Underlying dependency urlsafe-base64 uses Buffer unsafely #785
Description
NOTE: Please test in a least two browsers (i.e. Chrome and Firefox). This
helps with diagnosing problems quicker.
Setup
Please provide the following details, the more info you can provide the
better.
Operating System: Amazon Linux 2
Node Version: 18.15.0
web-push Version: 3.5.0
Please select any browsers that you are experiencing problems with:
- [X ] Chrome
- [X ] Firefox
- [X ] Opera for Android
- Samsung Internet Browser
- Other
Please list the browsers you are have tested this, including the version
of the browser (i.e. Chrome Beta, Firefox Beta etc).
All Browsers
Problem
When calling setVapidDetails in Node18 I see the following console error:
ERROR (node:14) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
at showFlaggedDeprecation (node:buffer:195:11)
at new Buffer (node:buffer:279:3)
at Object.decode (/var/task/index.js:490:68353)
at Object.validatePublicKey (/var/task/index.js:493:8952)
at Qxe.setVapidDetails (/var/task/index.js:493:19995)
at setVapidDetails (/var/task/index.js:497:4174)
...
Doing some debugging the cause of this is because the underlying library: urlsafe-base64 has not updated to using Buffer.from(). While there are already PRs to fix this, the maintainers seem to have abandoned the project. Would it be possible to fork the implementation of urlsafe-base64 and consume a patched version within web-push?
Expected
No console errors
Features Used
- [X ] VAPID Support
- GCM API Key
- Sending with Payload
Example / Reproduce Case
Please provide a code sample that reproduces the issue. If there is a
repository that reproduces the issue please put the link here.
import webpush from "web-push";
webpush.setVapidDetails(WEB_PUSH_API_SUBJECT, vapidDetails.publicKey, vapidDetails.privateKey);