child_process: ignore undef/proto values of env

At present, undefined values of env option will be transferred as
a "undefined" string value, and values in prototype will also be
included, which are not usual behaviors.

This commit prevents those to be transferred to the environment of
the child process.

PR-URL: https://github.com/nodejs/node/pull/15089
Fixes: https://github.com/nodejs/node/issues/15087
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/lib/child_process.js b/lib/child_process.js
index d1c4d2f290..f2c1a0c237 100644
--- a/lib/child_process.js
+++ b/lib/child_process.js
@@ -504,8 +504,11 @@ function normalizeSpawnArguments(file, args, options) {
   var env = options.env || process.env;
   var envPairs = [];
 
-  for (var key in env) {
-    envPairs.push(`${key}=${env[key]}`);
+  for (const key of Object.keys(env)) {
+    const value = env[key];
+    if (value !== undefined) {
+      envPairs.push(`${key}=${value}`);
+    }
   }
 
   _convertCustomFds(options);