noBufferConstructor (JavaScript)

Language JavaScript (and super languages)

Summary

Rule available since: v2.6.8
Diagnostic Category: lint/nursery/noBufferConstructor
This rule doesn’t have a fix.
The default severity of this rule is warning.
Sources:
- Same as no-buffer-constructor
- Inspired from n/no-deprecated-api

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noBufferConstructor": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow the deprecated Buffer() constructor in Node.js.

In Node.js, Buffer() and new Buffer() do different things depending on the type of the value you pass in. A number creates a buffer of that size, while a string or an array creates a buffer that holds a copy of that data. If the value comes from user input and its type isn’t checked, an attacker can pick the type. This can expose data that was left in memory, or make the program use a lot of memory.

For this reason, Node.js deprecated the Buffer constructor. Use one of these functions instead, which each do only one thing:

Buffer.from() creates a buffer from existing data, such as a string or an array.
Buffer.alloc() creates a buffer of a given size, filled with zeros.
Buffer.allocUnsafe() creates a buffer of a given size faster, but it may contain old data from memory.

The rule reports the global Buffer, including globalThis.Buffer, and Buffer when it comes from the buffer, node:buffer, or safe-buffer modules through import, require(), or process.getBuiltinModule().

Examples

Invalid

1
new Buffer(5);

code-block.js:1:1 lint/nursery/noBufferConstructor ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Don't use the deprecated new Buffer().
  
  > 1 │ new Buffer(5);
      │ ^^^^^^^^^^^^^
    2 │ 
  
  ℹ It does different things depending on the type of its argument, which can expose data left in memory when the argument comes from user input.
  
  ℹ Use Buffer.from() to create a buffer from existing data, or Buffer.alloc() to create a buffer of a given size.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

1
Buffer([1, 2, 3]);

code-block.js:1:1 lint/nursery/noBufferConstructor ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Don't use the deprecated Buffer().
  
  > 1 │ Buffer([1, 2, 3]);
      │ ^^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ It does different things depending on the type of its argument, which can expose data left in memory when the argument comes from user input.
  
  ℹ Use Buffer.from() to create a buffer from existing data, or Buffer.alloc() to create a buffer of a given size.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

1
import { Buffer } from "node:buffer";
2

3
new Buffer(res.body.amount);

code-block.js:3:1 lint/nursery/noBufferConstructor ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Don't use the deprecated new Buffer().
  
    1 │ import { Buffer } from "node:buffer";
    2 │ 
  > 3 │ new Buffer(res.body.amount);
      │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^
    4 │ 
  
  ℹ It does different things depending on the type of its argument, which can expose data left in memory when the argument comes from user input.
  
  ℹ Use Buffer.from() to create a buffer from existing data, or Buffer.alloc() to create a buffer of a given size.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

1
const buffer = require("buffer");
2

3
new buffer.Buffer(res.body.values);

code-block.js:3:1 lint/nursery/noBufferConstructor ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ⚠ Don't use the deprecated new Buffer().
  
    1 │ const buffer = require("buffer");
    2 │ 
  > 3 │ new buffer.Buffer(res.body.values);
      │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    4 │ 
  
  ℹ It does different things depending on the type of its argument, which can expose data left in memory when the argument comes from user input.
  
  ℹ Use Buffer.from() to create a buffer from existing data, or Buffer.alloc() to create a buffer of a given size.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
Buffer.alloc(5);
2
Buffer.allocUnsafe(5);
3
Buffer.from([1, 2, 3]);
4

5
Buffer.alloc(res.body.amount);
6
Buffer.from(res.body.values);