Repository navigation
The kDisableNodeOptionsEnv option can be work around by using NODE_REPL_EXTERNAL_MODULE env #51227
Description
Node has an kDisableNodeOptionsEnv embedder flag that disables NODE_OPTIONS env to avoid injecting external code into apps, however it can be bypassed by using the NODE_REPL_EXTERNAL_MODULE env as reported by electron/electron#40770.
I understand kDisableNodeOptionsEnv only means to disable NODE_OPTIONS env, but if we don't also disable NODE_REPL_EXTERNAL_MODULE the protection would become meaningless.
I think we have 2 options to fix this:
- Disable
NODE_REPL_EXTERNAL_MODULEenv whenkDisableNodeOptionsEnvis used. - Deprecate
kDisableNodeOptionsEnvand add a new flag that disables all possible ways to inject code.
I wonder which one would be preferred by Node team. /cc @addaleax @joyeecheung @bnoordhuis
Activity
avivkeller commentedon Apr 26, 2024
@nodejs/security-wg
avivkeller commentedon Apr 26, 2024
Dotenv isn't the correct label (no dotenv file), buts AFAIK the closest to env variables
RafaelGSS commentedon Apr 29, 2024
@zcbenz While the first option is trivial I assume it will be a breaking change for all users that rely on the current behavior. I believe a new flag should be a safer approach. Honestly, I'm fine with both options.
cc: @nodejs/tsc
src: fix external module env and kDisableNodeOptionsEnv
src: fix external module env and kDisableNodeOptionsEnv
src: fix external module env and kDisableNodeOptionsEnv