Unexpected behavior in process.env handling null bytes

[cruatta]

Version

v22.8.0

Platform

Linux fw13 6.10.7-200.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 30 00:08:59 UTC 2024 x86_64 GNU/Linux

Subsystem

Process

What steps will reproduce the bug?

Case 1: Reading environment variables using bracket notation property accessors where the property name contains a null byte.

console.log(process.env['SHELL\0TERM']);

Case 2: Setting an environment variable where the value of the environment variable contains a null byte.

process.env.SHELL = "HELLO\0GOODBYE";

How often does it reproduce? Is there a required condition?

There are no special required conditions

What is the expected behavior? Why is that the expected behavior?

In case 1, when referencing an environment variable using the property accessor, the expected output should be undefined, as environment variable names and values cannot contain null bytes.

In case 2, it's more ambiguous, but based on the behavior of other languages such as Python, throwing an error would be a sensible behavior. It would also make sense to simply escape the null byte.

What do you see instead?

In case 1, the value of the environment variable named SHELL is printed.

In case 2, the value of the environment variable SHELL becomes "HELLO"

Additional information

No response

[avivkeller]

process.env['FIRST'] = 'FIRST_VALUE'
console.log(process.env['FIRST\0LAST']);

process.env['FIRST\0LAST'] = 'FIRST_LAST_VALUE'
console.log(process.env['FIRST']);

process.env['FIRST'] = 'FIRST\0LAST_VALUE'
console.log(process.env['FIRST']);

$ node repro.js                                                                                                                                              
FIRST_VALUE
FIRST_LAST_VALUE
FIRST

Compared to Python:

Traceback (most recent call last):
  File "/python.py", line X, in <module>
    print(os.environ['FIRST\0LAST'])
          ~~~~~~~~~~^^^^^^^^^^^^^^^
  File "<frozen os>", line 679, in __getitem__
KeyError: 'FIRST\x00LAST'

and

Traceback (most recent call last):
  File "/python.py", line X, in <module>
    os.environ['FIRST_LAST'] = 'FIRST\0LAST_VALUE'
    ~~~~~~~~~~^^^^^^^^^^^^^^
  File "<frozen os>", line 685, in __setitem__
ValueError: embedded null byte

[daeyeon]

Throwing an error seems appropriate, but I'm unsure if it's fine to throw errors from process.env. If sanitizing strings is preferred, how they should be modified is unclear. Alternatively, this could be documented as a constraint. What do others think?