mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: oob string read when parsing node_options (#46210)

Browse source 
* fix: oob string read when parsing node_options

* chore: re-enable test

* fix: missing linux server env for tests
This commit is contained in:
Robo 2025-03-25 19:33:10 +09:00 • committed by GitHub
parent cfada0347e
commit 307d4f94c7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 51 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
shell/common/node_bindings.cc
View file

@ -394,6 +394,7 @@ void SetNodeOptions(base::Environment* env) {
if (env->HasVar("NODE_OPTIONS")) {
if (electron::fuses::IsNodeOptionsEnabled()) {
std::string options;
std::string result_options;
env->GetVar("NODE_OPTIONS", &options);
const std::vector<std::string_view> parts = base::SplitStringPiece(
options, " ", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
@ -408,18 +409,20 @@ void SetNodeOptions(base::Environment* env) {
// Explicitly disallow majority of NODE_OPTIONS in packaged apps
LOG(ERROR) << "Most NODE_OPTIONs are not supported in packaged apps."
<< " See documentation for more details.";
options.erase(options.find(option), part.length());
continue;
} else if (disallowed.contains(option)) {
// Remove NODE_OPTIONS specifically disallowed for use in Node.js
// through Electron owing to constraints like BoringSSL.
LOG(ERROR) << "The NODE_OPTION " << option
<< " is not supported in Electron";
options.erase(options.find(option), part.length());
continue;
}
result_options.append(part);
result_options.append(" ");
}
// overwrite new NODE_OPTIONS without unsupported variables
env->SetVar("NODE_OPTIONS", options);
env->SetVar("NODE_OPTIONS", result_options);
} else {
LOG(WARNING) << "NODE_OPTIONS ignored due to disabled nodeOptions fuse.";
env->UnSetVar("NODE_OPTIONS");