buffer 6.0.3

Source: https://github.com/feross/buffer
Commit scanned: f52dffd9df04 (recorded by npm)
Compared with: 2b1286b3e0c6 (0 signals introduced since)
Files: 71 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 42 info
Scan time: 5.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 8 of 8 warn and critical signals; 8 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 17:15

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info long-line perf/readUtf8.js:6:1

line length 1170 characters (raw pass, confidence 0.50)

var array = [ 152, 130, 206, 23, 243, 238, 197, 44, 27, 86, 208, 36, 163, 184, 164, 21, 94, 242, 178, 46, 25, 26, 253, 178, 72, 147, 207, 112, 236, 68, 179, 190, 29, 83, 239, 147, 125, 55, 143, 19, 157, 68, 157, 58, 212, 224, 150, 39, 128, 24, 94, 225, 120, 121, 75, 192, 112, 19, 184, 142, 203, 36, 43, 85, 26, 147, 227

info unicode-surrogate perf/writeUtf8.js:7:40

surrogate pair \uD944\uDC00 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
var singleByte = 'abcdefghi'
var multiByte = '\u0610' + '\u6100' + '\uD944\uDC00'

var browserBuffer = new BrowserBuffer(LENGTH)
```
info identifier-low-length test/compare.js:1:1

78 of 159 non-conventional identifiers are single-character (49%) (token pass, confidence 0.50)

info unicode-surrogate test/from-string.js:5:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:5:34

surrogate pair \uD83D\uDCAD (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:5:51

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:12:17

surrogate pair \uD842\uDFB7 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs over U+20000 until U+10FFFF', function (t) {
  const text = '\uD842\uDFB7' + '\uD93D\uDCAD' + '\uDBFF\uDFFF'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:12:34

surrogate pair \uD93D\uDCAD (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs over U+20000 until U+10FFFF', function (t) {
  const text = '\uD842\uDFB7' + '\uD93D\uDCAD' + '\uDBFF\uDFFF'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:12:51

surrogate pair \uDBFF\uDFFF (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('detect utf16 surrogate pairs over U+20000 until U+10FFFF', function (t) {
  const text = '\uD842\uDFB7' + '\uD93D\uDCAD' + '\uDBFF\uDFFF'
  const buf = new B(text)
  t.equal(text, buf.toString())

info unicode-surrogate test/from-string.js:19:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate lead code point', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:19:34

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

test('replace orphaned utf16 surrogate lead code point', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:19:45

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate lead code point', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:26:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate trail code point', function (t) {
  const text = '\uD83D\uDE38' + '\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:26:34

orphaned low surrogate \uDCAD (no preceding high surrogate) (token pass, confidence 0.65)

test('replace orphaned utf16 surrogate trail code point', function (t) {
  const text = '\uD83D\uDE38' + '\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:26:45

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('replace orphaned utf16 surrogate trail code point', function (t) {
  const text = '\uD83D\uDE38' + '\uDCAD' + '\uD83D\uDC4D'
  const buf = new B(text)
  t.deepEqual(buf, new B([0xf0, 0x9f, 0x98, 0xb8, 0xef, 0xbf, 0xbd, 0xf0, 0x9f, 0x91, 0x8d]))

info unicode-surrogate test/from-string.js:42:17

surrogate pair \uD83D\uDE38 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('handle partial utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDC4D'

  let buf = new B(8)

info unicode-surrogate test/from-string.js:42:34

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

test('handle partial utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = '\uD83D\uDE38' + '\uD83D\uDC4D'

  let buf = new B(8)

info unicode-surrogate test/from-string.js:88:23

orphaned low surrogate \uDE38 (no preceding high surrogate) (token pass, confidence 0.65)

test('handle invalid utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = 'a' + '\uDE38\uD83D' + 'b'

  let buf = new B(8)

info unicode-surrogate test/from-string.js:88:29

orphaned high surrogate \uD83D (no matching low surrogate) (token pass, confidence 0.65)

test('handle invalid utf16 code points when encoding to utf8 the way node does', function (t) {
  const text = 'a' + '\uDE38\uD83D' + 'b'

  let buf = new B(8)

info unicode-mixed-script test/node/test-buffer-alloc.js:157:25

identifier `hέlló` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
{
  const utf8String = '¡hέlló wôrld!';
  const offset = 100;
```

info unicode-surrogate test/node/test-buffer-alloc.js:272:26

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

{
  const f = Buffer.from('\uD83D\uDC4D', 'utf-16le'); // THUMBS UP SIGN (U+1F44D)
  assert.strictEqual(f.length, 4);
  assert.deepStrictEqual(f, Buffer.from('3DD84DDC', 'hex'));

info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:423:16

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw==', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.95 Base64 test vector in Node.js buffer allocation test asserting decoded length.
Reasoning
Raw base64 pass flagged a test literal decoded with Buffer.from and asserted to have length 32. This is a Node.js buffer test checking base64 decoding length; the blob is test data, not a payload.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:427:16

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw=', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.95 Base64 test vector with single padding checked for decoded length in Node core test.
Reasoning
Same pattern: base64 literal with padding decoded and length-asserted in a Node core test. Raw-pass base64 heuristic on test data with low ratio.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:435:16

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg==', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.95 Base64 test vector in Node buffer test asserting decoded length 31.
Reasoning
Base64 literal decoded and asserted to length 31 in a legitimate buffer test; context is clearly a test suite.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer-alloc.js:439:16

base64-like blob (43 bytes, compression ratio 1.26) (raw pass, confidence 0.60)
```
assert.strictEqual(
  Buffer.from('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg=', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.95 Padded base64 test vector in Node buffer test checking decoded length.
Reasoning
Padded base64 literal in a Node core buffer test with a length assertion; typical edge-case testing.

info unicode-surrogate test/node/test-buffer-alloc.js:729:30

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  // see https://codereview.chromium.org/121173009/
  const buf = Buffer.from('ab\ud800cd', 'utf8');
  assert.strictEqual(buf[0], 0x61);
  assert.strictEqual(buf[1], 0x62);

info unicode-homoglyph test/node/test-buffer-bytelength.js:75:39

identifier `κλμνξο` contains homoglyph candidates: κ (03BA)→k, ν (03BD)→v, ο (03BF)→o (in string/comment) (raw pass, confidence 0.35)

assert.strictEqual(Buffer.byteLength('∑éllö wørl∂!', 'utf-8'), 19);
assert.strictEqual(Buffer.byteLength('κλμνξο', 'utf8'), 12);
assert.strictEqual(Buffer.byteLength('挵挶挷挸挹', 'utf-8'), 15);
assert.strictEqual(Buffer.byteLength('𠝹𠱓𠱸', 'UTF8'), 12);

info unicode-mixed-script test/node/test-buffer-bytelength.js:75:39

identifier `κλμνξο` mixes scripts: Greek + Latin (in string/comment) (raw pass, confidence 0.40)

assert.strictEqual(Buffer.byteLength('∑éllö wørl∂!', 'utf-8'), 19);
assert.strictEqual(Buffer.byteLength('κλμνξο', 'utf8'), 12);
assert.strictEqual(Buffer.byteLength('挵挶挷挸挹', 'utf-8'), 15);
assert.strictEqual(Buffer.byteLength('𠝹𠱓𠱸', 'UTF8'), 12);

info unicode-mixed-script test/node/test-buffer-bytelength.js:80:39

identifier `𠱸挶νξ` mixes scripts: Other + Han + Greek (in string/comment) (raw pass, confidence 0.40)

assert.strictEqual(Buffer.byteLength('hey there'), 9);
assert.strictEqual(Buffer.byteLength('𠱸挶νξ#xx :)'), 17);
assert.strictEqual(Buffer.byteLength('hello world', ''), 11);
// it should also be assumed with unrecognized encoding

info unicode-mixed-script test/node/test-buffer.js:399:21

identifier `hέlló` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
var utf8String = '¡hέlló wôrld!';
var offset = 100;
```

info unicode-surrogate test/node/test-buffer.js:513:23

surrogate pair \uD83D\uDC4D (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)

{
  var f = new Buffer('\uD83D\uDC4D', 'utf-16le'); // THUMBS UP SIGN (U+1F44D)
  assert.equal(f.length, 4);
  assert.deepStrictEqual(f, new Buffer('3DD84DDC', 'hex'));

info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:650:15

base64-like blob (45 bytes, compression ratio 1.24) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw==', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.95 Base64 literal passed to deprecated new Buffer in a Node buffer test.
Reasoning
Legacy new Buffer call with a base64 test string and length assertion in Node's buffer test file; benign test data.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:654:15

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('72INjkR5fchcxk9+VgdGPFJDxUBFR5/rMFsghgxADiw=', 'base64').length,
  32
);
```
likely benign LLM, confidence 0.95 Base64 test vector with padding in Node buffer test asserting length.
Reasoning
Same benign test-vector pattern in Node's buffer test suite, checking decoded length.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:662:15

base64-like blob (44 bytes, compression ratio 1.25) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg==', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.95 Base64 test vector in Node buffer test asserting decoded length 31.
Reasoning
Base64 literal decoded and length-checked in a core test file; no execution or hiding behavior.
info ~~warn~~ → info by review encoding-base64 test/node/test-buffer.js:666:15

base64-like blob (43 bytes, compression ratio 1.26) (raw pass, confidence 0.60)
```
assert.equal(
  new Buffer('w69jACy6BgZmaFvv96HG6MYksWytuZu3T1FvGnulPg=', 'base64').length,
  31
);
```
likely benign LLM, confidence 0.95 Padded base64 test vector in Node buffer test checking decoded length.
Reasoning
Padded base64 literal in Node's buffer test with a length assertion; standard edge-case coverage.

info unicode-surrogate test/node/test-buffer.js:977:27

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  // see https://codereview.chromium.org/121173009/
  var buf = new Buffer('ab\ud800cd', 'utf8');
  assert.equal(buf[0], 0x61);
  assert.equal(buf[1], 0x62);

info unicode-mixed-script test/to-string.js:6:12

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
  t.equal(
    new B('Ձאab', 'utf8').toString('base64'),
    '1YHXkGFi'
  )
```
info unicode-mixed-script test/to-string.js:14:12

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
  t.equal(
    new B('Ձאab', 'utf8').toString('hex'),
    'd581d7906162'
  )
```
info unicode-mixed-script test/to-string.js:71:6

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
    new B('1YHXkGFi', 'base64').toString('utf8'),
    'Ձאab'
  )
  t.end()
```
info unicode-mixed-script test/to-string.js:79:6

identifier `Ձאab` mixes scripts: Armenian + Hebrew + Latin (in string/comment) (raw pass, confidence 0.40)
```
    new B('d581d7906162', 'hex').toString('utf8'),
    'Ձאab'
  )
  t.end()
```
info unicode-surrogate test/to-string.js:189:6

surrogate pair \uDBFC\uDC04 (non-scalar Unicode codepoints in string literal) (token pass, confidence 0.70)
```
    new B([0xF4, 0x8F, 0x80, 0x84]).toString(),
    '\uDBFC\uDC04'
  )
  t.equal(
```

info long-line test/to-string.js:204:1

line length 1179 characters (raw pass, confidence 0.50)

    new B([152, 130, 206, 23, 243, 238, 197, 44, 27, 86, 208, 36, 163, 184, 164, 21, 94, 242, 178, 46, 25, 26, 253, 178, 72, 147, 207, 112, 236, 68, 179, 190, 29, 83, 239, 147, 125, 55, 143, 19, 157, 68, 157, 58, 212, 224, 150, 39, 128, 24, 94, 225, 120, 121, 75, 192, 112, 19, 184, 142, 203, 36, 43, 85, 26, 147, 227, 1

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/feross/buffer buffer && cd buffer
git checkout f52dffd9df0445b93c0c9065c2f8f0f46b2c729a
disclude scan --severity info --diff 2b1286b3e0c61f22d68c9f7bdca2c11012d87dfe .