TextEncoder from node:util in pre-script are not generating Uint8Array

[sbahloul]

Hello,

First of all thank you for the amazing tool !

While trying to implement DPoP through jose js lib, it seems that the TextEncoder from the node:util is not generating a Uint8Array as it should. It is a problem for the jose js lib as it is trying to convert the payload and then the data to sign to Uint8Array before signing calling the actual signature function: https://github.com/panva/jose/blob/main/src/jws/flattened/sign.ts#L6

I tried to use the text-encoding polyfill which worked in my script, but unless I rebuild the jose lib to force the use of this polyfill, it is unusable. Any idea how this can be circumvented ?

Thanks,

[imhoffd]

Running into this as well.

I noticed that within Bruno's VM, TextEncoder instances appear to generate objects with numeric keys instead of proper Uint8Array instances. The following code has different output depending on whether it is run within Bruno or, frankly, anywhere else.

Node 18 ✅

const payload = new TextEncoder().encode('hi')

console.log(payload)
// Uint8Array(2) [ 104, 105 ]

Node 18 (using util) ✅

const util = require('node:util')
const payload = new util.TextEncoder().encode('hi')

console.log(payload)
// Uint8Array(2) [ 104, 105 ]

Node VM ✅

const vm = require('node:vm')
const util = require('node:util')
const output = {}
const context = vm.createContext({ output, util })

vm.runInContext(`output.text = new util.TextEncoder().encode('hi')`, context)

console.log(output.text)
// Uint8Array(2) [ 104, 105 ]

Bruno ❌

const util = require('node:util');

const payload = new util.TextEncoder().encode('hi')

console.log(payload)
// { '0': 104, '1': 105 }

[imhoffd]

Might it be an issue with the vm2 library? I don't know all the details, but it appears to be a discontinued project and their readme warns of critical security issues. cc @helloanoop

This is a blocker for us as Uint8Array is a foundational tool for working with binary data in JavaScript, and using a TextEncoder to create one is a very standard method of creating one. In addition, as @sbahloul mentioned, this makes signing JWTs using Jose impossible, which means Bruno does not support a leading library for JSON signing/encryption.