src: add option to disable global search paths

PR-URL: https://github.com/nodejs/node/pull/39754
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>

lib/internal/bootstrap/pre_execution.js

@@ -11,7 +11,8 @@ const {
 
 const {
   getOptionValue,
-  shouldNotRegisterESMLoader
+  noGlobalSearchPaths,
+  shouldNotRegisterESMLoader,
 } = require('internal/options');
 const { reconnectZeroFillToggle } = require('internal/buffer');
 
@@ -420,7 +421,9 @@ function initializeWASI() {
 
 function initializeCJSLoader() {
   const CJSLoader = require('internal/modules/cjs/loader');
-  CJSLoader.Module._initPaths();
+  if (!noGlobalSearchPaths) {
+    CJSLoader.Module._initPaths();
+  }
   // TODO(joyeecheung): deprecate this in favor of a proper hook?
   CJSLoader.Module.runMain =
     require('internal/modules/run_main').executeUserEntryPoint;

lib/internal/options.js

@@ -1,6 +1,10 @@
 'use strict';
 
-const { getOptions, shouldNotRegisterESMLoader } = internalBinding('options');
+const {
+  getOptions,
+  noGlobalSearchPaths,
+  shouldNotRegisterESMLoader,
+} = internalBinding('options');
 
 let warnOnAllowUnauthorized = true;
 
@@ -57,5 +61,6 @@ module.exports = {
   },
   getOptionValue,
   getAllowUnauthorized,
-  shouldNotRegisterESMLoader
+  noGlobalSearchPaths,
+  shouldNotRegisterESMLoader,
 };

src/env-inl.h

@@ -886,6 +886,10 @@ inline bool Environment::hide_console_windows() const {
   return flags_ & EnvironmentFlags::kHideConsoleWindows;
 }
 
+inline bool Environment::no_global_search_paths() const {
+  return flags_ & EnvironmentFlags::kNoGlobalSearchPaths;
+}
+
 bool Environment::filehandle_close_warning() const {
   return emit_filehandle_warning_;
 }

src/env.h

@@ -1203,6 +1203,7 @@ class Environment : public MemoryRetainer {
   inline bool owns_inspector() const;
   inline bool tracks_unmanaged_fds() const;
   inline bool hide_console_windows() const;
+  inline bool no_global_search_paths() const;
   inline uint64_t thread_id() const;
   inline worker::Worker* worker_context() const;
   Environment* worker_parent_env() const;

src/node.h

@@ -413,7 +413,12 @@ enum Flags : uint64_t {
   // so that a worker thread can't load a native addon even if `execArgv`
   // is overwritten and `--no-addons` is not specified but was specified
   // for this Environment instance.
-  kNoNativeAddons = 1 << 6
+  kNoNativeAddons = 1 << 6,
+  // Set this flag to disable searching modules from global paths like
+  // $HOME/.node_modules and $NODE_PATH. This is used by standalone apps that
+  // do not expect to have their behaviors changed because of globally
+  // installed modules.
+  kNoGlobalSearchPaths = 1 << 7
 };
 }  // namespace EnvironmentFlags
 

src/node_options.cc

@@ -1078,6 +1078,12 @@ void Initialize(Local<Object> target,
             Boolean::New(isolate, env->should_not_register_esm_loader()))
       .Check();
 
+  target
+      ->Set(context,
+            FIXED_ONE_BYTE_STRING(env->isolate(), "noGlobalSearchPaths"),
+            Boolean::New(isolate, env->no_global_search_paths()))
+      .Check();
+
   Local<Object> types = Object::New(isolate);
   NODE_DEFINE_CONSTANT(types, kNoOp);
   NODE_DEFINE_CONSTANT(types, kV8Option);

src/node_worker.cc

@@ -572,6 +572,8 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
     worker->environment_flags_ |= EnvironmentFlags::kHideConsoleWindows;
   if (env->no_native_addons())
     worker->environment_flags_ |= EnvironmentFlags::kNoNativeAddons;
+  if (env->no_global_search_paths())
+    worker->environment_flags_ |= EnvironmentFlags::kNoGlobalSearchPaths;
 }
 
 void Worker::StartThread(const FunctionCallbackInfo<Value>& args) {