src: whitelist new options for NODE_OPTIONS

Add --debug-*, --napi-modules

Remove --prof-process, like -p and -e, it causes node to do something
other than run node js scripts.

Backport-PR-URL: #12677
PR-URL: #13002
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

doc/api/cli.md

@@ -346,15 +346,17 @@ Node options that are allowed are:
 - `--enable-fips`
 - `--force-fips`
 - `--icu-data-dir`
+- `--debug-brk`
+- `--debug-port`
+- `--debug`
+- `--napi-modules`
 - `--no-deprecation`
 - `--no-warnings`
 - `--openssl-config`
-- `--prof-process`
 - `--redirect-warnings`
 - `--require`, `-r`
 - `--throw-deprecation`
 - `--trace-deprecation`
-- `--trace-events-enabled`
 - `--trace-sync-io`
 - `--trace-warnings`
 - `--track-heap-objects`

src/node.cc

@@ -3787,19 +3787,23 @@ static void CheckIfAllowedInEnv(const char* exe, bool is_env,
 
   static const char* whitelist[] = {
     // Node options
-    "-r", "--require",
+    "--require", "-r",
+    "--debug",
+    "--debug-brk",
+    "--debug-port",
     "--no-deprecation",
+    "--trace-deprecation",
+    "--throw-deprecation",
     "--no-warnings",
+    "--napi-modules",
     "--trace-warnings",
     "--redirect-warnings",
-    "--trace-deprecation",
     "--trace-sync-io",
     "--track-heap-objects",
-    "--throw-deprecation",
     "--zero-fill-buffers",
     "--v8-pool-size",
-    "--use-openssl-ca",
     "--use-bundled-ca",
+    "--use-openssl-ca",
     "--enable-fips",
     "--force-fips",
     "--openssl-config",