From 769823e57c90fc15e1854ae0d91a1b9a8d2a0c52 Mon Sep 17 00:00:00 2001
From: Yagiz Nizipli <yagiz@nizipli.com>
Date: Thu, 17 Aug 2023 10:08:05 -0400
Subject: [PATCH] src: add built-in `.env` file support

PR-URL: https://github.com/nodejs/node/pull/48890
Refs: https://github.com/orgs/nodejs/discussions/44975
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
---
 doc/api/cli.md                            |  36 +++++
 node.gyp                                  |   2 +
 src/env.cc                                |   9 +-
 src/env.h                                 |   5 +-
 src/heap_utils.cc                         |   4 +-
 src/inspector_profiler.cc                 |   6 +-
 src/node.cc                               |  26 +++-
 src/node_credentials.cc                   |   1 -
 src/node_dotenv.cc                        | 164 ++++++++++++++++++++++
 src/node_dotenv.h                         |  38 +++++
 src/node_options.cc                       |   6 +
 src/node_options.h                        |   2 +
 src/node_report.cc                        |   2 +-
 test/fixtures/dotenv/node-options.env     |   5 +
 test/fixtures/dotenv/valid.env            |  35 +++++
 test/parallel/test-dotenv-edge-cases.js   |  38 +++++
 test/parallel/test-dotenv-node-options.js |  73 ++++++++++
 test/parallel/test-dotenv.js              |  70 +++++++++
 tools/test.py                             |   2 +-
 19 files changed, 508 insertions(+), 16 deletions(-)
 create mode 100644 src/node_dotenv.cc
 create mode 100644 src/node_dotenv.h
 create mode 100644 test/fixtures/dotenv/node-options.env
 create mode 100644 test/fixtures/dotenv/valid.env
 create mode 100644 test/parallel/test-dotenv-edge-cases.js
 create mode 100644 test/parallel/test-dotenv-node-options.js
 create mode 100644 test/parallel/test-dotenv.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index b2d860ba500166..6cd0a795c216e7 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -984,6 +984,41 @@ surface on other platforms, but the performance impact may be severe.
 This flag is inherited from V8 and is subject to change upstream. It may
 disappear in a non-semver-major release.
 
+### `--env-file=config`
+
+> Stability: 1.1 - Active development
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Loads environment variables from a file relative to the current directory,
+making them available to applications on `process.env`. The [environment
+variables which configure Node.js][environment_variables], such as `NODE_OPTIONS`,
+are parsed and applied. If the same variable is defined in the environment and
+in the file, the value from the environment takes precedence.
+
+The format of the file should be one line per key-value pair of environment
+variable name and value separated by `=`:
+
+```text
+PORT=3000
+```
+
+Any text after a `#` is treated as a comment:
+
+```text
+# This is a comment
+PORT=3000 # This is also a comment
+```
+
+Values can start and end with the following quotes: `\`, `"` or `'`.
+They are omitted from the values.
+
+```text
+USERNAME="nodejs" # will result in `nodejs` as the value.
+```
+
 ### `--max-http-header-size=size`
 
 <!-- YAML
@@ -2647,6 +2682,7 @@ done
 [debugger]: debugger.md
 [debugging security implications]: https://nodejs.org/en/docs/guides/debugging-getting-started/#security-implications
 [emit_warning]: process.md#processemitwarningwarning-options
+[environment_variables]: #environment-variables
 [filtering tests by name]: test.md#filtering-tests-by-name
 [jitless]: https://v8.dev/blog/jitless
 [libuv threadpool documentation]: https://docs.libuv.org/en/latest/threadpool.html
diff --git a/node.gyp b/node.gyp
index 063349540086a3..1b6f1efe061a17 100644
--- a/node.gyp
+++ b/node.gyp
@@ -100,6 +100,7 @@
       'src/node_contextify.cc',
       'src/node_credentials.cc',
       'src/node_dir.cc',
+      'src/node_dotenv.cc',
       'src/node_env_var.cc',
       'src/node_errors.cc',
       'src/node_external_reference.cc',
@@ -214,6 +215,7 @@
       'src/node_context_data.h',
       'src/node_contextify.h',
       'src/node_dir.h',
+      'src/node_dotenv.h',
       'src/node_errors.h',
       'src/node_exit_code.h',
       'src/node_external_reference.h',
diff --git a/src/env.cc b/src/env.cc
index dcb29be9b907b0..20b404996ccd0f 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -684,7 +684,7 @@ void Environment::TryLoadAddon(
   }
 }
 
-std::string Environment::GetCwd() {
+std::string Environment::GetCwd(const std::string& exec_path) {
   char cwd[PATH_MAX_BYTES];
   size_t size = PATH_MAX_BYTES;
   const int err = uv_cwd(cwd, &size);
@@ -696,7 +696,6 @@ std::string Environment::GetCwd() {
 
   // This can fail if the cwd is deleted. In that case, fall back to
   // exec_path.
-  const std::string& exec_path = exec_path_;
   return exec_path.substr(0, exec_path.find_last_of(kPathSeparator));
 }
 
@@ -730,7 +729,7 @@ std::unique_ptr<v8::BackingStore> Environment::release_managed_buffer(
   return bs;
 }
 
-std::string GetExecPath(const std::vector<std::string>& argv) {
+std::string Environment::GetExecPath(const std::vector<std::string>& argv) {
   char exec_path_buf[2 * PATH_MAX];
   size_t exec_path_len = sizeof(exec_path_buf);
   std::string exec_path;
@@ -772,7 +771,7 @@ Environment::Environment(IsolateData* isolate_data,
       timer_base_(uv_now(isolate_data->event_loop())),
       exec_argv_(exec_args),
       argv_(args),
-      exec_path_(GetExecPath(args)),
+      exec_path_(Environment::GetExecPath(args)),
       exit_info_(
           isolate_, kExitInfoFieldCount, MAYBE_FIELD_PTR(env_info, exit_info)),
       should_abort_on_uncaught_toggle_(
@@ -1922,7 +1921,7 @@ size_t Environment::NearHeapLimitCallback(void* data,
 
   std::string dir = env->options()->diagnostic_dir;
   if (dir.empty()) {
-    dir = env->GetCwd();
+    dir = Environment::GetCwd(env->exec_path_);
   }
   DiagnosticFilename name(env, "Heap", "heapsnapshot");
   std::string filename = dir + kPathSeparator + (*name);
diff --git a/src/env.h b/src/env.h
index 0fb0550a973a16..c02fc6bd62dd78 100644
--- a/src/env.h
+++ b/src/env.h
@@ -588,6 +588,9 @@ class Environment : public MemoryRetainer {
 
   SET_MEMORY_INFO_NAME(Environment)
 
+  static std::string GetExecPath(const std::vector<std::string>& argv);
+  static std::string GetCwd(const std::string& exec_path);
+
   inline size_t SelfSize() const override;
   bool IsRootNode() const override { return true; }
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -604,8 +607,6 @@ class Environment : public MemoryRetainer {
   // Should be called before InitializeInspector()
   void InitializeDiagnostics();
 
-  std::string GetCwd();
-
 #if HAVE_INSPECTOR
   // If the environment is created for a worker, pass parent_handle and
   // the ownership if transferred into the Environment.
diff --git a/src/heap_utils.cc b/src/heap_utils.cc
index b423d97345e956..e385955a5d5fce 100644
--- a/src/heap_utils.cc
+++ b/src/heap_utils.cc
@@ -456,7 +456,9 @@ void TriggerHeapSnapshot(const FunctionCallbackInfo<Value>& args) {
   if (filename_v->IsUndefined()) {
     DiagnosticFilename name(env, "Heap", "heapsnapshot");
     THROW_IF_INSUFFICIENT_PERMISSIONS(
-        env, permission::PermissionScope::kFileSystemWrite, env->GetCwd());
+        env,
+        permission::PermissionScope::kFileSystemWrite,
+        Environment::GetCwd(env->exec_path()));
     if (WriteSnapshot(env, *name, options).IsNothing()) return;
     if (String::NewFromUtf8(isolate, *name).ToLocal(&filename_v)) {
       args.GetReturnValue().Set(filename_v);
diff --git a/src/inspector_profiler.cc b/src/inspector_profiler.cc
index 56e588ceefa17a..307049bf7c83c5 100644
--- a/src/inspector_profiler.cc
+++ b/src/inspector_profiler.cc
@@ -431,7 +431,8 @@ void StartProfilers(Environment* env) {
   if (env->options()->cpu_prof) {
     const std::string& dir = env->options()->cpu_prof_dir;
     env->set_cpu_prof_interval(env->options()->cpu_prof_interval);
-    env->set_cpu_prof_dir(dir.empty() ? env->GetCwd() : dir);
+    env->set_cpu_prof_dir(dir.empty() ? Environment::GetCwd(env->exec_path())
+                                      : dir);
     if (env->options()->cpu_prof_name.empty()) {
       DiagnosticFilename filename(env, "CPU", "cpuprofile");
       env->set_cpu_prof_name(*filename);
@@ -446,7 +447,8 @@ void StartProfilers(Environment* env) {
   if (env->options()->heap_prof) {
     const std::string& dir = env->options()->heap_prof_dir;
     env->set_heap_prof_interval(env->options()->heap_prof_interval);
-    env->set_heap_prof_dir(dir.empty() ? env->GetCwd() : dir);
+    env->set_heap_prof_dir(dir.empty() ? Environment::GetCwd(env->exec_path())
+                                       : dir);
     if (env->options()->heap_prof_name.empty()) {
       DiagnosticFilename filename(env, "Heap", "heapprofile");
       env->set_heap_prof_name(*filename);
diff --git a/src/node.cc b/src/node.cc
index 2f499ae24ebab0..e6be00eeb3c185 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -20,6 +20,7 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #include "node.h"
+#include "node_dotenv.h"
 
 // ========== local headers ==========
 
@@ -140,6 +141,10 @@ using v8::Value;
 
 namespace per_process {
 
+// node_dotenv.h
+// Instance is used to store environment variables including NODE_OPTIONS.
+node::Dotenv dotenv_file = Dotenv();
+
 // node_revert.h
 // Bit flag used to track security reverts.
 unsigned int reverted_cve = 0;
@@ -305,6 +310,10 @@ MaybeLocal<Value> StartExecution(Environment* env, StartExecutionCallback cb) {
   }
 #endif
 
+  if (env->options()->has_env_file_string) {
+    per_process::dotenv_file.SetEnvironment(env);
+  }
+
   // TODO(joyeecheung): move these conditions into JS land and let the
   // deserialize main function take precedence. For workers, we need to
   // move the pre-execution part into a different file that can be
@@ -831,11 +840,22 @@ static ExitCode InitializeNodeWithArgsInternal(
 
   HandleEnvOptions(per_process::cli_options->per_isolate->per_env);
 
+  std::string node_options;
+  auto file_path = node::Dotenv::GetPathFromArgs(*argv);
+
+  if (file_path.has_value()) {
+    auto cwd = Environment::GetCwd(Environment::GetExecPath(*argv));
+    std::string path = cwd + kPathSeparator + file_path.value();
+    CHECK(!per_process::v8_initialized);
+    per_process::dotenv_file.ParsePath(path);
+    per_process::dotenv_file.AssignNodeOptionsIfAvailable(&node_options);
+  }
+
 #if !defined(NODE_WITHOUT_NODE_OPTIONS)
   if (!(flags & ProcessInitializationFlags::kDisableNodeOptionsEnv)) {
-    std::string node_options;
-
-    if (credentials::SafeGetenv("NODE_OPTIONS", &node_options)) {
+    // NODE_OPTIONS environment variable is preferred over the file one.
+    if (credentials::SafeGetenv("NODE_OPTIONS", &node_options) ||
+        !node_options.empty()) {
       std::vector<std::string> env_argv =
           ParseNodeOptionsEnvVar(node_options, errors);
 
diff --git a/src/node_credentials.cc b/src/node_credentials.cc
index 52abaab7a635db..c1f7a4f2acbdf6 100644
--- a/src/node_credentials.cc
+++ b/src/node_credentials.cc
@@ -123,7 +123,6 @@ bool SafeGetenv(const char* key,
   }
 
 fail:
-  text->clear();
   return false;
 }
 
diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc
new file mode 100644
index 00000000000000..d8d6fc1d55d3de
--- /dev/null
+++ b/src/node_dotenv.cc
@@ -0,0 +1,164 @@
+#include "node_dotenv.h"
+#include "env-inl.h"
+#include "node_file.h"
+#include "uv.h"
+
+namespace node {
+
+using v8::NewStringType;
+using v8::String;
+
+std::optional<std::string> Dotenv::GetPathFromArgs(
+    const std::vector<std::string>& args) {
+  std::string_view flag = "--env-file";
+  // Match the last `--env-file`
+  // This is required to imitate the default behavior of Node.js CLI argument
+  // matching.
+  auto path =
+      std::find_if(args.rbegin(), args.rend(), [&flag](const std::string& arg) {
+        return strncmp(arg.c_str(), flag.data(), flag.size()) == 0;
+      });
+
+  if (path == args.rend()) {
+    return std::nullopt;
+  }
+
+  auto equal_char = path->find('=');
+
+  if (equal_char != std::string::npos) {
+    return path->substr(equal_char + 1);
+  }
+
+  auto next_arg = std::prev(path);
+
+  if (next_arg == args.rend()) {
+    return std::nullopt;
+  }
+
+  return *next_arg;
+}
+
+void Dotenv::SetEnvironment(node::Environment* env) {
+  if (store_.empty()) {
+    return;
+  }
+
+  auto isolate = env->isolate();
+
+  for (const auto& entry : store_) {
+    auto key = entry.first;
+    auto value = entry.second;
+    env->env_vars()->Set(
+        isolate,
+        v8::String::NewFromUtf8(
+            isolate, key.data(), NewStringType::kNormal, key.size())
+            .ToLocalChecked(),
+        v8::String::NewFromUtf8(
+            isolate, value.data(), NewStringType::kNormal, value.size())
+            .ToLocalChecked());
+  }
+}
+
+void Dotenv::ParsePath(const std::string_view path) {
+  uv_fs_t req;
+  auto defer_req_cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+
+  uv_file file = uv_fs_open(nullptr, &req, path.data(), 0, 438, nullptr);
+  if (req.result < 0) {
+    // req will be cleaned up by scope leave.
+    return;
+  }
+  uv_fs_req_cleanup(&req);
+
+  auto defer_close = OnScopeLeave([file]() {
+    uv_fs_t close_req;
+    CHECK_EQ(0, uv_fs_close(nullptr, &close_req, file, nullptr));
+    uv_fs_req_cleanup(&close_req);
+  });
+
+  std::string result{};
+  char buffer[8192];
+  uv_buf_t buf = uv_buf_init(buffer, sizeof(buffer));
+
+  while (true) {
+    auto r = uv_fs_read(nullptr, &req, file, &buf, 1, -1, nullptr);
+    if (req.result < 0) {
+      // req will be cleaned up by scope leave.
+      return;
+    }
+    uv_fs_req_cleanup(&req);
+    if (r <= 0) {
+      break;
+    }
+    result.append(buf.base, r);
+  }
+
+  using std::string_view_literals::operator""sv;
+  auto lines = SplitString(result, "\n"sv);
+
+  for (const auto& line : lines) {
+    ParseLine(line);
+  }
+}
+
+void Dotenv::AssignNodeOptionsIfAvailable(std::string* node_options) {
+  auto match = store_.find("NODE_OPTIONS");
+
+  if (match != store_.end()) {
+    *node_options = match->second;
+  }
+}
+
+void Dotenv::ParseLine(const std::string_view line) {
+  auto equal_index = line.find('=');
+
+  if (equal_index == std::string_view::npos) {
+    return;
+  }
+
+  auto key = line.substr(0, equal_index);
+
+  // Remove leading and trailing space characters from key.
+  while (!key.empty() && std::isspace(key.front())) key.remove_prefix(1);
+  while (!key.empty() && std::isspace(key.back())) key.remove_suffix(1);
+
+  // Omit lines with comments
+  if (key.front() == '#' || key.empty()) {
+    return;
+  }
+
+  auto value = std::string(line.substr(equal_index + 1));
+
+  // Might start and end with `"' characters.
+  auto quotation_index = value.find_first_of("`\"'");
+
+  if (quotation_index == 0) {
+    auto quote_character = value[quotation_index];
+    value.erase(0, 1);
+
+    auto end_quotation_index = value.find_last_of(quote_character);
+
+    // We couldn't find the closing quotation character. Terminate.
+    if (end_quotation_index == std::string::npos) {
+      return;
+    }
+
+    value.erase(end_quotation_index);
+  } else {
+    auto hash_index = value.find('#');
+
+    // Remove any inline comments
+    if (hash_index != std::string::npos) {
+      value.erase(hash_index);
+    }
+
+    // Remove any leading/trailing spaces from unquoted values.
+    while (!value.empty() && std::isspace(value.front())) value.erase(0, 1);
+    while (!value.empty() && std::isspace(value.back()))
+      value.erase(value.size() - 1);
+  }
+
+  store_.emplace(key, value);
+}
+
+}  // namespace node
diff --git a/src/node_dotenv.h b/src/node_dotenv.h
new file mode 100644
index 00000000000000..2fb810386324fc
--- /dev/null
+++ b/src/node_dotenv.h
@@ -0,0 +1,38 @@
+#ifndef SRC_NODE_DOTENV_H_
+#define SRC_NODE_DOTENV_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "util-inl.h"
+
+#include <map>
+#include <optional>
+
+namespace node {
+
+class Dotenv {
+ public:
+  Dotenv() = default;
+  Dotenv(const Dotenv& d) = default;
+  Dotenv(Dotenv&& d) noexcept = default;
+  Dotenv& operator=(Dotenv&& d) noexcept = default;
+  Dotenv& operator=(const Dotenv& d) = default;
+  ~Dotenv() = default;
+
+  void ParsePath(const std::string_view path);
+  void AssignNodeOptionsIfAvailable(std::string* node_options);
+  void SetEnvironment(Environment* env);
+
+  static std::optional<std::string> GetPathFromArgs(
+      const std::vector<std::string>& args);
+
+ private:
+  void ParseLine(const std::string_view line);
+  std::map<std::string, std::string> store_;
+};
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_NODE_DOTENV_H_
diff --git a/src/node_options.cc b/src/node_options.cc
index f9dc78abffa48c..6ea85e3399be69 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -575,6 +575,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "write warnings to file instead of stderr",
             &EnvironmentOptions::redirect_warnings,
             kAllowedInEnvvar);
+  AddOption(
+      "[has_env_file_string]", "", &EnvironmentOptions::has_env_file_string);
+  AddOption("--env-file",
+            "set environment variables from supplied file",
+            &EnvironmentOptions::env_file);
+  Implies("--env-file", "[has_env_file_string]");
   AddOption("--test",
             "launch test runner on startup",
             &EnvironmentOptions::test_runner);
diff --git a/src/node_options.h b/src/node_options.h
index bb8b68894b4430..1cc575bb9c7e3c 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -158,6 +158,8 @@ class EnvironmentOptions : public Options {
 #endif  // HAVE_INSPECTOR
   std::string redirect_warnings;
   std::string diagnostic_dir;
+  std::string env_file;
+  bool has_env_file_string = false;
   bool test_runner = false;
   bool test_runner_coverage = false;
   std::vector<std::string> test_name_pattern;
diff --git a/src/node_report.cc b/src/node_report.cc
index 31d857560e00be..88c9a97789e30b 100644
--- a/src/node_report.cc
+++ b/src/node_report.cc
@@ -882,7 +882,7 @@ std::string TriggerNodeReport(Isolate* isolate,
       THROW_IF_INSUFFICIENT_PERMISSIONS(
           env,
           permission::PermissionScope::kFileSystemWrite,
-          std::string_view(env->GetCwd()),
+          std::string_view(Environment::GetCwd(env->exec_path())),
           filename);
     }
   }
diff --git a/test/fixtures/dotenv/node-options.env b/test/fixtures/dotenv/node-options.env
new file mode 100644
index 00000000000000..3dc9b529947c30
--- /dev/null
+++ b/test/fixtures/dotenv/node-options.env
@@ -0,0 +1,5 @@
+CUSTOM_VARIABLE=hello-world
+NODE_NO_WARNINGS=1
+NODE_OPTIONS="--experimental-permission --allow-fs-read=*"
+TZ=Pacific/Honolulu
+UV_THREADPOOL_SIZE=5
diff --git a/test/fixtures/dotenv/valid.env b/test/fixtures/dotenv/valid.env
new file mode 100644
index 00000000000000..56632b36ba82ff
--- /dev/null
+++ b/test/fixtures/dotenv/valid.env
@@ -0,0 +1,35 @@
+BASIC=basic
+
+# previous line intentionally left blank
+AFTER_LINE=after_line
+EMPTY=
+EMPTY_SINGLE_QUOTES=''
+EMPTY_DOUBLE_QUOTES=""
+EMPTY_BACKTICKS=``
+SINGLE_QUOTES='single_quotes'
+SINGLE_QUOTES_SPACED='    single quotes    '
+DOUBLE_QUOTES="double_quotes"
+DOUBLE_QUOTES_SPACED="    double quotes    "
+DOUBLE_QUOTES_INSIDE_SINGLE='double "quotes" work inside single quotes'
+DOUBLE_QUOTES_WITH_NO_SPACE_BRACKET="{ port: $MONGOLAB_PORT}"
+SINGLE_QUOTES_INSIDE_DOUBLE="single 'quotes' work inside double quotes"
+BACKTICKS_INSIDE_SINGLE='`backticks` work inside single quotes'
+BACKTICKS_INSIDE_DOUBLE="`backticks` work inside double quotes"
+BACKTICKS=`backticks`
+BACKTICKS_SPACED=`    backticks    `
+DOUBLE_QUOTES_INSIDE_BACKTICKS=`double "quotes" work inside backticks`
+SINGLE_QUOTES_INSIDE_BACKTICKS=`single 'quotes' work inside backticks`
+DOUBLE_AND_SINGLE_QUOTES_INSIDE_BACKTICKS=`double "quotes" and single 'quotes' work inside backticks`
+# COMMENTS=work
+INLINE_COMMENTS=inline comments # work #very #well
+INLINE_COMMENTS_SINGLE_QUOTES='inline comments outside of #singlequotes' # work
+INLINE_COMMENTS_DOUBLE_QUOTES="inline comments outside of #doublequotes" # work
+INLINE_COMMENTS_BACKTICKS=`inline comments outside of #backticks` # work
+INLINE_COMMENTS_SPACE=inline comments start with a#number sign. no space required.
+EQUAL_SIGNS=equals==
+RETAIN_INNER_QUOTES={"foo": "bar"}
+RETAIN_INNER_QUOTES_AS_STRING='{"foo": "bar"}'
+RETAIN_INNER_QUOTES_AS_BACKTICKS=`{"foo": "bar's"}`
+TRIM_SPACE_FROM_UNQUOTED=    some spaced out string
+USERNAME=therealnerdybeast@example.tld
+    SPACED_KEY = parsed
diff --git a/test/parallel/test-dotenv-edge-cases.js b/test/parallel/test-dotenv-edge-cases.js
new file mode 100644
index 00000000000000..1d256799bfbb13
--- /dev/null
+++ b/test/parallel/test-dotenv-edge-cases.js
@@ -0,0 +1,38 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { describe, it } = require('node:test');
+
+const validEnvFilePath = '../fixtures/dotenv/valid.env';
+const relativePath = '../fixtures/dotenv/node-options.env';
+
+describe('.env supports edge cases', () => {
+
+  it('should use the last --env-file declaration', async () => {
+    const code = `
+      require('assert').strictEqual(process.env.BASIC, 'basic');
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${relativePath}`, `--env-file=${validEnvFilePath}`, '--eval', code ],
+      { cwd: __dirname },
+    );
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
+
+  it('should handle non-existent .env file', async () => {
+    const code = `
+      require('assert').strictEqual(1, 1)
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--env-file=.env', '--eval', code ],
+      { cwd: __dirname },
+    );
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
+
+});
diff --git a/test/parallel/test-dotenv-node-options.js b/test/parallel/test-dotenv-node-options.js
new file mode 100644
index 00000000000000..4b35f22f395371
--- /dev/null
+++ b/test/parallel/test-dotenv-node-options.js
@@ -0,0 +1,73 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { describe, it } = require('node:test');
+
+if (process.config.variables.node_without_node_options) {
+  common.skip('missing NODE_OPTIONS support');
+}
+
+const relativePath = '../fixtures/dotenv/node-options.env';
+
+describe('.env supports NODE_OPTIONS', () => {
+
+  it('should have access to permission scope', async () => {
+    const code = `
+      require('assert')(process.permission.has('fs.read'));
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${relativePath}`, '--eval', code ],
+      { cwd: __dirname },
+    );
+    // NODE_NO_WARNINGS is set, so `stderr` should not contain
+    // "ExperimentalWarning: Permission is an experimental feature" message
+    // and thus be empty
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
+
+  it('validate only read permissions are enabled', async () => {
+    const code = `
+      require('fs').writeFileSync(require('path').join(__dirname, 'should-not-write.txt'), 'hello', 'utf-8')
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${relativePath}`, '--eval', code ],
+      { cwd: __dirname },
+    );
+    assert.match(child.stderr, /Error: Access to this API has been restricted/);
+    assert.match(child.stderr, /code: 'ERR_ACCESS_DENIED'/);
+    assert.match(child.stderr, /permission: 'FileSystemWrite'/);
+    assert.strictEqual(child.code, 1);
+  });
+
+  it('TZ environment variable', { skip: !common.hasIntl || process.config.variables.icu_small }, async () => {
+    const code = `
+      require('assert')(new Date().toString().includes('Hawaii'))
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${relativePath}`, '--eval', code ],
+      { cwd: __dirname },
+    );
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
+
+  it('should update UV_THREADPOOL_SIZE', async () => {
+    const code = `
+      require('assert').strictEqual(process.env.UV_THREADPOOL_SIZE, '5')
+    `.trim();
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ `--env-file=${relativePath}`, '--eval', code ],
+      { cwd: __dirname },
+    );
+    assert.strictEqual(child.stderr, '');
+    assert.strictEqual(child.code, 0);
+  });
+
+});
diff --git a/test/parallel/test-dotenv.js b/test/parallel/test-dotenv.js
new file mode 100644
index 00000000000000..eb4d4178b1a4f4
--- /dev/null
+++ b/test/parallel/test-dotenv.js
@@ -0,0 +1,70 @@
+// Flags: --env-file test/fixtures/dotenv/valid.env
+'use strict';
+
+require('../common');
+const assert = require('node:assert');
+
+// Sets basic environment variable
+assert.strictEqual(process.env.BASIC, 'basic');
+// Reads after a skipped line
+assert.strictEqual(process.env.AFTER_LINE, 'after_line');
+// Defaults empty values to empty string
+assert.strictEqual(process.env.EMPTY, '');
+assert.strictEqual(process.env.EMPTY_SINGLE_QUOTES, '');
+assert.strictEqual(process.env.EMPTY_DOUBLE_QUOTES, '');
+assert.strictEqual(process.env.EMPTY_BACKTICKS, '');
+// Escapes single quoted values
+assert.strictEqual(process.env.SINGLE_QUOTES, 'single_quotes');
+// Respects surrounding spaces in single quotes
+assert.strictEqual(process.env.SINGLE_QUOTES_SPACED, '    single quotes    ');
+// Escapes double quoted values
+assert.strictEqual(process.env.DOUBLE_QUOTES, 'double_quotes');
+// Respects surrounding spaces in double quotes
+assert.strictEqual(process.env.DOUBLE_QUOTES_SPACED, '    double quotes    ');
+// Respects double quotes inside single quotes
+assert.strictEqual(process.env.DOUBLE_QUOTES_INSIDE_SINGLE, 'double "quotes" work inside single quotes');
+// Respects spacing for badly formed brackets
+assert.strictEqual(process.env.DOUBLE_QUOTES_WITH_NO_SPACE_BRACKET, '{ port: $MONGOLAB_PORT}');
+// Respects single quotes inside double quotes
+assert.strictEqual(process.env.SINGLE_QUOTES_INSIDE_DOUBLE, "single 'quotes' work inside double quotes");
+// Respects backticks inside single quotes
+assert.strictEqual(process.env.BACKTICKS_INSIDE_SINGLE, '`backticks` work inside single quotes');
+// Respects backticks inside double quotes
+assert.strictEqual(process.env.BACKTICKS_INSIDE_DOUBLE, '`backticks` work inside double quotes');
+assert.strictEqual(process.env.BACKTICKS, 'backticks');
+assert.strictEqual(process.env.BACKTICKS_SPACED, '    backticks    ');
+// Respects double quotes inside backticks
+assert.strictEqual(process.env.DOUBLE_QUOTES_INSIDE_BACKTICKS, 'double "quotes" work inside backticks');
+// Respects single quotes inside backticks
+assert.strictEqual(process.env.SINGLE_QUOTES_INSIDE_BACKTICKS, "single 'quotes' work inside backticks");
+// Respects single quotes inside backticks
+assert.strictEqual(
+  process.env.DOUBLE_AND_SINGLE_QUOTES_INSIDE_BACKTICKS,
+  "double \"quotes\" and single 'quotes' work inside backticks",
+);
+// Ignores inline comments
+assert.strictEqual(process.env.INLINE_COMMENTS, 'inline comments');
+// Ignores inline comments and respects # character inside of single quotes
+assert.strictEqual(process.env.INLINE_COMMENTS_SINGLE_QUOTES, 'inline comments outside of #singlequotes');
+// Ignores inline comments and respects # character inside of double quotes
+assert.strictEqual(process.env.INLINE_COMMENTS_DOUBLE_QUOTES, 'inline comments outside of #doublequotes');
+// Ignores inline comments and respects # character inside of backticks
+assert.strictEqual(process.env.INLINE_COMMENTS_BACKTICKS, 'inline comments outside of #backticks');
+// Treats # character as start of comment
+assert.strictEqual(process.env.INLINE_COMMENTS_SPACE, 'inline comments start with a');
+// Respects equals signs in values
+assert.strictEqual(process.env.EQUAL_SIGNS, 'equals==');
+// Retains inner quotes
+assert.strictEqual(process.env.RETAIN_INNER_QUOTES, '{"foo": "bar"}');
+// Respects equals signs in values
+assert.strictEqual(process.env.EQUAL_SIGNS, 'equals==');
+// Retains inner quotes
+assert.strictEqual(process.env.RETAIN_INNER_QUOTES, '{"foo": "bar"}');
+assert.strictEqual(process.env.RETAIN_INNER_QUOTES_AS_STRING, '{"foo": "bar"}');
+assert.strictEqual(process.env.RETAIN_INNER_QUOTES_AS_BACKTICKS, '{"foo": "bar\'s"}');
+// Retains spaces in string
+assert.strictEqual(process.env.TRIM_SPACE_FROM_UNQUOTED, 'some spaced out string');
+// Parses email addresses completely
+assert.strictEqual(process.env.USERNAME, 'therealnerdybeast@example.tld');
+// Parses keys and values surrounded by spaces
+assert.strictEqual(process.env.SPACED_KEY, 'parsed');
diff --git a/tools/test.py b/tools/test.py
index 3c7bfa7f6742a9..d35b45a669bccc 100755
--- a/tools/test.py
+++ b/tools/test.py
@@ -89,7 +89,7 @@ def get_module(name, path):
 VERBOSE = False
 
 os.umask(0o022)
-os.environ['NODE_OPTIONS'] = ''
+os.environ.pop('NODE_OPTIONS', None)
 
 # ---------------------------------------------
 # --- P r o g r e s s   I n d i c a t o r s ---