From 3b79e9c24ead8135788ccc6b5318aa589df88011 Mon Sep 17 00:00:00 2001
From: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date: Thu, 23 May 2024 15:41:55 -0300
Subject: [PATCH] src: fix external module env and kDisableNodeOptionsEnv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR-URL: https://github.com/nodejs/node/pull/52905
Fixes: https://github.com/nodejs/node/issues/51227
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
---
 doc/api/cli.md                   |  7 +++++++
 src/node.cc                      |  9 +++++++++
 test/embedding/embedtest.cc      | 11 +++++++++--
 test/embedding/test-embedding.js | 18 ++++++++++++++++++
 4 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 472f786d8cc7d7..18d8ff747cd310 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -2732,6 +2732,13 @@ equivalent to using the `--redirect-warnings=file` command-line flag.
 added:
  - v13.0.0
  - v12.16.0
+changes:
+  - version:
+     - REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/52905
+    description:
+      Remove the possibility to use this env var with
+      kDisableNodeOptionsEnv for embedders.
 -->
 
 Path to a Node.js module which will be loaded in place of the built-in REPL.
diff --git a/src/node.cc b/src/node.cc
index bc7720ae819768..95d2ffa49370f3 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -919,6 +919,15 @@ static ExitCode InitializeNodeWithArgsInternal(
           &env_argv, nullptr, errors, kAllowedInEnvvar);
       if (exit_code != ExitCode::kNoFailure) return exit_code;
     }
+  } else {
+    std::string node_repl_external_env = {};
+    if (credentials::SafeGetenv("NODE_REPL_EXTERNAL_MODULE",
+                                &node_repl_external_env) ||
+        !node_repl_external_env.empty()) {
+      errors->emplace_back("NODE_REPL_EXTERNAL_MODULE can't be used with "
+                           "kDisableNodeOptionsEnv");
+      return ExitCode::kInvalidCommandLineArgument;
+    }
   }
 #endif
 
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index 32ad72b20cb932..b617f8c65cef86 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -35,8 +35,15 @@ NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   std::unique_ptr<node::InitializationResult> result =
       node::InitializeOncePerProcess(
           args,
-          {node::ProcessInitializationFlags::kNoInitializeV8,
-           node::ProcessInitializationFlags::kNoInitializeNodeV8Platform});
+          {
+              node::ProcessInitializationFlags::kNoInitializeV8,
+              node::ProcessInitializationFlags::kNoInitializeNodeV8Platform,
+              // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
+              // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
+              // support in the future, split this configuration out as a
+              // command line option.
+              node::ProcessInitializationFlags::kDisableNodeOptionsEnv,
+          });
 
   for (const std::string& error : result->errors())
     fprintf(stderr, "%s: %s\n", args[0].c_str(), error.c_str());
diff --git a/test/embedding/test-embedding.js b/test/embedding/test-embedding.js
index 21d517b1ec47b1..1a579a11edc8b6 100644
--- a/test/embedding/test-embedding.js
+++ b/test/embedding/test-embedding.js
@@ -151,3 +151,21 @@ for (const extraSnapshotArgs of [
     [ '--', ...runEmbeddedArgs ],
     { cwd: tmpdir.path });
 }
+
+// Guarantee NODE_REPL_EXTERNAL_MODULE won't bypass kDisableNodeOptionsEnv
+{
+  spawnSyncAndExit(
+    binary,
+    ['require("os")'],
+    {
+      env: {
+        ...process.env,
+        'NODE_REPL_EXTERNAL_MODULE': 'fs',
+      },
+    },
+    {
+      status: 9,
+      signal: null,
+      stderr: `${binary}: NODE_REPL_EXTERNAL_MODULE can't be used with kDisableNodeOptionsEnv\n`,
+    });
+}