feat(unstable): clean environmental variables for subprocess (#11571)

This commit adds "Deno.RunOptions.clearEnv" option, that allows
to clear environmental variables from parent process before spawning
a subprocess.

3 files changed, 40 insertions, 0 deletions

diff --git a/cli/dts/lib.deno.ns.d.ts b/cli/dts/lib.deno.ns.d.ts
index 37cc58ad6..e1aff59fc 100644
--- a/cli/dts/lib.deno.ns.d.ts
+++ b/cli/dts/lib.deno.ns.d.ts
@@ -2034,6 +2034,10 @@ declare namespace Deno {
    * Subprocess uses same working directory as parent process unless `opt.cwd`
    * is specified.
    *
+   * Environmental variables from parent process can be cleared using `opt.clearEnv`.
+   * Doesn't guarantee that only `opt.env` variables are present,
+   * as the OS may set environmental variables for processes.
+   *
    * Environmental variables for subprocess can be specified using `opt.env`
    * mapping.
    *
diff --git a/cli/dts/lib.deno.unstable.d.ts b/cli/dts/lib.deno.unstable.d.ts
index 0ac829463..6fbd13f5f 100644
--- a/cli/dts/lib.deno.unstable.d.ts
+++ b/cli/dts/lib.deno.unstable.d.ts
@@ -791,6 +791,14 @@ declare namespace Deno {
     mtime: number | Date,
   ): Promise<void>;
 
+  export function run<
+    T extends RunOptions & {
+      clearEnv?: boolean;
+    } = RunOptions & {
+      clearEnv?: boolean;
+    },
+  >(opt: T): Process<T>;
+
   /** **UNSTABLE**: The `signo` argument may change to require the Deno.Signal
    * enum.
    *
diff --git a/cli/tests/unit/process_test.ts b/cli/tests/unit/process_test.ts
index 9bb4d7fc2..f187efe71 100644
--- a/cli/tests/unit/process_test.ts
+++ b/cli/tests/unit/process_test.ts
@@ -510,3 +510,31 @@ unitTest({ perms: { run: true, read: true } }, function killFailed(): void {
 
   p.close();
 });
+
+unitTest(
+  { perms: { run: true, read: true, env: true } },
+  async function clearEnv(): Promise<void> {
+    const p = Deno.run({
+      cmd: [
+        Deno.execPath(),
+        "eval",
+        "-p",
+        "JSON.stringify(Deno.env.toObject())",
+      ],
+      stdout: "piped",
+      clearEnv: true,
+      env: {
+        FOO: "23147",
+      },
+    });
+
+    const obj = JSON.parse(new TextDecoder().decode(await p.output()));
+
+    // can't check for object equality because the OS may set additional env vars for processes
+    // so we check if PATH isn't present as that is a common env var across OS's and isn't set for processes.
+    assertEquals(obj.FOO, "23147");
+    assert(!("PATH" in obj));
+
+    p.close();
+  },
+);