Fix exposing of .env variables in Create React App #560

moos · 2018-04-18T06:36:53Z

Create React Apps have the nifty feature of getting environment variables either from the shell or .env files. These are then resolved and baked into the JS bundle by webpack.

When using debug, the entirety of your .env file gets exposed in the bundle, e.g.:

    function u() {
      var e;
      try {
        e = t.storage.debug
      } catch (e) {
      }
      return !e && "undefined" !== typeof r && "env" in r && (e = Object({
        NODE_ENV: "production",
        PUBLIC_URL: "",
        REACT_APP_FOO: "1"
      }).DEBUG), e
    }

This PR fixes that situation by moving the env access to a separate file that isn't accessed when in browser mode.

Also should resolve #467 (comment).

coveralls · 2018-04-18T06:39:29Z

Coverage increased (+1.2%) to 75.0% when pulling 3d42235 on moos:fix-cra-env into 22f9932 on visionmedia:master.

coveralls · 2018-04-18T06:39:29Z

Coverage increased (+1.2%) to 75.0% when pulling 3d42235 on moos:fix-cra-env into 22f9932 on visionmedia:master.

coveralls · 2018-04-18T06:39:29Z

Coverage increased (+2.2%) to 89.862% when pulling 86c9684 on moos:fix-cra-env into 5c7c61d on visionmedia:master.

…pts for devs

Qix- · 2018-06-20T19:10:04Z

I'm 👎 on this. It's adding very specific checks where this is really a shortcoming in electron. Is this even still an issue? I know this is kind of an old PR.

moos · 2018-08-30T05:11:23Z

Yup - definitely still an issue. It's not an electron issue -- the code referenced above ends up in CRA bundle that's consumed by the browser, thereby exposing the entirety of CRA app's various .env files to the web site visitor -- clearly, an unintended (and hard-to-detect, unless you analyze the bundle -- I bet most app devs don't do that!) side-effect of .env + debug.

I'd be happy to submit an update if there is interest.

Qix- · 2018-12-13T15:49:22Z

Hi, sorry it took so long to get back. Could you rebase please? I'm okay with adding this check.

merge from upstream

…pts for devs

…cra-env

moos · 2019-02-02T08:09:42Z

karma.conf.js

@@ -14,7 +14,7 @@ module.exports = function (config) {
 		// Test results reporter to use
 		// possible values: 'dots', 'progress'
 		// available reporters: https://npmjs.org/browse/keyword/karma-reporter
-		reporters: ['progress'],
+		reporters: ['mocha'],


So we can see that browser env was selected.

moos · 2019-02-02T08:10:46Z

package.json

@@ -25,9 +25,10 @@
  "license": "MIT",
  "scripts": {
    "lint": "xo",
-    "test": "npm run test:node && npm run test:browser",
+    "test": "npm --node run test:node && npm run test:browser && npm --electron run test:electron",


--node and --electron get passed to test as process.env.npm_config_node and process.env.npm_config_electron.

moos · 2019-02-02T08:12:23Z

src/browser.js

 	} catch (error) {
 		// Swallow
 		// XXX (@Qix-) should we be logging these?
 	}
-
-	// If debug isn't set in LS, and we're in Electron, try to load $DEBUG
-	if (!r && typeof process !== 'undefined' && 'env' in process) {


This is the critical part that was exposing process.env in the browser. It's been pulled out into the electron-specific flow.

moos · 2019-02-03T06:24:49Z

package.json

    "test:browser": "karma start --single-run",
+    "test:node": "istanbul cover --dir coverage/node -x test.js node_modules/mocha/bin/_mocha",
+    "test:electron": "istanbul cover --dir coverage/electron -x test.js node_modules/mocha/bin/_mocha",
+    "posttest": "istanbul report --include coverage/**/coverage.json",


combines coverage for node + electron.

…e to nyc!

moos · 2019-02-03T07:56:20Z

holy 🐟 -- let's hope I don't have to do that again!

moos · 2019-02-27T04:35:05Z

Ping! Would hate to see this become stale again.

moos added 2 commits April 17, 2018 23:20

fix exposing of .env variables in Create React App

b7816c0

minor fixes

3d42235

take II - completely separate Electron path, add convenience npm scri…

80ae3ae

…pts for devs

Qix- added feature This proposes or provides a feature or enhancement awaiting-response This issue or pull request is awaiting a user's response change-patch This proposes or provides a change that requires a patch release labels Jun 20, 2018

Qix- added this to the 5.x milestone Dec 19, 2018

moos added 6 commits February 1, 2019 22:14

Merge pull request #1 from visionmedia/master

fb16b70

merge from upstream

fix exposing of .env variables in Create React App

c9c6c70

minor fixes

76e69d2

take II - completely separate Electron path, add convenience npm scri…

11cc167

…pts for devs

Merge branch 'fix-cra-env' of https://github.com/moos/debug into fix-…

f348d51

…cra-env

Update after rebasing from upstream

52d06bf

moos commented Feb 2, 2019

View reviewed changes

fix lint, add more test cases and coverage

0fa1a28

moos commented Feb 3, 2019

View reviewed changes

moos added 3 commits February 2, 2019 22:39

hmmm... - fix travis-only failure!

4065feb

unable to get istanbul to work on travis combining two runs -- upgrad…

9a8a9cd

…e to nyc!

fix for old npm version

86c9684

snyk-bot mentioned this pull request Jul 17, 2021

[Snyk] Security upgrade xo from 0.23.0 to 0.42.0 ryan-ally/debug#9

Open

snyk-bot mentioned this pull request Jun 1, 2022

[Snyk] Fix for 16 vulnerabilities LadyK-21/debug#1

Open

snyk-bot mentioned this pull request Jun 22, 2022

[Snyk] Security upgrade xo from 0.23.0 to 0.42.0 LadyK-21/debug#6

Open

LadyK-21 mentioned this pull request Jun 23, 2022

[Snyk] Security upgrade xo from 0.23.0 to 0.40.3 LadyK-21/debug#7

Open

ryan-ally mentioned this pull request Jun 23, 2022

[Snyk] Security upgrade xo from 0.32.1 to 0.40.3 ryan-ally/debug#13

Open

LadyK-21 mentioned this pull request Oct 6, 2022

[Snyk] Fix for 16 vulnerabilities LadyK-21/debug#8

Open

This was referenced Oct 13, 2022

Build fails when config includes redocusaurus and docusaurus-theme-search-typesense rohit-gohri/redocusaurus#236

Open

Build fails when config includes redocusaurus and docusaurus-theme-search-typesense typesense/docusaurus-theme-search-typesense#23

Open

ryan-ally mentioned this pull request Nov 27, 2023

[Snyk] Security upgrade xo from 0.32.1 to 0.42.0 ryan-ally/debug#18

Open

This was referenced Nov 28, 2023

[Snyk] Fix for 5 vulnerabilities LadyK-21/debug#15

Open

[Snyk] Security upgrade xo from 0.23.0 to 0.42.0 LadyK-21/debug#16

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix exposing of .env variables in Create React App #560

Fix exposing of .env variables in Create React App #560

moos commented Apr 18, 2018

coveralls commented Apr 18, 2018

coveralls commented Apr 18, 2018

coveralls commented Apr 18, 2018 •

edited

Qix- commented Jun 20, 2018

moos commented Aug 30, 2018

Qix- commented Dec 13, 2018

moos Feb 2, 2019

moos Feb 2, 2019

moos Feb 2, 2019

moos Feb 3, 2019

moos commented Feb 3, 2019

moos commented Feb 27, 2019

Fix exposing of .env variables in Create React App #560

Are you sure you want to change the base?

Fix exposing of .env variables in Create React App #560

Conversation

moos commented Apr 18, 2018

coveralls commented Apr 18, 2018

coveralls commented Apr 18, 2018

coveralls commented Apr 18, 2018 • edited

Qix- commented Jun 20, 2018

moos commented Aug 30, 2018

Qix- commented Dec 13, 2018

moos Feb 2, 2019

Choose a reason for hiding this comment

moos Feb 2, 2019

Choose a reason for hiding this comment

moos Feb 2, 2019

Choose a reason for hiding this comment

moos Feb 3, 2019

Choose a reason for hiding this comment

moos commented Feb 3, 2019

moos commented Feb 27, 2019

coveralls commented Apr 18, 2018 •

edited