Filter NODE_OPTIONS from env for file output

[cory-miller]

This matches the deprecated command equivalent as seen here.

[rymndhng]

@cory-miller @TingluoHuang I started seeing these errors on our worker (we set NODE_OPTIONS by writing to $GITHUB_ENV).

Can you clarify why setting this envvar is not allowed?

[synaptiko]

@cory-miller Our whole CI pipeline is failing since today morning due to this. We need to increase Node.js's memory and without it our commands are failing on OOMs.

Up until this point setting NODE_OPTIONS worked fine. We use this:

echo "NODE_OPTIONS=--max-old-space-size=${MAX_OLDSPACE_SIZE_MB}" >> $GITHUB_ENV

I checked both PRs related to blocking NODE_OPTIONS but there is no explanation why it's blocked and what is an alternative way to set it. Can you please shed some light on this topic? I tried to google it as well but no luck.

The problem is that our deployments are blocked by this quite hidden change. And it took us a while to find this PR as well.

There is no note about NODE_OPTIONS being special in the official docs either: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#setting-an-environment-variable

cc @pleszkowicz @icaliskanoglu

[cory-miller]

For the deprecated set-env command we received bug bounty reports showing exploits of arbitrary code execution using NODE_OPTIONS. This led to the initial filtering for set-env. When introducing GITHUB_ENV for some reason this filter was added despite also being vulnerable to the initial report. This led to subsequent reports related to arbitrary code execution hence the need to add back the filtering.

I will look at the docs and update them.

[georgehb]

For anyone looking for a workaround, you can set the value as an output parameter and then set it as the env for each step that requires it.

eg

steps:
  - name: Calculate NODE_OPTIONS
    id: node_ops
    run: |
      MAX_OLDSPACE_SIZE_MB=8192
      echo "val=--max-old-space-size=${MAX_OLDSPACE_SIZE_MB}" >> "$GITHUB_OUTPUT"
  - name: Tests
    run: npm run test
    env:
      NODE_OPTIONS: ${{steps.node_ops.outputs.val}}

[vlkl-sap]

The workaround works. What is the threat model here?

[eluchsinger]

This workaround is not working for me anymore... :/