
objectToString,
Expand Down
37 changes: 0 additions & 37 deletions test/parallel/test-buffer-constructor-node-modules-paths.js

This file was deleted.

29 changes: 0 additions & 29 deletions test/parallel/test-buffer-constructor-outside-node-modules.js

This file was deleted.

Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
// Flags: --pending-deprecation --no-warnings
// Flags: --no-warnings
'use strict';

const common = require('../common');
Expand Down
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
// Flags: --no-warnings --pending-deprecation
// Flags: --no-warnings
'use strict';

const common = require('../common');

process.on('warning', common.mustNotCall('A warning should not be emitted'));

// With the --pending-deprecation flag, the deprecation warning for
// new Buffer() should not be emitted when Uint8Array methods are called.
// The deprecation warning for new Buffer() should not be emitted when
// Uint8Array methods are called.

Buffer.from('abc').map((i) => i);
Buffer.from('abc').filter((i) => i);
Expand Down