child_process: ignore undef/proto values of env

At present, undefined values of env option will be transferred as
a "undefined" string value, and values in prototype will also be
included, which are not usual behaviors.

This commit prevents those to be transferred to the environment of
the child process.

PR-URL: nodejs/node#15089
Fixes: nodejs/node#15087
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

doc/api/child_process.md

@@ -437,6 +437,8 @@ If not given, the default is to inherit the current working directory.
 Use `env` to specify environment variables that will be visible to the new
 process, the default is [`process.env`][].
 
+`undefined` values in `env` will be ignored.
+
 Example of running `ls -lh /usr`, capturing `stdout`, `stderr`, and the
 exit code:
 

lib/child_process.js

@@ -504,8 +504,11 @@ function normalizeSpawnArguments(file, args, options) {
   var env = options.env || process.env;
   var envPairs = [];
 
-  for (var key in env) {
-    envPairs.push(`${key}=${env[key]}`);
+  for (const key of Object.keys(env)) {
+    const value = env[key];
+    if (value !== undefined) {
+      envPairs.push(`${key}=${value}`);
+    }
   }
 
   _convertCustomFds(options);

test/parallel/test-child-process-env.js

@@ -22,11 +22,15 @@
 'use strict';
 const common = require('../common');
 const assert = require('assert');
+const os = require('os');
 
 const spawn = require('child_process').spawn;
 
 const env = {
-  'HELLO': 'WORLD'
+  'HELLO': 'WORLD',
+  'UNDEFINED': undefined,
+  'NULL': null,
+  'EMPTY': ''
 };
 Object.setPrototypeOf(env, {
   'FOO': 'BAR'
@@ -53,5 +57,8 @@ child.stdout.on('data', function(chunk) {
 
 process.on('exit', function() {
   assert.ok(response.includes('HELLO=WORLD'));
-  assert.ok(response.includes('FOO=BAR'));
+  assert.ok(!response.includes('FOO='));
+  assert.ok(!response.includes('UNDEFINED=undefined'));
+  assert.ok(response.includes('NULL=null'));
+  assert.ok(response.includes(`EMPTY=${os.EOL}`));
 });