Pwa-studio: Strip JS Comments from Venia Production bundle

[supernova-at]

Because Venia will soon be both a reference storefront and an "as is / quick deploy" option for clients, we should outfit it with security best practices.

Comments left in JavaScript source files and delivered to end users can clue attackers in to potential weaknesses of the system. This is especially true for // TODO comments or similar.

Since these comments are still helpful to developers we don't want to lose them at the source code level. One potential solution that satisfies both conditions is to strip them from the final production bundle.

Venia uses a plugin called terser to configure its output webpack bundle.

According to this comment in terser-webpack-plugin, we should be able to set terserOption.output.comments to false when building for production to strip the comments from the bundle.

Note: Our product is still Open Source and attackers could just go view the source code. This is just a small step towards our goal.

[Banhawy]

Any idea how I would test this out? I made the recommended edit to webpack but I don't know which files to check before and after to see if it worked.

[zetlen]

@Banhawy Sorry it took a while to get back to you. You'd look in packages/venia-concept/dist/js in the contents of those files. It can be hard on text editors to open files of that size, so you might want to use a terminal command like head -n 5 packages/venia-concept/dist/js/client.js to get the first five lines of the file only (and that may still be pretty large!)

[supernova-at]

Here is where we set up the Terser Webpack Plugin: https://github.com/magento/pwa-studio/blob/c548fa8f8ecd1dd4beacbfecc7c22c694e1f9f74/packages/pwa-buildpack/lib/WebpackTools/configureWebpack.js#L330-L347.

[Banhawy]

I've been using the terser plugin with terserOption.output.comments set to false for a while now and forgot to share my results.

I honestly could not see any difference in output, all comments seemed to be extracted before and after adding the option.

After reviewing today I found out that the terserOption.output.comments option is set to false by default as per the plugin documentation.

I don't know if I should commit and make a PR anyways?

[supernova-at]

After reviewing today I found out that the terserOption.output.comments option is set to false by default as per the plugin documentation.

Oh okay awesome - thanks! I'll close this issue then 👍

[sirugh]

@supernova-at did you check the open PR for this issue: https://github.com/magento/pwa-studio/pull/1855

[sirugh]

Looks like, on develop, yarn build does indeed strip comments so the PR may be unnecessary.

That said, sw.js for some reason is not minified and still contains comments. I'm not sure how that file gets generated though.