buffer 6.0.3

Source: https://github.com/feross/buffer
Commit scanned: f52dffd9df04 (recorded by npm)
Compared with: 2b1286b3e0c6 (0 signals introduced since)
Files: 70 scanned, 2 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 42 info
Scan time: 4.8 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:59

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line perf/readUtf8.js:6:1

line length 1170 characters (raw pass, confidence 0.50)

var array = [ 152, 130, 206, 23, 243, 238, 197, 44, 27, 86, 208, 36, 163, 184, 164, 21, 94, 242, 178, 46, 25, 26, 253, 178, 72, 147, 207, 112, 236, 68, 179, 190, 29, 83, 239, 147, 125, 55, 143, 19, 157, 68, 157, 58, 212, 224, 150, 39, 128, 24, 94, 225, 120, 121, 75, 192, 112, 19, 184, 142, 203, 36, 43, 85, 26, 147, 227

info unicode-surrogate perf/writeUtf8.js:7:40

surrogate pair \uD944\uDC00 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
var singleByte = 'abcdefghi'
var multiByte = '\u0610' + '\u6100' + '\uD944\uDC00'

var browserBuffer = new BrowserBuffer(LENGTH)
```
info identifier-low-length test/compare.js:1:1

78 of 159 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)

info unicode-surrogate test/from-string.js:5:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:5:34

surrogate pair \uD83D\uDCAD (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:5:51

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:12:17

surrogate pair \uD842\uDFB7 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs over U+20000 until U+10FFFF', function (t) {
  const text = '\uD842\uDFB7' + '\uD93D\uDCAD' + '\uDBFF\uDFFF'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:12:34

surrogate pair \uD93D\uDCAD (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs over U+20000 until U+10FFFF', function (t) {
  const text = '\uD842\uDFB7' + '\uD93D\uDCAD' + '\uDBFF\uDFFF'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:12:51

surrogate pair \uDBFF\uDFFF (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs over U+20000 until U+10FFFF', function (t) {
  const text = '\uD842\uDFB7' + '\uD93D\uDCAD' + '\uDBFF\uDFFF'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:19:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate lead code point', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:19:34

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

test('replace orphaned utf16 surrogate lead code point', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:19:45

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate lead code point', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:26:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate trail code point', function (t) {
  const text = '\uD83D\uDE38' + '\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:26:34

orphaned low surrogate \uDCAD (no preceding high surrogate) (token pass, confidence 0.65)

test('replace orphaned utf16 surrogate trail code point', function (t) {
  const text = '\uD83D\uDE38' + '\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:26:45

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate trail code point', function (t) {
  const text = '\uD83D\uDE38' + '\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:42:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('handle partial utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDC4D'

  let buf = new B(8)

info unicode-surrogate test/from-string.js:42:34

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('handle partial utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDC4D'

  let buf = new B(8)

info unicode-surrogate test/from-string.js:88:23

orphaned low surrogate \uDE38 (no preceding high surrogate) (token pass, confidence 0.65)

test('handle invalid utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = 'a' + '\uDE38\uD83D' + 'b'

  let buf = new B(8)

info unicode-surrogate test/from-string.js:88:29

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

test('handle invalid utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = 'a' + '\uDE38\uD83D' + 'b'

  let buf = new B(8)

info unicode-mixed-script test/node/test-buffer-alloc.js:157:25

identifier `hέlló` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
{
  const utf8String = '¡hέlló wôrld!';
  const offset = 100;
```

info unicode-surrogate test/node/test-buffer-alloc.js:272:26

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

{
  const f = Buffer.from('\uD83D\uDC4D', 'utf-16le'); // THUMBS UP SIGN (U+1F44D)
  assert.strictEqual(f.length, 4);
  assert.deepStrictEqual(f, Buffer.from('3DD84DDC', 'hex'));

info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:423:16

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw==', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.97 Base64 test vector used to assert Buffer.from decoded length in Node's test suite.
Reasoning
This is a Node.js buffer test asserting decoded base64 lengths of fixed test vectors. The blob is a deliberate test input for base64 decoding edge cases, in a test file of the Node core library. Raw-pass base64 heuristic on test data is a known false positive.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:427:16

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw=', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.97 Base64 padding-edge test vector asserting decoded length in Node buffer tests.
Reasoning
Same pattern as the other Node core buffer tests: a fixed base64 string with an expected decoded length of 32 bytes, checking padding handling. Legitimate test fixture.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:435:16

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg==', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.97 Base64 test vector asserting decoded length of 31 bytes.
Reasoning
Fixed base64 test input with expected decoded length of 31 bytes, consistent with testing base64 decoding behavior. Benign test fixture.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:439:16

base64-like blob (43 bytes, compression ratio 1.26) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg=', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.97 Base64 padding test vector asserting decoded length of 31 bytes.
Reasoning
Padded base64 variant with expected length assertion; a standard test of the decoder. No execution or hidden payload involved.

info unicode-surrogate test/node/test-buffer-alloc.js:729:30

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  // see https://codereview.chromium.org/121173009/
  const buf = Buffer.from('ab\ud800cd', 'utf8');
  assert.strictEqual(buf[0], 0x61);
  assert.strictEqual(buf[1], 0x62);

info unicode-homoglyph test/node/test-buffer-bytelength.js:75:39

identifier `κλμνξο` contains homoglyph candidates: κ (03BA)→k, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

assert.strictEqual(Buffer.byteLength('∑éllö wørl∂!', 'utf-8'), 19);
assert.strictEqual(Buffer.byteLength('κλμνξο', 'utf8'), 12);
assert.strictEqual(Buffer.byteLength('挵挶挷挸挹', 'utf-8'), 15);
assert.strictEqual(Buffer.byteLength('𠝹𠱓𠱸', 'UTF8'), 12);

info unicode-mixed-script test/node/test-buffer-bytelength.js:75:39

identifier `κλμνξο` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

assert.strictEqual(Buffer.byteLength('∑éllö wørl∂!', 'utf-8'), 19);
assert.strictEqual(Buffer.byteLength('κλμνξο', 'utf8'), 12);
assert.strictEqual(Buffer.byteLength('挵挶挷挸挹', 'utf-8'), 15);
assert.strictEqual(Buffer.byteLength('𠝹𠱓𠱸', 'UTF8'), 12);

info unicode-mixed-script test/node/test-buffer-bytelength.js:80:39

identifier `𠱸挶νξ` mixes scripts: Other + Han + Greek (in string/comment) (raw pass, confidence 0.40)

assert.strictEqual(Buffer.byteLength('hey there'), 9);
assert.strictEqual(Buffer.byteLength('𠱸挶νξ#xx :)'), 17);
assert.strictEqual(Buffer.byteLength('hello world', ''), 11);
// it should also be assumed with unrecognized encoding

info unicode-mixed-script test/node/test-buffer.js:399:21

identifier `hέlló` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
var utf8String = '¡hέlló wôrld!';
var offset = 100;
```

info unicode-surrogate test/node/test-buffer.js:513:23

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

{
  var f = new Buffer('\uD83D\uDC4D', 'utf-16le'); // THUMBS UP SIGN (U+1F44D)
  assert.equal(f.length, 4);
  assert.deepStrictEqual(f, new Buffer('3DD84DDC', 'hex'));

info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:650:15

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw==', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.97 Legacy Buffer constructor base64 decode test asserting length 32.
Reasoning
Legacy new Buffer call with a base64 test vector and expected length assertion in Node's buffer test suite. Benign fixture data.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:654:15

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw=', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.97 Legacy Buffer base64 decode test asserting length 32 for padded input.
Reasoning
Same benign base64 test vector with length assertion for padded input, from the core buffer tests.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:662:15

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg==', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.97 Legacy Buffer base64 decode test asserting length 31.
Reasoning
Base64 test vector with expected length 31 in a standard Node buffer test. Benign.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:666:15

base64-like blob (43 bytes, compression ratio 1.26) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg=', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.97 Legacy Buffer base64 padding test asserting length 31.
Reasoning
Padded base64 test vector with expected decoded length 31 in Node's test suite. No malicious behavior; raw entropy heuristic only.

info unicode-surrogate test/node/test-buffer.js:977:27

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  // see https://codereview.chromium.org/121173009/
  var buf = new Buffer('ab\ud800cd', 'utf8');
  assert.equal(buf[0], 0x61);
  assert.equal(buf[1], 0x62);

info unicode-mixed-script test/to-string.js:6:12

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
  t.equal(
    new B('Ձאab', 'utf8').toString('base64'),
    '1YHXkGFi'
  )
```
info unicode-mixed-script test/to-string.js:14:12

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
  t.equal(
    new B('Ձאab', 'utf8').toString('hex'),
    'd581d7906162'
  )
```
info unicode-mixed-script test/to-string.js:71:6

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
    new B('1YHXkGFi', 'base64').toString('utf8'),
    'Ձאab'
  )
  t.end()
```
info unicode-mixed-script test/to-string.js:79:6

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
    new B('d581d7906162', 'hex').toString('utf8'),
    'Ձאab'
  )
  t.end()
```
info unicode-surrogate test/to-string.js:189:6

surrogate pair \uDBFC\uDC04 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
    new B([0xF4, 0x8F, 0x80, 0x84]).toString(),
    '\uDBFC\uDC04'
  )
  t.equal(
```

info long-line test/to-string.js:204:1

line length 1179 characters (raw pass, confidence 0.50)

    new B([152, 130, 206, 23, 243, 238, 197, 44, 27, 86, 208, 36, 163, 184, 164, 21, 94, 242, 178, 46, 25, 26, 253, 178, 72, 147, 207, 112, 236, 68, 179, 190, 29, 83, 239, 147, 125, 55, 143, 19, 157, 68, 157, 58, 212, 224, 150, 39, 128, 24, 94, 225, 120, 121, 75, 192, 112, 19, 184, 142, 203, 36, 43, 85, 26, 147, 227, 1

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/feross/buffer buffer && cd buffer
git checkout f52dffd9df0445b93c0c9065c2f8f0f46b2c729a
disclude scan --severity info --diff 2b1286b3e0c61f22d68c9f7bdca2c11012d87dfe .