Commit a7e06d975d2 for nodejs

commit a7e06d975d23573849daaf87438cb3ee5cf5f08c
Author: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date:   Thu Oct 22 17:12:12 2026 -0300

    permission: reject wildcard references when dropping env

    Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
    PR-URL: https://github.com/nodejs/node/pull/66773
    Reviewed-By: James M Snell <jasnell@gmail.com>

diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index 386671b339d..b8610055c78 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -350,6 +350,10 @@ const databaseUrl = process.env.DATABASE_URL;
 process.permission.drop('env', 'DATABASE_URL');
 ```

+Wildcards cannot be dropped: `process.permission.drop('env', 'APP_*')` and
+`process.permission.drop('env', '*')` throw `ERR_INVALID_ARG_VALUE`. To remove
+every variable, drop the whole `env` scope.
+
 When a process that enforces the Permission Model spawns a child process, the
 child is started with `--allow-env=*`: the environment it inherits only contains
 variables that the parent had access to. The child can still read its own
diff --git a/doc/api/process.md b/doc/api/process.md
index 36e087b2cd0..14e3fa9718a 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -3269,7 +3269,7 @@ The available scopes are the same as [`process.permission.has()`][]:
 * `fs.write` - File System write operations
 * `child` - Child process spawning operations
 * `env` - Environment variables. Dropping a variable removes it from the
-  environment
+  environment. A reference ending with `*` is not accepted
 * `openssl.store` - Loading keys through OpenSSL STORE loaders
 * `worker` - Worker thread spawning operation
 * `net` - Network operations
diff --git a/src/permission/permission.cc b/src/permission/permission.cc
index d5e93c729be..53d3a765744 100644
--- a/src/permission/permission.cc
+++ b/src/permission/permission.cc
@@ -122,6 +122,14 @@ static void Drop(const FunctionCallbackInfo<Value>& args) {
     // are not guaranteed to be valid UTF-8.
     BufferValue resource(env->isolate(), args[1]);
     if (resource.length() > 0) {
+      // A wildcard would drop more than one variable at once. Dropping the
+      // whole scope, without a reference, is the only way to do that.
+      if (scope == PermissionScope::kEnv &&
+          resource.ToStringView().back() == '*') {
+        return THROW_ERR_INVALID_ARG_VALUE(
+            env,
+            "Wildcards are not supported when dropping environment variables");
+      }
       env->permission()->Drop(env, scope, resource.ToStringView());
       return;
     }
diff --git a/test/parallel/test-permission-env-drop.js b/test/parallel/test-permission-env-drop.js
index 652513231e0..ef656bd7cbd 100644
--- a/test/parallel/test-permission-env-drop.js
+++ b/test/parallel/test-permission-env-drop.js
@@ -68,3 +68,23 @@ spawnSyncAndAssert(
   ],
   { env },
   {});
+
+// Wildcards cannot be dropped, and nothing is removed.
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--permission', '--allow-env=PERMISSION_ENV_*', '-e',
+    `
+    const assert = require('assert');
+    for (const reference of ['PERMISSION_ENV_*', '*']) {
+      assert.throws(() => process.permission.drop('env', reference), {
+        code: 'ERR_INVALID_ARG_VALUE',
+      });
+    }
+    assert.strictEqual(process.permission.has('env', 'PERMISSION_ENV_ONE'), true);
+    assert.strictEqual(process.env.PERMISSION_ENV_ONE, 'one');
+    assert.strictEqual(process.env.PERMISSION_ENV_TWO, 'two');
+    `,
+  ],
+  { env },
+  {});