buffer: add Buffer.harden() method

doc/api/buffer.md

@@ -919,6 +919,54 @@ const buf = Buffer.from(new Foo(), 'utf8');
 A `TypeError` will be thrown if `object` has not mentioned methods or is not of
 other type appropriate for `Buffer.from()` variants.
 
+### Class Method: Buffer.harden([options])
+<!-- YAML
+added: TODO
+-->
+
+> Stability: 1 - Experimental
+
+* `options` {Object}
+ * `zeroFill` {boolean}
+ If `true`, all future `Buffer` instances, even the ones created with
+ `Buffer.allocUnsafe`, will be zero-filled by default.
+ **Default:** `true`.
+ * `disablePool` {boolean}
+ If `true`, all future `Buffer` allocations will not be pooled and their
+ underlying `ArrayBuffer` will have the same size as `Buffer` instance.
+ **Default:** `true`.
+ * `throwOnUnsafe` {boolean}
+ If `true`, unsafe `Buffer(arg)` API will throw instead of showing a
+ deprecation warning.
+ Otherwise, if `false`, first call to unsafe `Buffer(arg)` will trigger a
+ deprecation warning, regardless of whether it was called from inside of
+ `node_modules` directory or not (unlike the default warning).
+ **Default:** `true`.
+ * `freeze` {boolean}
+ If `true`, `Buffer` and `require('buffer')` objects are frozen and can
+ not be monkey-patched.
+ `Buffer.prototype` is not frozen for compatibility reasons.
+ **Default:** `true`.
+
+Calling `Buffer.harden()` enables additional security measures for Buffer API,
+disabling some trade-offs between security and performance/compatibility that
+are present by default.
+
+This method has effect only of subsequent Buffer API usage, Buffer instances
+created before `Buffer.harden()` is called are not affected.
+
+Warning: for ecosystem compatibility and security reasons `Buffer.harden()` can
+be called only once and only from the top-level application code and only before
+the first turn of the event loop. Attempting to call it asynchronously in
+runtime or from a library in `node_modules` will throw.
+
+By default, it enables mandratory zero fill, disables Buffer pooling, disables
+deprecated unsafe Buffer API, freezes `Buffer` and `require('buffer')` objects.
+
+The exact behaviour could be fine-tuned: for example, to still allow unsafe
+Buffer API for compatibility reasons (e.g. if that us required by application
+dependencies), `Buffer.harden({ throwOnUnsafe: false })` could be used.
+
 ### Class Method: Buffer.from(string[, encoding])
 <!-- YAML
 added: v5.10.0

lib/buffer.js

@@ -63,6 +63,7 @@ const {
 
 const {
  codes: {
+ ERR_ASSERTION,
  ERR_BUFFER_OUT_OF_BOUNDS,
  ERR_INVALID_ARG_TYPE,
  ERR_INVALID_ARG_VALUE,
@@ -109,8 +110,18 @@ let poolSize, poolOffset, allocPool;
 // do not own the ArrayBuffer allocator. Zero fill is always on in that case.
 const zeroFill = bindingZeroFill || [0];
 
+// Hardening Buffer enables disables unsafe Buffer API, disables pooling,
+// and enables mandratory zero-fill. This is more secure, but has potential
+// performance and compatibility impact, depending on the usecase.
+const hardened = {
+ applied: false,
+ zeroFill: false,
+ disablePool: false,
+ throwOnUnsafe: false,
+};
+
 function createUnsafeBuffer(size) {
- zeroFill[0] = 0;
+ zeroFill[0] = hardened.zeroFill ? 1 : 0;
  try {
  return new FastBuffer(size);
  } finally {
@@ -140,6 +151,18 @@ const bufferWarning = 'Buffer() is deprecated due to security and usability ' +
  'Buffer.allocUnsafe(), or Buffer.from() methods instead.';
 
 function showFlaggedDeprecation() {
+ if (hardened.applied) {
+ if (hardened.throwOnUnsafe) {
+ throw new ERR_ASSERTION(
+ 'Unsafe Buffer() API is forbidden by Buffer strict hardening opt-in.'
+ );
+ }
+ if (bufferWarningAlreadyEmitted) return;
+ process.emitWarning(bufferWarning, 'DeprecationWarning', 'DEP0005');
+ bufferWarningAlreadyEmitted = true;
+ return;
+ }
+
  if (bufferWarningAlreadyEmitted ||
  ++nodeModulesCheckCounter > 10000 ||
  (!require('internal/options').getOptionValue('--pending-deprecation') &&
@@ -157,6 +180,50 @@ function showFlaggedDeprecation() {
  bufferWarningAlreadyEmitted = true;
 }
 
+// Calling this method does not affect existing buffers, only new ones.
+Buffer.harden = function({
+ zeroFill = true,
+ disablePool = true,
+ throwOnUnsafe = true,
+ freeze = true,
+} = {}) {
+ if (hardened.applied) {
+ // So that params are not changed afterwards
+ throw new ERR_ASSERTION(
+ 'Buffer.harden can be called only once'
+ );
+ }
+ if (isInsideNodeModules()) {
+ throw new ERR_ASSERTION(
+ 'Buffer.harden() should be called only from the top-level module. ' +
+ 'Calling Buffer.harden() from dependencies is not supported.'
+ );
+ }
+ const perf_hooks = require('perf_hooks');
+ const stillSynchronous = perf_hooks.performance.nodeTiming.loopStart < 0;
+ if (!stillSynchronous) throw new ERR_ASSERTION(
+ 'Buffer.harden() should be called only in synchronous mode, during app ' +
+ 'startup. Calling Buffer.harden() asynchronously is not supported.'
+ );
+ Object.assign(hardened, {
+ applied: true,
+ zeroFill: Boolean(zeroFill),
+ disablePool: Boolean(disablePool),
+ throwOnUnsafe: Boolean(throwOnUnsafe),
+ });
+ if (disablePool) {
+ Object.defineProperty(Buffer, 'poolSize', {
+ enumerable: true,
+ get: () => 0,
+ set: () => {},
+ });
+ }
+ if (freeze) {
+ Object.freeze(Buffer);
+ Object.freeze(module.exports);
+ }
+};
+
 function toInteger(n, defaultVal) {
  n = +n;
  if (!Number.isNaN(n) &&
@@ -365,7 +432,7 @@ function allocate(size) {
  if (size <= 0) {
  return new FastBuffer();
  }
- if (size < (Buffer.poolSize >>> 1)) {
+ if (size < (Buffer.poolSize >>> 1) && !hardened.disablePool) {
  if (size > (poolSize - poolOffset))
  createPool();
  const b = new FastBuffer(allocPool, poolOffset, size);