Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

doc: Consider removing dangerous Buffer usage from the Readme

See original GitHub issue

I’m talking about the examples on https://github.com/form-data/form-data#usage.

Sending new Buffer(10) to a remote host is unsafe, it basically sends a chunk of process memory, which potentially cointains db passwords, encryption keys, source file chunks, etc.

While not a vulnerability in form-data, having that code as the first example of how to use this library is probably not a very good idea.

Issue Analytics

State:
Created 7 years ago
Reactions:1
Comments:5 (2 by maintainers)

Top GitHub Comments

1reaction

DylanPierceycommented, Jul 15, 2017

@motet-a I agree, we should probably remove this deprecated api. I plan on doing some cleanup on this lib when I get a bit of time but feel free to make a PR.

0reactions

motet-acommented, Mar 22, 2017

In addition to be unsafe, it is deprecated.

Top Results From Across the Web

@guld/safe-buffer - npm

Use of Buffer.allocUnsafeSlow() should be used only as a last resort after a developer has observed undue memory retention in their applications ...

User Data Options - ReadMe Documentation

Just wrap the variable name with <<variable>> to user's value, or the default if no value is set. <<name>> will be replaced with...

base/containers/README.md - chromium/src - Git at Google

efficiently. In this case, consider `base::flat_map` and `base::flat_set`. You need to be aware of the maximum expected size of the container since.

Changelog — Python 3.11.1 documentation

gh-92888: Fix memoryview use after free when accessing the backing buffer in certain cases. gh-68966: The deprecated mailcap module now refuses to inject...

ChangeLog - Zlib

configure for Solaris, support --64 [Mooney] - Remove -R. from Solaris shared ... use of Z_BUF_ERROR in gz* functions except for premature EOF...