Skip to content

Commit 34e8eb6

Browse files
committed
src: allow CLI args in env with NODE_OPTIONS
Not all CLI options are supported, those that are problematic from a security or implementation point of view are disallowed, as are ones that are inappropriate (for example, -e, -p, --i), or that only make sense when changed with code changes (such as options that change the javascript syntax or add new APIs). PR-URL: #12028 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Refael Ackermann <[email protected]> Reviewed-By: Gibson Fahnestock <[email protected]> Reviewed-By: Bradley Farias <[email protected]>
1 parent 50e60e9 commit 34e8eb6

File tree

6 files changed

+261
-38
lines changed

6 files changed

+261
-38
lines changed

configure

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,6 +432,11 @@ parser.add_option('--without-ssl',
432432
dest='without_ssl',
433433
help='build without SSL')
434434

435+
parser.add_option('--without-node-options',
436+
action='store_true',
437+
dest='without_node_options',
438+
help='build without NODE_OPTIONS support')
439+
435440
parser.add_option('--xcode',
436441
action='store_true',
437442
dest='use_xcode',
@@ -965,6 +970,9 @@ def configure_openssl(o):
965970
o['variables']['openssl_no_asm'] = 1 if options.openssl_no_asm else 0
966971
if options.use_openssl_ca_store:
967972
o['defines'] += ['NODE_OPENSSL_CERT_STORE']
973+
o['variables']['node_without_node_options'] = b(options.without_node_options)
974+
if options.without_node_options:
975+
o['defines'] += ['NODE_WITHOUT_NODE_OPTIONS']
968976
if options.openssl_fips:
969977
o['variables']['openssl_fips'] = options.openssl_fips
970978
fips_dir = os.path.join(root_dir, 'deps', 'openssl', 'fips')

doc/api/cli.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -365,6 +365,40 @@ added: v7.5.0
365365

366366
When set to `1`, process warnings are silenced.
367367

368+
### `NODE_OPTIONS=options...`
369+
<!-- YAML
370+
added: REPLACEME
371+
-->
372+
373+
`options...` are interpreted as if they had been specified on the command line
374+
before the actual command line (so they can be overriden). Node will exit with
375+
an error if an option that is not allowed in the environment is used, such as
376+
`-p` or a script file.
377+
378+
Node options that are allowed are:
379+
- `--enable-fips`
380+
- `--force-fips`
381+
- `--icu-data-dir`
382+
- `--no-deprecation`
383+
- `--no-warnings`
384+
- `--openssl-config`
385+
- `--prof-process`
386+
- `--redirect-warnings`
387+
- `--require`, `-r`
388+
- `--throw-deprecation`
389+
- `--trace-deprecation`
390+
- `--trace-events-enabled`
391+
- `--trace-sync-io`
392+
- `--trace-warnings`
393+
- `--track-heap-objects`
394+
- `--use-bundled-ca`
395+
- `--use-openssl-ca`
396+
- `--v8-pool-size`
397+
- `--zero-fill-buffers`
398+
399+
V8 options that are allowed are:
400+
- `--max_old_space_size`
401+
368402
### `NODE_PRESERVE_SYMLINKS=1`
369403
<!-- YAML
370404
added: v7.1.0

doc/node.1

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,13 @@ with small\-icu support.
237237
.BR NODE_NO_WARNINGS =\fI1\fR
238238
When set to \fI1\fR, process warnings are silenced.
239239

240+
.TP
241+
.BR NODE_OPTIONS =\fIoptions...\fR
242+
\fBoptions...\fR are interpreted as if they had been specified on the command
243+
line before the actual command line (so they can be overriden). Node will exit
244+
with an error if an option that is not allowed in the environment is used, such
245+
as \fB-p\fR or a script file.
246+
240247
.TP
241248
.BR NODE_PATH =\fIpath\fR[:\fI...\fR]
242249
\':\'\-separated list of directories prefixed to the module search path.

src/node.cc

Lines changed: 133 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -3552,6 +3552,9 @@ static void PrintHelp() {
35523552
#endif
35533553
#endif
35543554
"NODE_NO_WARNINGS set to 1 to silence process warnings\n"
3555+
#if !defined(NODE_WITHOUT_NODE_OPTIONS)
3556+
"NODE_OPTIONS set CLI options in the environment\n"
3557+
#endif
35553558
#ifdef _WIN32
35563559
"NODE_PATH ';'-separated list of directories\n"
35573560
#else
@@ -3566,6 +3569,51 @@ static void PrintHelp() {
35663569
}
35673570

35683571

3572+
static void CheckIfAllowedInEnv(const char* exe, bool is_env,
3573+
const char* arg) {
3574+
if (!is_env)
3575+
return;
3576+
3577+
// Find the arg prefix when its --some_arg=val
3578+
const char* eq = strchr(arg, '=');
3579+
size_t arglen = eq ? eq - arg : strlen(arg);
3580+
3581+
static const char* whitelist[] = {
3582+
// Node options
3583+
"-r", "--require",
3584+
"--no-deprecation",
3585+
"--no-warnings",
3586+
"--trace-warnings",
3587+
"--redirect-warnings",
3588+
"--trace-deprecation",
3589+
"--trace-sync-io",
3590+
"--trace-events-enabled",
3591+
"--track-heap-objects",
3592+
"--throw-deprecation",
3593+
"--zero-fill-buffers",
3594+
"--v8-pool-size",
3595+
"--use-openssl-ca",
3596+
"--use-bundled-ca",
3597+
"--enable-fips",
3598+
"--force-fips",
3599+
"--openssl-config",
3600+
"--icu-data-dir",
3601+
3602+
// V8 options
3603+
"--max_old_space_size",
3604+
};
3605+
3606+
for (unsigned i = 0; i < arraysize(whitelist); i++) {
3607+
const char* allowed = whitelist[i];
3608+
if (strlen(allowed) == arglen && strncmp(allowed, arg, arglen) == 0)
3609+
return;
3610+
}
3611+
3612+
fprintf(stderr, "%s: %s is not allowed in NODE_OPTIONS\n", exe, arg);
3613+
exit(9);
3614+
}
3615+
3616+
35693617
// Parse command line arguments.
35703618
//
35713619
// argv is modified in place. exec_argv and v8_argv are out arguments that
@@ -3582,7 +3630,8 @@ static void ParseArgs(int* argc,
35823630
int* exec_argc,
35833631
const char*** exec_argv,
35843632
int* v8_argc,
3585-
const char*** v8_argv) {
3633+
const char*** v8_argv,
3634+
bool is_env) {
35863635
const unsigned int nargs = static_cast<unsigned int>(*argc);
35873636
const char** new_exec_argv = new const char*[nargs];
35883637
const char** new_v8_argv = new const char*[nargs];
@@ -3609,6 +3658,8 @@ static void ParseArgs(int* argc,
36093658
const char* const arg = argv[index];
36103659
unsigned int args_consumed = 1;
36113660

3661+
CheckIfAllowedInEnv(argv[0], is_env, arg);
3662+
36123663
if (debug_options.ParseOption(arg)) {
36133664
// Done, consumed by DebugOptions::ParseOption().
36143665
} else if (strcmp(arg, "--version") == 0 || strcmp(arg, "-v") == 0) {
@@ -3737,6 +3788,13 @@ static void ParseArgs(int* argc,
37373788

37383789
// Copy remaining arguments.
37393790
const unsigned int args_left = nargs - index;
3791+
3792+
if (is_env && args_left) {
3793+
fprintf(stderr, "%s: %s is not supported in NODE_OPTIONS\n",
3794+
argv[0], argv[index]);
3795+
exit(9);
3796+
}
3797+
37403798
memcpy(new_argv + new_argc, argv + index, args_left * sizeof(*argv));
37413799
new_argc += args_left;
37423800

@@ -4180,6 +4238,54 @@ inline void PlatformInit() {
41804238
}
41814239

41824240

4241+
void ProcessArgv(int* argc,
4242+
const char** argv,
4243+
int* exec_argc,
4244+
const char*** exec_argv,
4245+
bool is_env = false) {
4246+
// Parse a few arguments which are specific to Node.
4247+
int v8_argc;
4248+
const char** v8_argv;
4249+
ParseArgs(argc, argv, exec_argc, exec_argv, &v8_argc, &v8_argv, is_env);
4250+
4251+
// TODO(bnoordhuis) Intercept --prof arguments and start the CPU profiler
4252+
// manually? That would give us a little more control over its runtime
4253+
// behavior but it could also interfere with the user's intentions in ways
4254+
// we fail to anticipate. Dillema.
4255+
for (int i = 1; i < v8_argc; ++i) {
4256+
if (strncmp(v8_argv[i], "--prof", sizeof("--prof") - 1) == 0) {
4257+
v8_is_profiling = true;
4258+
break;
4259+
}
4260+
}
4261+
4262+
#ifdef __POSIX__
4263+
// Block SIGPROF signals when sleeping in epoll_wait/kevent/etc. Avoids the
4264+
// performance penalty of frequent EINTR wakeups when the profiler is running.
4265+
// Only do this for v8.log profiling, as it breaks v8::CpuProfiler users.
4266+
if (v8_is_profiling) {
4267+
uv_loop_configure(uv_default_loop(), UV_LOOP_BLOCK_SIGNAL, SIGPROF);
4268+
}
4269+
#endif
4270+
4271+
// The const_cast doesn't violate conceptual const-ness. V8 doesn't modify
4272+
// the argv array or the elements it points to.
4273+
if (v8_argc > 1)
4274+
V8::SetFlagsFromCommandLine(&v8_argc, const_cast<char**>(v8_argv), true);
4275+
4276+
// Anything that's still in v8_argv is not a V8 or a node option.
4277+
for (int i = 1; i < v8_argc; i++) {
4278+
fprintf(stderr, "%s: bad option: %s\n", argv[0], v8_argv[i]);
4279+
}
4280+
delete[] v8_argv;
4281+
v8_argv = nullptr;
4282+
4283+
if (v8_argc > 1) {
4284+
exit(9);
4285+
}
4286+
}
4287+
4288+
41834289
void Init(int* argc,
41844290
const char** argv,
41854291
int* exec_argc,
@@ -4222,31 +4328,36 @@ void Init(int* argc,
42224328
if (openssl_config.empty())
42234329
SafeGetenv("OPENSSL_CONF", &openssl_config);
42244330

4225-
// Parse a few arguments which are specific to Node.
4226-
int v8_argc;
4227-
const char** v8_argv;
4228-
ParseArgs(argc, argv, exec_argc, exec_argv, &v8_argc, &v8_argv);
4229-
4230-
// TODO(bnoordhuis) Intercept --prof arguments and start the CPU profiler
4231-
// manually? That would give us a little more control over its runtime
4232-
// behavior but it could also interfere with the user's intentions in ways
4233-
// we fail to anticipate. Dillema.
4234-
for (int i = 1; i < v8_argc; ++i) {
4235-
if (strncmp(v8_argv[i], "--prof", sizeof("--prof") - 1) == 0) {
4236-
v8_is_profiling = true;
4237-
break;
4331+
#if !defined(NODE_WITHOUT_NODE_OPTIONS)
4332+
std::string node_options;
4333+
if (SafeGetenv("NODE_OPTIONS", &node_options)) {
4334+
// Smallest tokens are 2-chars (a not space and a space), plus 2 extra
4335+
// pointers, for the prepended executable name, and appended NULL pointer.
4336+
size_t max_len = 2 + (node_options.length() + 1) / 2;
4337+
const char** argv_from_env = new const char*[max_len];
4338+
int argc_from_env = 0;
4339+
// [0] is expected to be the program name, fill it in from the real argv.
4340+
argv_from_env[argc_from_env++] = argv[0];
4341+
4342+
char* cstr = strdup(node_options.c_str());
4343+
char* initptr = cstr;
4344+
char* token;
4345+
while ((token = strtok(initptr, " "))) { // NOLINT(runtime/threadsafe_fn)
4346+
initptr = nullptr;
4347+
argv_from_env[argc_from_env++] = token;
42384348
}
4239-
}
4240-
4241-
#ifdef __POSIX__
4242-
// Block SIGPROF signals when sleeping in epoll_wait/kevent/etc. Avoids the
4243-
// performance penalty of frequent EINTR wakeups when the profiler is running.
4244-
// Only do this for v8.log profiling, as it breaks v8::CpuProfiler users.
4245-
if (v8_is_profiling) {
4246-
uv_loop_configure(uv_default_loop(), UV_LOOP_BLOCK_SIGNAL, SIGPROF);
4349+
argv_from_env[argc_from_env] = nullptr;
4350+
int exec_argc_;
4351+
const char** exec_argv_ = nullptr;
4352+
ProcessArgv(&argc_from_env, argv_from_env, &exec_argc_, &exec_argv_, true);
4353+
delete[] exec_argv_;
4354+
delete[] argv_from_env;
4355+
free(cstr);
42474356
}
42484357
#endif
42494358

4359+
ProcessArgv(argc, argv, exec_argc, exec_argv);
4360+
42504361
#if defined(NODE_HAVE_I18N_SUPPORT)
42514362
// If the parameter isn't given, use the env variable.
42524363
if (icu_data_dir.empty())
@@ -4258,21 +4369,6 @@ void Init(int* argc,
42584369
"(check NODE_ICU_DATA or --icu-data-dir parameters)");
42594370
}
42604371
#endif
4261-
// The const_cast doesn't violate conceptual const-ness. V8 doesn't modify
4262-
// the argv array or the elements it points to.
4263-
if (v8_argc > 1)
4264-
V8::SetFlagsFromCommandLine(&v8_argc, const_cast<char**>(v8_argv), true);
4265-
4266-
// Anything that's still in v8_argv is not a V8 or a node option.
4267-
for (int i = 1; i < v8_argc; i++) {
4268-
fprintf(stderr, "%s: bad option: %s\n", argv[0], v8_argv[i]);
4269-
}
4270-
delete[] v8_argv;
4271-
v8_argv = nullptr;
4272-
4273-
if (v8_argc > 1) {
4274-
exit(9);
4275-
}
42764372

42774373
// Unconditionally force typed arrays to allocate outside the v8 heap. This
42784374
// is to prevent memory pointers from being moved around that are returned by
Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
'use strict';
2+
const common = require('../common');
3+
if (process.config.variables.node_without_node_options)
4+
return common.skip('missing NODE_OPTIONS support');
5+
6+
// Test options specified by env variable.
7+
8+
const assert = require('assert');
9+
const exec = require('child_process').execFile;
10+
11+
disallow('--version');
12+
disallow('-v');
13+
disallow('--help');
14+
disallow('-h');
15+
disallow('--eval');
16+
disallow('-e');
17+
disallow('--print');
18+
disallow('-p');
19+
disallow('-pe');
20+
disallow('--check');
21+
disallow('-c');
22+
disallow('--interactive');
23+
disallow('-i');
24+
disallow('--v8-options');
25+
disallow('--');
26+
27+
function disallow(opt) {
28+
const options = {env: {NODE_OPTIONS: opt}};
29+
exec(process.execPath, options, common.mustCall(function(err) {
30+
const message = err.message.split(/\r?\n/)[1];
31+
const expect = process.execPath + ': ' + opt +
32+
' is not allowed in NODE_OPTIONS';
33+
34+
assert.strictEqual(err.code, 9);
35+
assert.strictEqual(message, expect);
36+
}));
37+
}
38+
39+
const printA = require.resolve('../fixtures/printA.js');
40+
41+
expect('-r ' + printA, 'A\nB\n');
42+
expect('--no-deprecation', 'B\n');
43+
expect('--no-warnings', 'B\n');
44+
expect('--trace-warnings', 'B\n');
45+
expect('--redirect-warnings=_', 'B\n');
46+
expect('--trace-deprecation', 'B\n');
47+
expect('--trace-sync-io', 'B\n');
48+
expect('--trace-events-enabled', 'B\n');
49+
expect('--track-heap-objects', 'B\n');
50+
expect('--throw-deprecation', 'B\n');
51+
expect('--zero-fill-buffers', 'B\n');
52+
expect('--v8-pool-size=10', 'B\n');
53+
expect('--use-openssl-ca', 'B\n');
54+
expect('--use-bundled-ca', 'B\n');
55+
expect('--openssl-config=_ossl_cfg', 'B\n');
56+
expect('--icu-data-dir=_d', 'B\n');
57+
58+
// V8 options
59+
expect('--max_old_space_size=0', 'B\n');
60+
61+
function expect(opt, want) {
62+
const printB = require.resolve('../fixtures/printB.js');
63+
const argv = [printB];
64+
const opts = {
65+
env: {NODE_OPTIONS: opt},
66+
maxBuffer: 1000000000,
67+
};
68+
exec(process.execPath, argv, opts, common.mustCall(function(err, stdout) {
69+
assert.ifError(err);
70+
if (!RegExp(want).test(stdout)) {
71+
console.error('For %j, failed to find %j in: <\n%s\n>',
72+
opt, expect, stdout);
73+
assert(false, 'Expected ' + expect);
74+
}
75+
}));
76+
}

0 commit comments

Comments
 (0)