---
title: Avoid Buffer(argument) with non-literal values
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST
  Rules > Avoid Buffer(argument) with non-literal values
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Avoid Buffer(argument) with non-literal values

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**ID:** `typescript-node-security/detect-new-buffer`

**Language:** TypeScript

**Severity:** Warning

**Category:** Security

**CWE**: [400](https://cwe.mitre.org/data/definitions/400.html)

## Description{% #description %}

Dealing with binary data can achieved with Node.js Buffer class, however if used with non literal params it could lead to an attack as the attacker might control the value of the provided parameter.

For example a large number could allocate a large amount of memory leading to a denial of service attack. It is recommended to use literal values you can control to prevent attacks.

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```typescript
var a = new Buffer(c)
```

## Compliant Code Examples{% #compliant-code-examples %}

```typescript
var a = new Buffer('test')
```
  Seamless integrations. Try Datadog Code SecurityDatadog Code Security 
{% icon name="icon-external-link" /%}