René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"The kDisableNodeOptionsEnv option can be work around by using NODE_REPL_EXTERNAL_MODULE env","articleBody":"Node has an `kDisableNodeOptionsEnv` embedder flag that disables `NODE_OPTIONS` env to avoid injecting external code into apps, however it can be bypassed by using the `NODE_REPL_EXTERNAL_MODULE` env as reported by https://github.com/electron/electron/pull/40770.\r\n\r\nI understand `kDisableNodeOptionsEnv` only means to disable `NODE_OPTIONS` env, but if we don't also disable `NODE_REPL_EXTERNAL_MODULE` the protection would become meaningless.\r\n\r\nI think we have 2 options to fix this:\r\n1. Disable `NODE_REPL_EXTERNAL_MODULE` env when `kDisableNodeOptionsEnv` is used.\r\n2. Deprecate `kDisableNodeOptionsEnv` and add a new flag that disables all possible ways to inject code.\r\n\r\nI wonder which one would be preferred by Node team. /cc @addaleax @joyeecheung @bnoordhuis ","author":{"url":"https://github.com/zcbenz","@type":"Person","name":"zcbenz"},"datePublished":"2023-12-20T00:59:56.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/51227/node/issues/51227"}