lifecycle: keep private values out of child procs

[email protected] didn't include configuration values prefixed with an underscore
in the environment passed to chiled processes. [email protected] includes the
notion of scoped configuration, where a nerfed URL can be used to prefix
configuration, some of which might be underscore-prefixed without the
scope. Add that behavior to npm@2 and close this regression.

PR-URL: npm/npm#9348

lib/utils/lifecycle.js

@@ -324,7 +324,9 @@ function makeEnv (data, prefix, env) {
   var verPref = data.name + '@' + data.version + ':'
 
   keys.forEach(function (i) {
-    if (i.charAt(0) === '_' && i.indexOf('_' + namePref) !== 0) {
+    // in some rare cases (e.g. working with nerf darts), there are segmented
+    // "private" (underscore-prefixed) config names -- don't export
+    if (i.charAt(0) === '_' && i.indexOf('_' + namePref) !== 0 || i.match(/:_/)) {
       return
     }
     var value = npm.config.get(i)

test/tap/run-script-filter-private.js

@@ -0,0 +1,52 @@
+var fs = require('graceful-fs')
+var path = require('path')
+
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var test = require('tap').test
+
+var common = require('../common-tap')
+
+var pkg = path.resolve(__dirname, 'run-script-filter-private')
+
+var opts = { cwd: pkg }
+
+var json = {
+  name: 'run-script-filter-private',
+  version: '1.2.3'
+}
+
+var npmrc = '//blah.com:_harsh=realms\n'
+
+test('setup', function (t) {
+  cleanup()
+  mkdirp.sync(pkg)
+  fs.writeFileSync(
+    path.resolve(pkg, 'package.json'),
+    JSON.stringify(json, null, 2) + '\n'
+  )
+  fs.writeFileSync(
+    path.resolve(pkg, '.npmrc'),
+    npmrc
+  )
+  t.end()
+})
+
+test('npm run-script env', function (t) {
+  common.npm(['run-script', 'env'], opts, function (er, code, stdout, stderr) {
+    t.ifError(er, 'using default env script')
+    t.notOk(stderr, 'should not generate errors')
+    t.ok(stdout.indexOf('npm_config_init_version') > 0, 'expected values in var list')
+    t.notMatch(stdout, /harsh/, 'unexpected config not there')
+    t.end()
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  rimraf.sync(pkg)
+}

test/tap/run-script.js

@@ -1,4 +1,4 @@
-var fs = require('fs')
+var fs = require('graceful-fs')
 var path = require('path')
 
 var mkdirp = require('mkdirp')