From f32c9d25e79aaa21e90bd4a06a6a2c51fa00370f Mon Sep 17 00:00:00 2001
From: Sergey Petushkov <petushkov.sergey@gmail.com>
Date: Thu, 30 Jun 2022 12:18:02 +0200
Subject: [PATCH] process: make process.config read only

Fixes: https://github.com/nodejs/node/issues/43581
---
 doc/api/deprecations.md                       |  5 +-
 doc/api/process.md                            | 19 ++---
 lib/internal/bootstrap/node.js                | 75 ++-----------------
 .../overwrite-config-preload-module.js        |  1 +
 test/parallel/test-process-config.js          |  3 +
 5 files changed, 23 insertions(+), 80 deletions(-)

diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 9dd2f7628d84b0..8faee2fde691f2 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -2889,12 +2889,15 @@ Prefer [`message.socket`][] over [`message.connection`][].
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/43627
+    description: End-of-Life.
   - version: v16.0.0
     pr-url: https://github.com/nodejs/node/pull/36902
     description: Runtime deprecation.
 -->
 
-Type: Runtime
+Type: End-of-Life
 
 The `process.config` property provides access to Node.js compile-time settings.
 However, the property is mutable and therefore subject to tampering. The ability
diff --git a/doc/api/process.md b/doc/api/process.md
index ecd53469ca4221..dff97fcfdced22 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -1041,6 +1041,9 @@ This feature is not available in [`Worker`][] threads.
 <!-- YAML
 added: v0.7.7
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/43627
+    description: The `process.config` object is now frozen.
   - version: v16.0.0
     pr-url: https://github.com/nodejs/node/pull/36902
     description: Modifying process.config has been deprecated.
@@ -1048,10 +1051,10 @@ changes:
 
 * {Object}
 
-The `process.config` property returns an `Object` containing the JavaScript
-representation of the configure options used to compile the current Node.js
-executable. This is the same as the `config.gypi` file that was produced when
-running the `./configure` script.
+The `process.config` property returns a frozen `Object` containing the
+JavaScript representation of the configure options used to compile the current
+Node.js executable. This is the same as the `config.gypi` file that was produced
+when running the `./configure` script.
 
 An example of the possible output looks like:
 
@@ -1085,14 +1088,6 @@ An example of the possible output looks like:
 }
 ```
 
-The `process.config` property is **not** read-only and there are existing
-modules in the ecosystem that are known to extend, modify, or entirely replace
-the value of `process.config`.
-
-Modifying the `process.config` property, or any child-property of the
-`process.config` object has been deprecated. The `process.config` will be made
-read-only in a future release.
-
 ## `process.connected`
 
 <!-- YAML
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index 0f72e3e67af306..a6439b77d0fe90 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -46,10 +46,8 @@ const {
   JSONParse,
   ObjectDefineProperty,
   ObjectGetPrototypeOf,
-  ObjectPreventExtensions,
   ObjectSetPrototypeOf,
-  ReflectGet,
-  ReflectSet,
+  ObjectFreeze,
   SymbolToStringTag,
   globalThis,
 } = primordials;
@@ -72,75 +70,18 @@ process._exiting = false;
 // process.config is serialized config.gypi
 const nativeModule = internalBinding('native_module');
 
-// TODO(@jasnell): Once this has gone through one full major
-// release cycle, remove the Proxy and setter and update the
-// getter to either return a read-only object or always return
-// a freshly parsed version of nativeModule.config.
-
-const deprecationHandler = {
-  warned: false,
-  message: 'Setting process.config is deprecated. ' +
-           'In the future the property will be read-only.',
-  code: 'DEP0150',
-  maybeWarn() {
-    if (!this.warned) {
-      process.emitWarning(this.message, {
-        type: 'DeprecationWarning',
-        code: this.code
-      });
-      this.warned = true;
-    }
-  },
-
-  defineProperty(target, key, descriptor) {
-    this.maybeWarn();
-    return ObjectDefineProperty(target, key, descriptor);
-  },
-
-  deleteProperty(target, key) {
-    this.maybeWarn();
-    delete target[key];
-  },
-
-  preventExtensions(target) {
-    this.maybeWarn();
-    return ObjectPreventExtensions(target);
-  },
-
-  set(target, key, value) {
-    this.maybeWarn();
-    return ReflectSet(target, key, value);
-  },
-
-  get(target, key, receiver) {
-    const val = ReflectGet(target, key, receiver);
-    if (val != null && typeof val === 'object') {
-      // eslint-disable-next-line node-core/prefer-primordials
-      return new Proxy(val, deprecationHandler);
-    }
-    return val;
-  },
-
-  setPrototypeOf(target, proto) {
-    this.maybeWarn();
-    return ObjectSetPrototypeOf(target, proto);
-  }
-};
-
-// eslint-disable-next-line node-core/prefer-primordials
-let processConfig = new Proxy(
-  JSONParse(nativeModule.config),
-  deprecationHandler);
+const processConfig = JSONParse(nativeModule.config, (_key, value) => {
+  // The `reviver` argument of the JSONParse method will visit all the values of
+  // the parsed config, including the "root" object, so there is no need to
+  // explicitly freeze the config outside of this method
+  return ObjectFreeze(value);
+});
 
 ObjectDefineProperty(process, 'config', {
   __proto__: null,
   enumerable: true,
   configurable: true,
-  get() { return processConfig; },
-  set(value) {
-    deprecationHandler.maybeWarn();
-    processConfig = value;
-  }
+  value: processConfig,
 });
 
 require('internal/worker/js_transferable').setup();
diff --git a/test/fixtures/overwrite-config-preload-module.js b/test/fixtures/overwrite-config-preload-module.js
index 21cb966a54988b..1c969a73c50654 100644
--- a/test/fixtures/overwrite-config-preload-module.js
+++ b/test/fixtures/overwrite-config-preload-module.js
@@ -2,4 +2,5 @@
 const common = require('../common');
 common.skipIfInspectorDisabled();
 
+delete process.config;
 process.config = {};
diff --git a/test/parallel/test-process-config.js b/test/parallel/test-process-config.js
index a48e107d4c22a3..20ebc36a996385 100644
--- a/test/parallel/test-process-config.js
+++ b/test/parallel/test-process-config.js
@@ -36,6 +36,9 @@ assert(Object.hasOwn(process, 'config'));
 // Ensure that `process.config` is an Object.
 assert.strictEqual(Object(process.config), process.config);
 
+// Ensure that you can't change config values
+assert.throws(() => { process.config.variables = 42; }, TypeError);
+
 const configPath = path.resolve(__dirname, '..', '..', 'config.gypi');
 
 if (!fs.existsSync(configPath)) {