Skip to content

Absolute paths of development environment are leaked to unminified production code #2623

@Timsonrobl

Description

@Timsonrobl

⚠️ IMPORTANT ⚠️ Please do not ignore this template. If you do, your issue will be closed immediately.

Describe the bug

"vite build" are currently leaking full paths from development environment if set to minify: false.
For example if project code is located on C:\users\sensitive-info-like-user-real-names\projects\myproject\source vite would add variable names like var C__users_sensitiveInfoLikeUserRealNames_projects_myproject_source_node_modules_objectInspect into production code generated by vite build.
I understand that not minifying code for production is not common, however code minification is not a security procedure and should not affect security matters in my opinion.

Reproduction

I'm pretty sure this behavior is universal for any vite project.

System Info

  • vite version: 2.1.2
  • Operating System: Windows 10
  • Node version: 15.9.0
  • Package manager (npm/yarn/pnpm) and version: yarn 1.22.5

Logs (Optional if provided reproduction)

  1. Run vite or vite build with the --debug flag.
  2. Provide the error log here.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions