Fix exposing of .env variables in Create React App by moos · Pull Request #560 · debug-js/debug · GitHub

Create React Apps have the nifty feature of getting environment variables either from the shell or .env files. These are then resolved and baked into the JS bundle by webpack.

When using debug, the entirety of your .env file gets exposed in the bundle, e.g.:

    function u() {
      var e;
      try {
        e = t.storage.debug
      } catch (e) {
      }
      return !e && "undefined" !== typeof r && "env" in r && (e = Object({
        NODE_ENV: "production",
        PUBLIC_URL: "",
        REACT_APP_FOO: "1"
      }).DEBUG), e
    }

This PR fixes that situation by moving the env access to a separate file that isn't accessed when in browser mode.

Also should resolve #467 (comment).

Coverage increased (+1.2%) to 75.0% when pulling 3d42235 on moos:fix-cra-env into 22f9932 on visionmedia:master.

Coverage increased (+2.2%) to 89.862% when pulling 86c9684 on moos:fix-cra-env into 5c7c61d on visionmedia:master.

…pts for devs

I'm 👎 on this. It's adding very specific checks where this is really a shortcoming in electron. Is this even still an issue? I know this is kind of an old PR.

Yup - definitely still an issue. It's not an electron issue -- the code referenced above ends up in CRA bundle that's consumed by the browser, thereby exposing the entirety of CRA app's various .env files to the web site visitor -- clearly, an unintended (and hard-to-detect, unless you analyze the bundle -- I bet most app devs don't do that!) side-effect of .env + debug.

I'd be happy to submit an update if there is interest.

Hi, sorry it took so long to get back. Could you rebase please? I'm okay with adding this check.

merge from upstream

…pts for devs

…cra-env

So we can see that browser env was selected.

--node and --electron get passed to test as process.env.npm_config_node and process.env.npm_config_electron.

This is the critical part that was exposing process.env in the browser. It's been pulled out into the electron-specific flow.

combines coverage for node + electron.

…e to nyc!

holy 🐟 -- let's hope I don't have to do that again!

Ping! Would hate to see this become stale again.

moos added 2 commits April 17, 2018 23:20

fix exposing of .env variables in Create React App

b7816c0

minor fixes

3d42235

take II - completely separate Electron path, add convenience npm scri…

80ae3ae

…pts for devs

Qix- added feature This proposes or provides a feature or enhancement awaiting-response This issue or pull request is awaiting a user's response change-patch This proposes or provides a change that requires a patch release labels Jun 20, 2018

Qix- added this to the 5.x milestone Dec 19, 2018

moos added 6 commits February 1, 2019 22:14

Merge pull request #1 from visionmedia/master

fb16b70

merge from upstream

fix exposing of .env variables in Create React App

c9c6c70

minor fixes

76e69d2

take II - completely separate Electron path, add convenience npm scri…

11cc167

…pts for devs

Merge branch 'fix-cra-env' of https://github.com/moos/debug into fix-…

f348d51

…cra-env

Update after rebasing from upstream

52d06bf

moos commented Feb 2, 2019

View reviewed changes

fix lint, add more test cases and coverage

0fa1a28

moos commented Feb 3, 2019

View reviewed changes

moos added 3 commits February 2, 2019 22:39

hmmm... - fix travis-only failure!

4065feb

unable to get istanbul to work on travis combining two runs -- upgrad…

9a8a9cd

…e to nyc!

fix for old npm version

86c9684

snyk-bot mentioned this pull request Jul 17, 2021

[Snyk] Security upgrade xo from 0.23.0 to 0.42.0 ryan-ally/debug#9

Open

snyk-bot mentioned this pull request Jun 1, 2022

[Snyk] Fix for 16 vulnerabilities LadyK-21/debug#1

Open

snyk-bot mentioned this pull request Jun 22, 2022

[Snyk] Security upgrade xo from 0.23.0 to 0.42.0 LadyK-21/debug#6

Open

LadyK-21 mentioned this pull request Jun 23, 2022

[Snyk] Security upgrade xo from 0.23.0 to 0.40.3 LadyK-21/debug#7

Open

ryan-ally mentioned this pull request Jun 23, 2022

[Snyk] Security upgrade xo from 0.32.1 to 0.40.3 ryan-ally/debug#13

Open

LadyK-21 mentioned this pull request Oct 6, 2022

[Snyk] Fix for 16 vulnerabilities LadyK-21/debug#8

Open

This was referenced Oct 13, 2022

Build fails when config includes redocusaurus and docusaurus-theme-search-typesense rohit-gohri/redocusaurus#236

Closed

Build fails when config includes redocusaurus and docusaurus-theme-search-typesense typesense/docusaurus-theme-search-typesense#23

Open

ryan-ally mentioned this pull request Nov 27, 2023

[Snyk] Security upgrade xo from 0.32.1 to 0.42.0 ryan-ally/debug#18

Open

This was referenced Nov 28, 2023

[Snyk] Fix for 5 vulnerabilities LadyK-21/debug#15

Open

[Snyk] Security upgrade xo from 0.23.0 to 0.42.0 LadyK-21/debug#16

Open

ryan-ally mentioned this pull request May 22, 2024

[Snyk] Security upgrade xo from 0.32.1 to 0.42.0 ryan-ally/debug#20

Open

LadyK-21 mentioned this pull request May 23, 2024

[Snyk] Fix for 2 vulnerabilities LadyK-21/debug#18

Open

               		// possible values: 'dots', 'progress'
               		// available reporters: https://npmjs.org/browse/keyword/karma-reporter
-              		reporters: ['progress'],
+              		reporters: ['mocha'],

                 "scripts": {
                   "lint": "xo",
-                  "test": "npm run test:node && npm run test:browser",
+                  "test": "npm --node run test:node && npm run test:browser && npm --electron run test:electron",

                   "test:browser": "karma start --single-run",
+                  "test:node": "istanbul cover --dir coverage/node -x test.js node_modules/mocha/bin/_mocha",
+                  "test:electron": "istanbul cover --dir coverage/electron -x test.js node_modules/mocha/bin/_mocha",
+                  "posttest": "istanbul report --include coverage/**/coverage.json",

Fix exposing of .env variables in Create React App by moos · Pull Request #560 · debug-js/debug · GitHub

Uh oh!

Fix exposing of .env variables in Create React App - #560

Fix exposing of .env variables in Create React App #560
moos wants to merge 13 commits into
debug-js:masterfrom
moos:fix-cra-env

moos commented Apr 18, 2018

Uh oh!

coveralls commented Apr 18, 2018

Uh oh!

coveralls commented Apr 18, 2018

Uh oh!

coveralls commented Apr 18, 2018 •
edited
Loading

Uh oh!

Uh oh!

Qix- commented Jun 20, 2018

Uh oh!

moos commented Aug 30, 2018

Uh oh!

Qix- commented Dec 13, 2018

Uh oh!

moos Feb 2, 2019

Uh oh!

moos Feb 2, 2019

Uh oh!

moos Feb 2, 2019

Uh oh!

moos Feb 3, 2019

Uh oh!

moos commented Feb 3, 2019

Uh oh!

moos commented Feb 27, 2019

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

               	}
-              	// If debug isn't set in LS, and we're in Electron, try to load $DEBUG
-              	if (!r && typeof process !== 'undefined' && 'env' in process) {

Fix exposing of .env variables in Create React App by moos · Pull Request #560 · debug-js/debug · GitHub

Uh oh!

Fix exposing of .env variables in Create React App - #560

Fix exposing of .env variables in Create React App #560moos wants to merge 13 commits intodebug-js:masterdebug-js/debug:masterfrom moos:fix-cra-envmoos/debug:fix-cra-envCopy head branch name to clipboard

Conversation

moos commented Apr 18, 2018

Uh oh!

coveralls commented Apr 18, 2018

Uh oh!

coveralls commented Apr 18, 2018

Uh oh!

coveralls commented Apr 18, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Qix- commented Jun 20, 2018

Uh oh!

moos commented Aug 30, 2018

Uh oh!

Qix- commented Dec 13, 2018

Uh oh!

moos Feb 2, 2019

Choose a reason for hiding this comment

Uh oh!

moos Feb 2, 2019

Choose a reason for hiding this comment

Uh oh!

moos Feb 2, 2019

Choose a reason for hiding this comment

Uh oh!

moos Feb 3, 2019

Choose a reason for hiding this comment

Uh oh!

moos commented Feb 3, 2019

Uh oh!

moos commented Feb 27, 2019

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Fix exposing of .env variables in Create React App #560
moos wants to merge 13 commits into
debug-js:masterfrom
moos:fix-cra-env

coveralls commented Apr 18, 2018 •
edited
Loading