fix(js-x-ray): decode base64 in Buffer.from require specifiers

[VictorMartins3]

#handleBufferFrom only reads an ArrayExpression argument. The hex form never reaches it, since it is picked up earlier by the generic hex check on the first argument of any call, and atob has its own handler. That leaves base64 through Buffer.from as the one spelling with nothing behind it.

require(Buffer.from("68747470", "hex").toString())     // http
require(atob("aHR0cA=="))                              // http
require(Buffer.from("aHR0cA==", "base64").toString())  // nothing recorded

Buffer.from is the Node idiom here; atob is the browser one, so the gap is on the spelling more likely to show up in a package.

argument	resolved
Buffer.from([104, 116, 116, 112])	"http", already worked
Buffer.from("68747470", "hex")	"http", already worked
Buffer.from("aHR0cA==", "base64")	"http"
Buffer.from("not base64 at all!", "base64")	null

The last row is why it goes through the existing isStringBase64 rather than handing anything to Buffer.from: Node's base64 decoder is lenient and would happily turn arbitrary text into bytes, which would put junk in the dependency list.

Only base64 is added, not base64url, because isStringBase64 matches the +/ alphabet and would reject valid base64url. Happy to add it with its own check if you want it.

unsafe-import still fires, same as it does for the hex form, since the require is still dynamic. Two tests, one per new row.

[changeset-bot]

🦋 Changeset detected

Latest commit: 3ee8e79

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@nodesecure/js-x-ray	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR