[fix] Fixed uninitialized buffer vulnerability in base64 methods. (https://hackerone.com/reports/321701)

[ronperris]

Remediation

The source code in base64.js says that both encode¹ and decode² expect a string parameter. I see two obvious solutions.

1. Return null when base64.encode or base64.decode are given something other than a string.
2. Convert the parameter passed into base64.encode and base64.decode into a string before encoding or decoding.

To preserve backward compatibility with existing usage that might not be expecting null as a return value from encoding or decoding values that are not strings, I think we should covert the parameter to a string then perform that encode or decode operation.

¹ https://github.com/flatiron/utile/blob/master/lib/base64.js#L12
² https://github.com/flatiron/utile/blob/master/lib/base64.js#L30

[rjd40]

Any update on getting this PR merged? I'm unable to use this package because of this vulnerability.

[raphi]

@indexzero could you review this PR 🙏 As @rjd40 said, we are blocked by this security issue as well