Skip to content

[stable33] fix(core): use btoa() instead of window.Buffer.from() for base64 encoding#60157

Merged
miaulalala merged 2 commits intostable33from
backport/60148/stable33
May 5, 2026
Merged

[stable33] fix(core): use btoa() instead of window.Buffer.from() for base64 encoding#60157
miaulalala merged 2 commits intostable33from
backport/60148/stable33

Conversation

@backportbot
Copy link
Copy Markdown

@backportbot backportbot Bot commented May 5, 2026

Backport of PR #60148

…ding

window.Buffer is a Node.js API that is not natively available in browsers.
It was apparently polyfilled in the webpack bundle by a dependency, but
the polyfill is absent in environments like headless Electron (Cypress).

This went undetected because browserslist-useragent-regexp < 4.1.4 had a
bug where an empty browser set produced /(?:)/ (matches everything). Electron
matched as "supported" and the redirect code was never reached.

browserslist-useragent-regexp 4.1.4 fixed that bug (PR #1583: faithfully
match an empty set of browsers), generating /[]/ instead. Electron 118 no
longer matches as supported, the redirect path is now exercised, and
window.Buffer.from() throws:

  TypeError: Cannot read properties of undefined (reading 'from')

The fix replaces window.Buffer.from(str).toString('base64') with the
native browser btoa(str), which has been universally available since
before our minimum browser support baseline and requires no polyfill.

Fixes: #57920

Signed-off-by: Anna Larch <anna@nextcloud.com>
@backportbot backportbot Bot requested a review from a team as a code owner May 5, 2026 07:32
@backportbot backportbot Bot added bug 3. to review Waiting for reviews AI assisted labels May 5, 2026
@backportbot backportbot Bot added this to the Nextcloud 33.0.4 milestone May 5, 2026
@backportbot backportbot Bot requested review from sorbaugh and szaimen and removed request for a team May 5, 2026 07:32
@miaulalala
Copy link
Copy Markdown
Contributor

/compile amend

Covers the main logic paths: supported browser (no redirect), unsupported
browser (redirect with btoa-encoded URL), already on the warning page
(no double redirect), and a no-throw guard that would have caught the
window.Buffer regression.

AI-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Anna Larch <anna@nextcloud.com>
Signed-off-by: nextcloud-command <nextcloud-command@users.noreply.github.com>
@nextcloud-command nextcloud-command force-pushed the backport/60148/stable33 branch from c45e6ff to 8950603 Compare May 5, 2026 07:42
@miaulalala miaulalala merged commit 912ae3f into stable33 May 5, 2026
191 of 197 checks passed
@miaulalala miaulalala deleted the backport/60148/stable33 branch May 5, 2026 14:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants