Bug #103419 Buffer() is deprecated due to security and usability issues

• Submitted: 22 Apr 2021 7:00
• Modified: 9 Jul 2021 13:04
• Reporter: ALEKSANDAR MAKEDONSKI
• Status: Closed
• Category: Connector for Node.js
• Severity: S3 (Non-critical)
• Version: 8.0.24
• OS: Any
• Assigned to: Rui Quelhas
• CPU Architecture: Any
• Tags: deprecation, engine, NodeJS

[22 Apr 2021 7:00] ALEKSANDAR MAKEDONSKI

Description:
I've got a warning for deprecation, please reconsider to change Buffer().

DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
at showFlaggedDeprecation (node:buffer:184:11)
at new Buffer (node:buffer:271:3)
at Object.toBuffer (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/Protocol/Wrappers/ScalarValues/bytes.js:57:1)
at Object.serialize (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/Protocol/Wrappers/Traits/Serializable.js:50:1)
at Object.exports.encodeCapabilitiesSet (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/Protocol/OutboundHandlers/Connection.js:70:1)
at Client.capabilitiesSet (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/Protocol/Client.js:292:1)
at Client.enableTLS (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/Protocol/Client.js:101:1)
at Session._createConnection (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/DevAPI/Session.js:264:1)
at Session.connect_ (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/DevAPI/Session.js:310:1)
at Socket.<anonymous> (~/dist/webpack:/application-backend/node_modules/@mysql/xdevapi/lib/DevAPI/Session.js:351:1)

How to repeat:
Using nodejs 14+

Suggested fix:
use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from()

[9 Jul 2021 13:04] Philip Olson

Posted by developer:
 
Fixed as of the upcoming MySQL Connector/Node 8.0.26 release, and here's the proposed changelog entry from the documentation team:

Replaced all instances of the deprecated new Buffer() API for the now
recommended alternatives (Buffer.alloc(), Buffer.allocUnsafe() and
Buffer.from()) to avoid unnecessary warning messages.

Thank you for the bug report.