[fix] Fixed uninitialized buffer vulnerability in base64 methods. (https://hackerone.com/reports/321701)

lib/base64.js

@@ -16,7 +16,7 @@ base64.encode = function (unencoded) {
   var encoded;
 
   try {
-    encoded = new Buffer(unencoded || '').toString('base64');
+    encoded = new Buffer(unencoded ? String(unencoded) : '').toString('base64');
   }
   catch (ex) {
     return null;
@@ -34,7 +34,7 @@ base64.decode = function (encoded) {
   var decoded;
 
   try {
-    decoded = new Buffer(encoded || '', 'base64').toString('utf8');
+    decoded = new Buffer(encoded ? String(encoded) : '', 'base64').toString('utf8');
   }
   catch (ex) {
     return null;

package.json

@@ -1,7 +1,7 @@
 {
   "name": "utile",
   "description": "A drop-in replacement for `util` with some additional advantageous functions",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "author": "Nodejitsu Inc. <info@nodejitsu.com>",
   "maintainers": [
     "indexzero <charlie@nodejitsu.com>"

test/base64-test.js

@@ -0,0 +1,17 @@
+var assert = require('assert'),
+    vows = require('vows'),
+    utile = require('../lib/');
+
+
+vows.describe('utile/base64').addBatch({
+
+  'Should treat input as a string for encode().': function() {
+    assert.equal(utile.base64.encode('200'), utile.base64.encode(200))
+    assert.equal(utile.base64.encode('100000000'), utile.base64.encode(1e8))
+  },
+
+  'Should treat input as a string for decode().': function() {
+    assert.equal(utile.base64.decode('MTAw'), 100)
+  }
+
+}).export(module);