#include "node_options.h"  // NOLINT(build/include_inline)

#include "node_options-inl.h"

#include "env-inl.h"

#include "node_binding.h"

#include "node_external_reference.h"

#include "node_internals.h"

#if HAVE_OPENSSL

#include "openssl/opensslv.h"

#endif

#include <errno.h>

#include <sstream>

#include <limits>

#include <algorithm>

#include <cstdlib>  // strtoul, errno

using v8::Boolean;

using v8::Context;

using v8::FunctionCallbackInfo;

using v8::Integer;

using v8::Isolate;

using v8::Local;

using v8::Map;

using v8::Number;

using v8::Object;

using v8::Undefined;

using v8::Value;

namespace node {

namespace per_process {

Mutex cli_options_mutex;

std::shared_ptr<PerProcessOptions> cli_options{new PerProcessOptions()};

}  // namespace per_process

                                std::vector<std::string>* argv) {

#if !NODE_USE_V8_PLATFORM && !HAVE_INSPECTOR

  if (inspector_enabled) {

    errors->push_back("Inspector is not available when Node is compiled "

                      "--without-v8-platform and --without-inspector.");

  }

#endif

                      "are invalid. Please use `node --inspect` and "

                      "`node --inspect-brk` instead.");

  }

  std::vector<std::string> destinations =

    } else {

                        "stderr or http");

    }

  }

                                     std::vector<std::string>* argv) {

#if HAVE_OPENSSL

                      "used, not both");

  }

  // Any value less than 2 disables use of the secure heap.

            static_cast<int64_t>(std::numeric_limits<int>::max())});

  }

#endif  // HAVE_OPENSSL

  }

                                     std::vector<std::string>* argv) {

                                      std::vector<std::string>* argv) {

                      "--experimental-policy be enabled");

  }

  }

    }

  }

  }

  }

                      "used, not both");

  }

  }

    }

    }

    }

          "--watch-path cannot be used in combination with --test");

    }

#ifndef ALLOW_ATTACHING_DEBUGGER_IN_TEST_RUNNER

    debug_options_.allow_attaching_debugger = false;

#endif

  }

                        "can be used, not both");

    }

#ifndef ALLOW_ATTACHING_DEBUGGER_IN_WATCH_MODE

    debug_options_.allow_attaching_debugger = false;

#endif

  }

#if HAVE_INSPECTOR

    }

    }

    // We can't catch the case where the value passed is the default value,

    // then the option just becomes a noop which is fine.

    }

  }

    }

    }

    }

    // We can't catch the case where the value passed is the default value,

    // then the option just becomes a noop which is fine.

    }

  }

  }

#endif  // HAVE_INSPECTOR

namespace options_parser {

class DebugOptionsParser : public OptionsParser<DebugOptions> {

 public:

  DebugOptionsParser();

};

class EnvironmentOptionsParser : public OptionsParser<EnvironmentOptions> {

 public:

  EnvironmentOptionsParser();

};

class PerIsolateOptionsParser : public OptionsParser<PerIsolateOptions> {

 public:

  PerIsolateOptionsParser() = delete;

  explicit PerIsolateOptionsParser(const EnvironmentOptionsParser& eop);

};

class PerProcessOptionsParser : public OptionsParser<PerProcessOptions> {

 public:

  PerProcessOptionsParser() = delete;

  explicit PerProcessOptionsParser(const PerIsolateOptionsParser& iop);

};

#if HAVE_INSPECTOR

const DebugOptionsParser _dop_instance{};

const EnvironmentOptionsParser _eop_instance{_dop_instance};

// This Parse is not dead code. It is used by embedders (e.g., Electron).

template <>

  StringVector* const args, StringVector* const exec_args,

  StringVector* const v8_args,

  DebugOptions* const options,

  OptionEnvvarSettings required_env_settings, StringVector* const errors) {

    args, exec_args, v8_args, options, required_env_settings, errors);

}

#else

const EnvironmentOptionsParser _eop_instance{};

#endif  // HAVE_INSPECTOR

const PerIsolateOptionsParser _piop_instance{_eop_instance};

const PerProcessOptionsParser _ppop_instance{_piop_instance};

template <>

  StringVector* const args, StringVector* const exec_args,

  StringVector* const v8_args,

  PerIsolateOptions* const options,

  OptionEnvvarSettings required_env_settings, StringVector* const errors) {

    args, exec_args, v8_args, options, required_env_settings, errors);

template <>

  StringVector* const args, StringVector* const exec_args,

  StringVector* const v8_args,

  PerProcessOptions* const options,

  OptionEnvvarSettings required_env_settings, StringVector* const errors) {

    args, exec_args, v8_args, options, required_env_settings, errors);

// XXX: If you add an option here, please also add it to doc/node.1 and

// doc/api/cli.md

// TODO(addaleax): Make that unnecessary.

            "set host:port for inspector",

            &DebugOptions::host_port,

            kAllowedInEnvvar);

            "activate inspector on host:port (default: 127.0.0.1:9229)",

            &DebugOptions::inspector_enabled,

            kAllowedInEnvvar);

            "activate inspector on host:port and break at start of user script",

            &DebugOptions::break_first_line,

            kAllowedInEnvvar);

            "comma separated list of destinations for inspector uid"

            "(default: stderr,http)",

            &DebugOptions::inspect_publish_uid_string,

            kAllowedInEnvvar);

            "additional user conditions for conditional exports and imports",

            &EnvironmentOptions::conditions,

            kAllowedInEnvvar);

            "set dir for all output files"

            " (default: current working directory)",

            &EnvironmentOptions::diagnostic_dir,

            kAllowedInEnvvar);

            "set default value of verbatim in dns.lookup. Options are "

            "'ipv4first' (IPv4 addresses are placed before IPv6 addresses) "

            "'verbatim' (addresses are in the order the DNS resolver "

            "returned)",

            &EnvironmentOptions::dns_result_order,

            kAllowedInEnvvar);

            "Enable network address family autodetection algorithm",

            &EnvironmentOptions::enable_network_family_autoselection,

            kAllowedInEnvvar);

            "Source Map V3 support for stack traces",

            &EnvironmentOptions::enable_source_maps,

            kAllowedInEnvvar);

            "experimental Fetch API",

            &EnvironmentOptions::experimental_fetch,

            kAllowedInEnvvar,

            true);

            "expose experimental CustomEvent on the global scope",

            &EnvironmentOptions::experimental_global_customevent,

            kAllowedInEnvvar,

            true);

            "expose experimental Web Crypto API on the global scope",

            &EnvironmentOptions::experimental_global_web_crypto,

            kAllowedInEnvvar,

            true);

            "use the specified module as a custom loader",

            &EnvironmentOptions::userland_loaders,

            kAllowedInEnvvar);

            "experimental https: support for the ES Module loader",

            &EnvironmentOptions::experimental_https_modules,

            kAllowedInEnvvar);

            "experimental ES Module support for webassembly modules",

            &EnvironmentOptions::experimental_wasm_modules,

            kAllowedInEnvvar);

            "experimental ES Module import.meta.resolve() support",

            &EnvironmentOptions::experimental_import_meta_resolve,

            kAllowedInEnvvar);

            "use the specified file as a "

            "security policy",

            &EnvironmentOptions::experimental_policy,

            kAllowedInEnvvar);

            "",

            &EnvironmentOptions::has_policy_integrity_string);

            "ensure the security policy contents match "

            "the specified integrity",

            &EnvironmentOptions::experimental_policy_integrity,

            kAllowedInEnvvar);

            "experimental await keyword support in REPL",

            &EnvironmentOptions::experimental_repl_await,

            kAllowedInEnvvar,

            true);

            "experimental ES Module support in vm module",

            &EnvironmentOptions::experimental_vm_modules,

            kAllowedInEnvvar);

            "experimental WASI support",

            &EnvironmentOptions::experimental_wasi,

            kAllowedInEnvvar);

            "experimental frozen intrinsics support",

            &EnvironmentOptions::frozen_intrinsics,

            kAllowedInEnvvar);

            "Generate heap snapshot on specified signal",

            &EnvironmentOptions::heap_snapshot_signal,

            kAllowedInEnvvar);

            "Generate heap snapshots whenever V8 is approaching "

            "the heap limit. No more than the specified number of "

            "heap snapshots will be generated.",

            &EnvironmentOptions::heap_snapshot_near_heap_limit,

            kAllowedInEnvvar);

            "use an insecure HTTP parser that accepts invalid HTTP headers",

            &EnvironmentOptions::insecure_http_parser,

            kAllowedInEnvvar);

            "set module type for string input",

            &EnvironmentOptions::module_type,

            kAllowedInEnvvar);

      "--experimental-specifier-resolution", "", NoOp{}, kAllowedInEnvvar);

           "--experimental-specifier-resolution");

            "silence deprecation warnings",

            &EnvironmentOptions::deprecation,

            kAllowedInEnvvar,

            true);

            "disable checks for async_hooks",

            &EnvironmentOptions::force_async_hooks_checks,

            kAllowedInEnvvar,

            true);

      "--force-node-api-uncaught-exceptions-policy",

      "enforces 'uncaughtException' event on Node API asynchronous callbacks",

      &EnvironmentOptions::force_node_api_uncaught_exceptions_policy,

      kAllowedInEnvvar,

      false);

            "disable loading native addons",

            &EnvironmentOptions::allow_native_addons,

            kAllowedInEnvvar,

            true);

            "disable global module search paths",

            &EnvironmentOptions::global_search_paths,

            kAllowedInEnvvar,

            true);

            "silence all process warnings",

            &EnvironmentOptions::warnings,

            kAllowedInEnvvar,

            true);

            "disable loading non-context-aware addons",

            &EnvironmentOptions::force_context_aware,

            kAllowedInEnvvar);

            "emit pending deprecation warnings",

            &EnvironmentOptions::pending_deprecation,

            kAllowedInEnvvar);

            "preserve symbolic links when resolving",

            &EnvironmentOptions::preserve_symlinks,

            kAllowedInEnvvar);

            "preserve symbolic links when resolving the main module",

            &EnvironmentOptions::preserve_symlinks_main,

            kAllowedInEnvvar);

            "Generate V8 profiler output.",

            V8Option{});

            "process V8 profiler output generated using --prof",

            &EnvironmentOptions::prof_process);

  // Options after --prof-process are passed through to the prof processor.

#if HAVE_INSPECTOR

            "Start the V8 CPU profiler on start up, and write the CPU profile "

            "to disk before exit. If --cpu-prof-dir is not specified, write "

            "the profile to the current working directory.",

            &EnvironmentOptions::cpu_prof);

            "specified file name of the V8 CPU profile generated with "

            "--cpu-prof",

            &EnvironmentOptions::cpu_prof_name);

            "specified sampling interval in microseconds for the V8 CPU "

            "profile generated with --cpu-prof. (default: 1000)",

            &EnvironmentOptions::cpu_prof_interval);

            "Directory where the V8 profiles generated by --cpu-prof will be "

            "placed. Does not affect --prof.",

            &EnvironmentOptions::cpu_prof_dir);

      "--heap-prof",

      "Start the V8 heap profiler on start up, and write the heap profile "

      "to disk before exit. If --heap-prof-dir is not specified, write "

      "the profile to the current working directory.",

      &EnvironmentOptions::heap_prof);

            "specified file name of the V8 heap profile generated with "

            "--heap-prof",

            &EnvironmentOptions::heap_prof_name);

            "Directory where the V8 heap profiles generated by --heap-prof "

            "will be placed.",

            &EnvironmentOptions::heap_prof_dir);

            "specified sampling interval in bytes for the V8 heap "

            "profile generated with --heap-prof. (default: 512 * 1024)",

            &EnvironmentOptions::heap_prof_interval);

#endif  // HAVE_INSPECTOR

            "set the maximum size of HTTP headers (default: 16384 (16KB))",

            &EnvironmentOptions::max_http_header_size,

            kAllowedInEnvvar);

            "write warnings to file instead of stderr",

            &EnvironmentOptions::redirect_warnings,

            kAllowedInEnvvar);

            "launch test runner on startup",

            &EnvironmentOptions::test_runner);

            "run tests whose name matches this regular expression",

            &EnvironmentOptions::test_name_pattern);

            "report test output using the given reporter",

            &EnvironmentOptions::test_reporter);

            "report given reporter to the given destination",

            &EnvironmentOptions::test_reporter_destination);

            "run tests with 'only' option set",

            &EnvironmentOptions::test_only,

            kAllowedInEnvvar);

            &EnvironmentOptions::test_udp_no_try_send);

            "throw an exception on deprecations",

            &EnvironmentOptions::throw_deprecation,

            kAllowedInEnvvar);

            "(deprecated) trace Atomics.wait() operations",

            &EnvironmentOptions::trace_atomics_wait,

            kAllowedInEnvvar);

            "show stack traces on deprecations",

            &EnvironmentOptions::trace_deprecation,

            kAllowedInEnvvar);

            "show stack trace when an environment exits",

            &EnvironmentOptions::trace_exit,

            kAllowedInEnvvar);

            "show stack trace when use of sync IO is detected after the "

            "first tick",

            &EnvironmentOptions::trace_sync_io,

            kAllowedInEnvvar);

            "prints TLS packet trace information to stderr",

            &EnvironmentOptions::trace_tls,

            kAllowedInEnvvar);

            "show stack traces for the `throw` behind uncaught exceptions",

            &EnvironmentOptions::trace_uncaught,

            kAllowedInEnvvar);

            "show stack traces on process warnings",

            &EnvironmentOptions::trace_warnings,

            kAllowedInEnvvar);

            "hide extra information on fatal exception that causes exit",

            &EnvironmentOptions::extra_info_on_fatal_exception,

            kAllowedInEnvvar,

            true);

            "define unhandled rejections behavior. Options are 'strict' "

            "(always raise an error), 'throw' (raise an error unless "

            "'unhandledRejection' hook is set), 'warn' (log a warning), 'none' "

            "(silence warnings), 'warn-with-error-code' (log a warning and set "

            "exit code 1 unless 'unhandledRejection' hook is set). (default: "

            "throw)",

            &EnvironmentOptions::unhandled_rejections,

            kAllowedInEnvvar);

            "", /* undocumented, only for debugging */

            &EnvironmentOptions::verify_base_objects,

            kAllowedInEnvvar);

            "run in watch mode",

            &EnvironmentOptions::watch_mode,

            kAllowedInEnvvar);

            "path to watch",

            &EnvironmentOptions::watch_mode_paths,

            kAllowedInEnvvar);

            "preserve outputs on watch mode restart",

            &EnvironmentOptions::watch_mode_preserve_output,

            kAllowedInEnvvar);

            "syntax check script without executing",

            &EnvironmentOptions::syntax_check_only);

  // This option is only so that we can tell --eval with an empty string from

  // no eval at all. Having it not start with a dash makes it inaccessible

  // from the parser itself, but available for using Implies().

  // TODO(addaleax): When moving --help over to something generated from the

  // programmatic descriptions, this will need some special care.

  // (See also [ssl_openssl_cert_store] below.)

            "evaluate script and print result",

            &EnvironmentOptions::print_eval);

            "CommonJS module to preload (option can be repeated)",

            &EnvironmentOptions::preload_cjs_modules,

            kAllowedInEnvvar);

            "ES module to preload (option can be repeated)",

            &EnvironmentOptions::preload_esm_modules,

            kAllowedInEnvvar);

            "always enter the REPL even if stdin does not appear "

            "to be a terminal",

            &EnvironmentOptions::force_repl);

            "update assert snapshot files",

            &EnvironmentOptions::update_assert_snapshot,

            kAllowedInEnvvar);

            "log TLS decryption keys to named file for traffic analysis",

            &EnvironmentOptions::tls_keylog,

            kAllowedInEnvvar);

            "set default TLS minimum to TLSv1.0 (default: TLSv1.2)",

            &EnvironmentOptions::tls_min_v1_0,

            kAllowedInEnvvar);

            "set default TLS minimum to TLSv1.1 (default: TLSv1.2)",

            &EnvironmentOptions::tls_min_v1_1,

            kAllowedInEnvvar);

            "set default TLS minimum to TLSv1.2 (default: TLSv1.2)",

            &EnvironmentOptions::tls_min_v1_2,

            kAllowedInEnvvar);

            "set default TLS minimum to TLSv1.3 (default: TLSv1.2)",

            &EnvironmentOptions::tls_min_v1_3,

            kAllowedInEnvvar);

            "set default TLS maximum to TLSv1.2 (default: TLSv1.3)",

            &EnvironmentOptions::tls_max_v1_2,

            kAllowedInEnvvar);

  // Current plan is:

  // - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3

  // - 12.x: TLS1.3 is opt-out with --tls-max-v1.2

  // In either case, support both options they are uniformly available.

            "set default TLS maximum to TLSv1.3 (default: TLSv1.3)",

            &EnvironmentOptions::tls_max_v1_3,

            kAllowedInEnvvar);

            "track heap object allocations for heap snapshots",

            &PerIsolateOptions::track_heap_objects,

            kAllowedInEnvvar);

  // Explicitly add some V8 flags to mark them as allowed in NODE_OPTIONS.

            "aborting instead of exiting causes a core file to be generated "

            "for analysis",

            V8Option{},

            kAllowedInEnvvar);

            "help system profilers to translate JavaScript interpreted frames",

            V8Option{},

            kAllowedInEnvvar);

      "--perf-basic-prof-only-functions", "", V8Option{}, kAllowedInEnvvar);

            "disallow eval and friends",

            V8Option{},

            kAllowedInEnvvar);

            "increase default maximum heap size on machines with 16GB memory "

            "or more",

            V8Option{},

            kAllowedInEnvvar);

            "disable runtime allocation of executable memory",

            V8Option{},

            kAllowedInEnvvar);

            "generate diagnostic report on uncaught exceptions",

            &PerIsolateOptions::report_uncaught_exception,

            kAllowedInEnvvar);

            "generate diagnostic report upon receiving signals",

            &PerIsolateOptions::report_on_signal,

            kAllowedInEnvvar);

            "causes diagnostic report to be produced on provided signal,"

            " unsupported in Windows. (default: SIGUSR2)",

            &PerIsolateOptions::report_signal,

            kAllowedInEnvvar);

            "",

            &PerIsolateOptions::experimental_shadow_realm,

            kAllowedInEnvvar);

            "the process title to use on startup",

            &PerProcessOptions::title,

            kAllowedInEnvvar);

            "comma separated list of trace event categories to record",

            &PerProcessOptions::trace_event_categories,

            kAllowedInEnvvar);

            "Template string specifying the filepath for the trace-events "

            "data, it supports ${rotation} and ${pid}.",

            &PerProcessOptions::trace_event_file_pattern,

            kAllowedInEnvvar);

            "set V8's thread pool size",

            &PerProcessOptions::v8_thread_pool_size,

            kAllowedInEnvvar);

            "automatically zero-fill all newly allocated Buffer and "

            "SlowBuffer instances",

            &PerProcessOptions::zero_fill_all_buffers,

            kAllowedInEnvvar);

            "", /* undocumented, only for debugging */

            &PerProcessOptions::debug_arraybuffer_allocations,

            kAllowedInEnvvar);

            "disable Object.prototype.__proto__",

            &PerProcessOptions::disable_proto,

            kAllowedInEnvvar);

            "Generate a snapshot blob when the process exits."

            " Currently only supported in the node_mksnapshot binary.",

            &PerProcessOptions::build_snapshot,

            kDisallowedInEnvvar);

            "",  // It's a debug-only option.

            &PerProcessOptions::node_snapshot,

            kAllowedInEnvvar);

            "Path to the snapshot blob that's either the result of snapshot"

            "building, or the blob that is used to restore the application "

            "state",

            &PerProcessOptions::snapshot_blob,

            kAllowedInEnvvar);

  // 12.x renamed this inadvertently, so alias it for consistency within the

  // release line, while using the original name for consistency with older

  // release lines.

            "print source-able bash completion script",

            &PerProcessOptions::print_bash_completion);

            "print node command line options",

            &PerProcessOptions::print_help);

      "--version", "print Node.js version", &PerProcessOptions::print_version);

            "print V8 command line options",

            &PerProcessOptions::print_v8_help);

            "output compact single-line JSON",

            &PerProcessOptions::report_compact,

            kAllowedInEnvvar);

            "define custom report pathname."

            " (default: current working directory)",

            &PerProcessOptions::report_directory,

            kAllowedInEnvvar);

            "define custom report file name."

            " (default: YYYYMMDD.HHMMSS.PID.SEQUENCE#.txt)",

            &PerProcessOptions::report_filename,

            kAllowedInEnvvar);

            "generate diagnostic report on fatal (internal) errors",

            &PerProcessOptions::report_on_fatalerror,

            kAllowedInEnvvar);

#ifdef NODE_HAVE_I18N_SUPPORT

            "set ICU data load path to dir (overrides NODE_ICU_DATA)"

#ifndef NODE_HAVE_SMALL_ICU

            " (note: linked-in ICU data is present)"

#endif

            ,

            &PerProcessOptions::icu_data_dir,

            kAllowedInEnvvar);

#endif

#if HAVE_OPENSSL

            "load OpenSSL configuration from the specified file "

            "(overrides OPENSSL_CONF)",

            &PerProcessOptions::openssl_config,

            kAllowedInEnvvar);

            "use an alternative default TLS cipher list",

            &PerProcessOptions::tls_cipher_list,

            kAllowedInEnvvar);

            "use OpenSSL's default CA store"

#if defined(NODE_OPENSSL_CERT_STORE)

            " (default)"

#endif

            ,

            &PerProcessOptions::use_openssl_ca,

            kAllowedInEnvvar);

            "use bundled CA store"

#if !defined(NODE_OPENSSL_CERT_STORE)

            " (default)"

#endif

            ,

            &PerProcessOptions::use_bundled_ca,

            kAllowedInEnvvar);

  // Similar to [has_eval_string] above, except that the separation between

  // this and use_openssl_ca only exists for option validation after parsing.

  // This is not ideal.

            "",

            &PerProcessOptions::ssl_openssl_cert_store);

            "enable FIPS crypto at startup",

            &PerProcessOptions::enable_fips_crypto,

            kAllowedInEnvvar);

            "force FIPS crypto (cannot be disabled)",

            &PerProcessOptions::force_fips_crypto,

            kAllowedInEnvvar);

            "total size of the OpenSSL secure heap",

            &PerProcessOptions::secure_heap,

            kAllowedInEnvvar);

            "minimum allocation size from the OpenSSL secure heap",

            &PerProcessOptions::secure_heap_min,

            kAllowedInEnvvar);

#endif  // HAVE_OPENSSL

#if OPENSSL_VERSION_MAJOR >= 3

            "enable OpenSSL 3.0 legacy provider",

            &PerProcessOptions::openssl_legacy_provider,

            kAllowedInEnvvar);

            "enable OpenSSL shared configuration",

            &PerProcessOptions::openssl_shared_config,

            kAllowedInEnvvar);

#endif  // OPENSSL_VERSION_MAJOR

            "Map the Node.js static code to large pages. Options are "

            "'off' (the default value, meaning do not map), "

            "'on' (map and ignore failure, reporting it to stderr), "

            "or 'silent' (map and silently ignore failure)",

            &PerProcessOptions::use_largepages,

            kAllowedInEnvvar);

            "enable printing JavaScript stacktrace on SIGINT",

            &PerProcessOptions::trace_sigint,

            kAllowedInEnvvar);

            "Run with extra debug checks for memory leaks in Node.js itself",

            NoOp{},

            kAllowedInEnvvar);

  else

}

                                std::vector<std::string>* errors) {

  char* endptr;

  const unsigned long result =                 // NOLINT(runtime/int)