@@ -53,6 +53,41 @@ function resolveTrustedWindowsCmdExe(): string {
5353return path.win32.join(getWindowsInstallRoots().systemRoot, "System32", "cmd.exe");
5454}
555556+function assignChildEnvValue(params: {
57+env: NodeJS.ProcessEnv;
58+key: string;
59+platform: NodeJS.Platform;
60+value: string | undefined;
61+}): void {
62+if (params.value === undefined) {
63+return;
64+}
65+if (params.platform === "win32") {
66+const normalizedKey = params.key.toLowerCase();
67+for (const existingKey of Object.keys(params.env)) {
68+if (existingKey.toLowerCase() === normalizedKey && existingKey !== params.key) {
69+delete params.env[existingKey];
70+}
71+}
72+}
73+params.env[params.key] = params.value;
74+}
75+76+function mergeChildEnv(params: {
77+baseEnv: NodeJS.ProcessEnv;
78+env?: NodeJS.ProcessEnv;
79+platform: NodeJS.Platform;
80+}): NodeJS.ProcessEnv {
81+const resolvedEnv: NodeJS.ProcessEnv = {};
82+for (const [key, value] of Object.entries(params.baseEnv)) {
83+assignChildEnvValue({ env: resolvedEnv, key, platform: params.platform, value });
84+}
85+for (const [key, value] of Object.entries(params.env ?? {})) {
86+assignChildEnvValue({ env: resolvedEnv, key, platform: params.platform, value });
87+}
88+return resolvedEnv;
89+}
90+5691/**
5792 * On Windows, Node 18.20.2+ (CVE-2024-27980) rejects spawning .cmd/.bat directly
5893 * without shell, causing EINVAL. Resolve npm/npx to node + cli script so we
@@ -246,8 +281,10 @@ export function resolveCommandEnv(params: {
246281argv: string[];
247282env?: NodeJS.ProcessEnv;
248283baseEnv?: NodeJS.ProcessEnv;
284+platform?: NodeJS.Platform;
249285}): NodeJS.ProcessEnv {
250286const baseEnv = params.baseEnv ?? process.env;
287+const platform = params.platform ?? process.platform;
251288const argv = params.argv;
252289const shouldSuppressNpmFund = (() => {
253290const cmd = path.basename(argv[0] ?? "");
@@ -261,12 +298,7 @@ export function resolveCommandEnv(params: {
261298return false;
262299})();
263300264-const mergedEnv = params.env ? { ...baseEnv, ...params.env } : { ...baseEnv };
265-const resolvedEnv = Object.fromEntries(
266-Object.entries(mergedEnv)
267-.filter(([, value]) => value !== undefined)
268-.map(([key, value]) => [key, String(value)]),
269-);
301+const resolvedEnv = mergeChildEnv({ baseEnv, env: params.env, platform });
270302if (shouldSuppressNpmFund) {
271303if (resolvedEnv.NPM_CONFIG_FUND == null) {
272304resolvedEnv.NPM_CONFIG_FUND = "false";
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。