pem.decode throws TypeError: str.charAt is not a function for Buffer input in 1.4.1 (breaks node-jose) #1165

Since 1.4.1, forge.pem.decode() throws when it gets a Buffer instead of a string. Up to 1.4.0, a Buffer was accepted because the regex-based parser converted it to a string. The new scanner from the PEM ReDoS fix (GHSA-7wch-p9px-956x) calls str.charAt() directly.

This breaks node-jose@2.2.0 (latest).

JWK.asKey(buffer, 'pem') passes the Buffer straight to forge.pem.decode (lib/jwk/keystore.js, fromPEM). @types/node-jose also declares Buffer as valid input there. node-forge is a ^1.x dependency of node-jose

Repro:

const { generateKeyPairSync } = require('crypto');
const jose = require('node-jose'); // 2.2.0

const { publicKey } = generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: { type: 'spki', format: 'pem' },
});

jose.JWK.asKey(Buffer.from(publicKey), 'pem').then(
  () => console.log('ok'),
  (e) => console.error(e), // 1.4.1: TypeError: str.charAt is not a function
);

Stack trace:

TypeError: str.charAt is not a function
    at labelAt (node_modules/node-forge/lib/pem.js:282:54)
    at _pemMessageScanner (node_modules/node-forge/lib/pem.js:321:20)
    at pem.decode (node_modules/node-forge/lib/pem.js:99:18)
    at fromPEM (node_modules/node-jose/lib/jwk/keystore.js:87:24)
    at JWKStore.value (node_modules/node-jose/lib/jwk/keystore.js:296:25)
    at JWKStore.asKey (node_modules/node-jose/lib/jwk/keystore.js:692:12)

Suggested fix: convert the input to a string at the start of pem.decode (e.g. str = String(str), or toString('binary') for Buffers) to restore the 1.4.0 behaviour.