Regarding Buffer

A little background:

• new Buffer(size) is deprecated: https://nodejs.org/api/buffer.html#buffer_new_buffer_size
• Buffer.alloc() or Buffer.allocUnsafe() should be used instead, but it’s not supported on Node.js v4.0.0-v4.5.0.
• https://github.com/jprichardson/node-fs-extra/pull/380 switched us to Buffer.alloc(). This was released in fs-extra v2.1.0
• People complained about the lack of Node v4.3.0 support: https://github.com/jprichardson/node-fs-extra/issues/390
• I reverted #380 in e02c07bc26edfca0b9602a9ac142a344ed020aad, and released fs-extra v2.1.1 as a hotfix for this.

Now, what are we going to do moving forward? Using new Buffer() emits a deprecation warning in Node v7.0.0-v7.2.1.

I’m wondering if we shouldn’t consider some sort of fallback solution.

---

Also, this brings up the security question that prompted Node to change the Buffer API in the first place: new Buffer returns an uninitialized buffer. Currently, we are not zero-filling it. I can’t see how this could be exploited in the current implementation, but it would be good to have this reviewed.

If we do not need the buffer to be initialized, we should use Buffer.allocUnsafe, not Buffer.alloc, in later versions.

Atten: @jprichardson @manidlou @dr-dimitru

[jprichardson]

@RyanZim good point. Let’s just go with allocUnsafe()

@dr-dimitru looks good!

[dr-dimitru]

Hi @jprichardson

Here is my snipped from #380 thread:

var _buffer = {
  allocUnsafe: function (len) {
    if (typeof Buffer.allocUnsafe === 'function') {
      try {
        // Node 4.4.* Buffer.allocUnsafe already exists, but throws exception in edge cases
        return Buffer.allocUnsafe(len);
      } catch (_error) {
        return new Buffer(len);
      }
    }
    return new Buffer(len);
  }
};