Rollup-plugin-vue: Security and other concerns

[miljan-aleksic]

Thank you @znck for your good work.

version 4.3.1

The normalize script has some security concerns, the code component.__file = "/Users/[username]/path/to/component.vue" is rendering out sensitive information.

Beside that I don't see a way to get rid of the __vue_create_injector__ code.

[znck]

Is it okay if the file path is relative to cwd?

PS @Akryum: will devtools' open in editor work if __file is relative to cwd?

[miljan-aleksic]

For public projects that would be ok, for private ones still a concern. Could it be an optional setting?

[Akryum]

It should just be disabled in production/minified code, like in vue-loader.

[miljan-aleksic]

@znck, do you agree with @Akryum suggestion? It is going to be fixed?

On another similar note, if I am not exporting any classes, what is the __vue_create_injector__ used for?

[znck]

__vue_create_injector__ is used to inject styles to page at runtime. I have a WIP branch to remove it but it's blocked on https://github.com/vuejs/vue/issues/8296. non-SSR solution is ready though.

[miljan-aleksic]

I am compiling a library, for which I don't need anyting SSR or runtime related. Aiming for the cleanest possible output. If not possible to fix it soon, please make it optional.

[miljan-aleksic]

Thanks @znck!

[miljan-aleksic]

@znck, sorry to bother again. I just realized the SSR scripts are still present when processing vue files.

[znck]

Maybe I missed something. I'll check again.

[miljan-aleksic]

@znck, did you got the chance to check this?

[miljan-aleksic]

@znck, seems I found the issue, reported at https://github.com/vuejs/vue-component-compiler/issues/77

[lukasjuhas]

Is there any workaround for this? My generated budnles have my path in them.. I've tried several things but I cannot get it to dissapear. (component.__file)