-
-
Notifications
You must be signed in to change notification settings - Fork 8k
Absolute paths of development environment are leaked to unminified production code #2623
Copy link
Copy link
Closed
Labels
Description
- Read the docs.
- Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to https://github.com/vuejs/vue-next instead.
- This is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
Describe the bug
"vite build" are currently leaking full paths from development environment if set to minify: false.
For example if project code is located on C:\users\sensitive-info-like-user-real-names\projects\myproject\source vite would add variable names like var C__users_sensitiveInfoLikeUserRealNames_projects_myproject_source_node_modules_objectInspect into production code generated by vite build.
I understand that not minifying code for production is not common, however code minification is not a security procedure and should not affect security matters in my opinion.
Reproduction
I'm pretty sure this behavior is universal for any vite project.
System Info
viteversion: 2.1.2- Operating System: Windows 10
- Node version: 15.9.0
- Package manager (npm/yarn/pnpm) and version: yarn 1.22.5
Logs (Optional if provided reproduction)
- Run
viteorvite buildwith the--debugflag. - Provide the error log here.
Reactions are currently unavailable