buffer: make methods work on Uint8Array instances

Removes the reliance on prototype bound methods internally
so that Uint8Arrays can be set as the bound `this` value when calling
the various Buffer methods. Introduces some additional tamper protection
by removing internal reliance on writable properties.

Fixes: #56577
PR-URL: #56578
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Author: nbbeeken

doc/api/buffer.md

@@ -415,6 +415,21 @@ function:
 * [`Buffer.from(arrayBuffer[, byteOffset[, length]])`][`Buffer.from(arrayBuf)`]
 * [`Buffer.from(string[, encoding])`][`Buffer.from(string)`]
 
+### Buffer methods are callable with `Uint8Array` instances
+
+All methods on the Buffer prototype are callable with a `Uint8Array` instance.
+
+```js
+const { toString, write } = Buffer.prototype;
+
+const uint8array = new Uint8Array(5);
+
+write.call(uint8array, 'hello', 0, 5, 'utf8'); // 5
+// <Uint8Array 68 65 6c 6c 6f>
+
+toString.call(uint8array, 'utf8'); // 'hello'
+```
+
 ## Buffers and iteration
 
 `Buffer` instances can be iterated over using `for..of` syntax:
@@ -2058,6 +2073,10 @@ console.log(buf.fill('zz', 'hex'));
 
 <!-- YAML
 added: v5.3.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
 -->
 
 * `value` {string|Buffer|Uint8Array|integer} What to search for.
@@ -2945,10 +2964,14 @@ console.log(buf.readInt32LE(1));
 <!-- YAML
 added: v0.11.15
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
   - version: v10.0.0
     pr-url: https://github.com/nodejs/node/pull/18395
     description: Removed `noAssert` and no implicit coercion of the offset
                  and `byteLength` to `uint32` anymore.
+
 -->
 
 * `offset` {integer} Number of bytes to skip before starting to read. Must
@@ -2992,10 +3015,14 @@ console.log(buf.readIntBE(1, 0).toString(16));
 <!-- YAML
 added: v0.11.15
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
   - version: v10.0.0
     pr-url: https://github.com/nodejs/node/pull/18395
     description: Removed `noAssert` and no implicit coercion of the offset
                  and `byteLength` to `uint32` anymore.
+
 -->
 
 * `offset` {integer} Number of bytes to skip before starting to read. Must
@@ -3269,6 +3296,9 @@ console.log(buf.readUInt32LE(1).toString(16));
 <!-- YAML
 added: v0.11.15
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
   - version:
     - v14.9.0
     - v12.19.0
@@ -3319,6 +3349,9 @@ console.log(buf.readUIntBE(1, 6).toString(16));
 <!-- YAML
 added: v0.11.15
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
   - version:
     - v14.9.0
     - v12.19.0
@@ -3771,6 +3804,10 @@ console.log(copy);
 
 <!-- YAML
 added: v0.1.90
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
 -->
 
 * `encoding` {string} The character encoding to use. **Default:** `'utf8'`.
@@ -3909,6 +3946,10 @@ for (const value of buf) {
 
 <!-- YAML
 added: v0.1.90
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/56578
+    description: supports Uint8Array as `this` value.
 -->
 
 * `string` {string} String to write to `buf`.

lib/buffer.js

@@ -72,6 +72,17 @@ const {
   kStringMaxLength,
   atob: _atob,
   btoa: _btoa,
+  asciiSlice,
+  base64Slice,
+  base64urlSlice,
+  latin1Slice,
+  hexSlice,
+  ucs2Slice,
+  utf8Slice,
+  base64Write,
+  base64urlWrite,
+  hexWrite,
+  ucs2Write,
 } = internalBinding('buffer');
 const {
   constants: {
@@ -127,6 +138,9 @@ const {
   markAsUntransferable,
   addBufferPrototypeMethods,
   createUnsafeBuffer,
+  asciiWrite,
+  latin1Write,
+  utf8Write,
 } = require('internal/buffer');
 
 FastBuffer.prototype.constructor = Buffer;
@@ -634,44 +648,44 @@ const encodingOps = {
     encoding: 'utf8',
     encodingVal: encodingsMap.utf8,
     byteLength: byteLengthUtf8,
-    write: (buf, string, offset, len) => buf.utf8Write(string, offset, len),
-    slice: (buf, start, end) => buf.utf8Slice(start, end),
+    write: utf8Write,
+    slice: utf8Slice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfString(buf, val, byteOffset, encodingsMap.utf8, dir),
   },
   ucs2: {
     encoding: 'ucs2',
     encodingVal: encodingsMap.utf16le,
     byteLength: (string) => string.length * 2,
-    write: (buf, string, offset, len) => buf.ucs2Write(string, offset, len),
-    slice: (buf, start, end) => buf.ucs2Slice(start, end),
+    write: ucs2Write,
+    slice: ucs2Slice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfString(buf, val, byteOffset, encodingsMap.utf16le, dir),
   },
   utf16le: {
     encoding: 'utf16le',
     encodingVal: encodingsMap.utf16le,
     byteLength: (string) => string.length * 2,
-    write: (buf, string, offset, len) => buf.ucs2Write(string, offset, len),
-    slice: (buf, start, end) => buf.ucs2Slice(start, end),
+    write: ucs2Write,
+    slice: ucs2Slice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfString(buf, val, byteOffset, encodingsMap.utf16le, dir),
   },
   latin1: {
     encoding: 'latin1',
     encodingVal: encodingsMap.latin1,
     byteLength: (string) => string.length,
-    write: (buf, string, offset, len) => buf.latin1Write(string, offset, len),
-    slice: (buf, start, end) => buf.latin1Slice(start, end),
+    write: latin1Write,
+    slice: latin1Slice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfString(buf, val, byteOffset, encodingsMap.latin1, dir),
   },
   ascii: {
     encoding: 'ascii',
     encodingVal: encodingsMap.ascii,
     byteLength: (string) => string.length,
-    write: (buf, string, offset, len) => buf.asciiWrite(string, offset, len),
-    slice: (buf, start, end) => buf.asciiSlice(start, end),
+    write: asciiWrite,
+    slice: asciiSlice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfBuffer(buf,
                     fromStringFast(val, encodingOps.ascii),
@@ -683,8 +697,8 @@ const encodingOps = {
     encoding: 'base64',
     encodingVal: encodingsMap.base64,
     byteLength: (string) => base64ByteLength(string, string.length),
-    write: (buf, string, offset, len) => buf.base64Write(string, offset, len),
-    slice: (buf, start, end) => buf.base64Slice(start, end),
+    write: base64Write,
+    slice: base64Slice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfBuffer(buf,
                     fromStringFast(val, encodingOps.base64),
@@ -696,9 +710,8 @@ const encodingOps = {
     encoding: 'base64url',
     encodingVal: encodingsMap.base64url,
     byteLength: (string) => base64ByteLength(string, string.length),
-    write: (buf, string, offset, len) =>
-      buf.base64urlWrite(string, offset, len),
-    slice: (buf, start, end) => buf.base64urlSlice(start, end),
+    write: base64urlWrite,
+    slice: base64urlSlice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfBuffer(buf,
                     fromStringFast(val, encodingOps.base64url),
@@ -710,8 +723,8 @@ const encodingOps = {
     encoding: 'hex',
     encodingVal: encodingsMap.hex,
     byteLength: (string) => string.length >>> 1,
-    write: (buf, string, offset, len) => buf.hexWrite(string, offset, len),
-    slice: (buf, start, end) => buf.hexSlice(start, end),
+    write: hexWrite,
+    slice: hexSlice,
     indexOf: (buf, val, byteOffset, dir) =>
       indexOfBuffer(buf,
                     fromStringFast(val, encodingOps.hex),
@@ -836,7 +849,7 @@ Buffer.prototype.copy =
 // to their upper/lower bounds if the value passed is out of range.
 Buffer.prototype.toString = function toString(encoding, start, end) {
   if (arguments.length === 0) {
-    return this.utf8Slice(0, this.length);
+    return utf8Slice(this, 0, this.length);
   }
 
   const len = this.length;
@@ -857,7 +870,7 @@ Buffer.prototype.toString = function toString(encoding, start, end) {
     return '';
 
   if (encoding === undefined)
-    return this.utf8Slice(start, end);
+    return utf8Slice(this, start, end);
 
   const ops = getEncodingOps(encoding);
   if (ops === undefined)
@@ -888,7 +901,7 @@ Buffer.prototype[customInspectSymbol] = function inspect(recurseTimes, ctx) {
   const actualMax = MathMin(max, this.length);
   const remaining = this.length - max;
   let str = StringPrototypeTrim(RegExpPrototypeSymbolReplace(
-    /(.{2})/g, this.hexSlice(0, actualMax), '$1 '));
+    /(.{2})/g, hexSlice(this, 0, actualMax), '$1 '));
   if (remaining > 0)
     str += ` ... ${remaining} more byte${remaining > 1 ? 's' : ''}`;
   // Inspect special properties as well, if possible.
@@ -1027,7 +1040,7 @@ Buffer.prototype.lastIndexOf = function lastIndexOf(val, byteOffset, encoding) {
 };
 
 Buffer.prototype.includes = function includes(val, byteOffset, encoding) {
-  return this.indexOf(val, byteOffset, encoding) !== -1;
+  return bidirectionalIndexOf(this, val, byteOffset, encoding, true) !== -1;
 };
 
 // Usage:
@@ -1112,7 +1125,7 @@ function _fill(buf, value, offset, end, encoding) {
 Buffer.prototype.write = function write(string, offset, length, encoding) {
   // Buffer#write(string);
   if (offset === undefined) {
-    return this.utf8Write(string, 0, this.length);
+    return utf8Write(this, string, 0, this.length);
   }
   // Buffer#write(string, encoding)
   if (length === undefined && typeof offset === 'string') {
@@ -1139,9 +1152,9 @@ Buffer.prototype.write = function write(string, offset, length, encoding) {
   }
 
   if (!encoding || encoding === 'utf8')
-    return this.utf8Write(string, offset, length);
+    return utf8Write(this, string, offset, length);
   if (encoding === 'ascii')
-    return this.asciiWrite(string, offset, length);
+    return asciiWrite(this, string, offset, length);
 
   const ops = getEncodingOps(encoding);
   if (ops === undefined)