2 ms·
Replace buffer in your example with plain object or just array - that rest of it still stands, right? There's something other at play: > buffers expose privat
by kklisura 3y ago
Replace buffer in your example with plain object or just array - that rest of it still stands, right?
There's something other at play:
> buffers expose private information through global variables, a potential security risk.
This links to following piece of code [1]:
> // Somewhere in your code
> const privateBuf = Buffer.from(privateKey, 'hex');
> // Rogue package can access
> Buffer.from('1').buffer
I've just run it in node, and my god am I shocked!
> const privateBuf = Buffer.from('DEADBEEF', 'hex');
> Buffer.from('1').buffer
> ArrayBuffer {
[Uint8Contents]: <2f 00 00 00 00 00 00 00 de ad be ef 00 > ....
[1] https://github.com/nodejs/node/issues/41588#issuecomment-1016269584 https://github.com/nodejs/node/issues/41588#issuecomment-101...