src: allow --tls-cipher-list in NODE_OPTIONS

Backport-PR-URL: #12677
PR-URL: #13172
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

doc/api/cli.md

@@ -356,6 +356,7 @@ Node options that are allowed are:
 - `--redirect-warnings`
 - `--require`, `-r`
 - `--throw-deprecation`
+- `--tls-cipher-list`
 - `--trace-deprecation`
 - `--trace-sync-io`
 - `--trace-warnings`

src/node.cc

@@ -3786,7 +3786,7 @@ static void CheckIfAllowedInEnv(const char* exe, bool is_env,
   size_t arglen = eq ? eq - arg : strlen(arg);
 
   static const char* whitelist[] = {
-    // Node options
+    // Node options, sorted in `node --help` order for ease of comparison.
     "--require", "-r",
     "--debug",
     "--debug-brk",
@@ -3802,6 +3802,7 @@ static void CheckIfAllowedInEnv(const char* exe, bool is_env,
     "--track-heap-objects",
     "--zero-fill-buffers",
     "--v8-pool-size",
+    "--tls-cipher-list",
     "--use-bundled-ca",
     "--use-openssl-ca",
     "--enable-fips",