fix: avoid leaking defined env vars when trying to access not defined env vars

[pieh]

fixes #10021

With current approach when process.env.NOT_EXISTING_ENV_VAR is used then bundle will contain:
Object({ NODE_ENV: "production", ...otherEnvVars }).NOT_EXISTING_ENV_VAR - with this approach it will produce: {}.NOT_EXISTING_ENV_VAR, while still being able to access all defined vars.

This is important because not only user code can be responsible for leaks - all imported npm packages can cause this as well.

Limitation - users won't be able to iterate over process.env object but this was exactly what was causing potential leak.

[DSchau]

Yeah - I think this looks great. Nice work @pieh 💪

[elskwid]

@pieh thank you for the security fix. I don't know the best place to make mention of this but the change will seriously impact anyone that is destructuring environment variables.

const { FOO, BAR } = process.env

Will result in undefined values for both.

[brimtown]

Is there a reason that this was not communicated as a breaking change? It's surprising to have an app break after a patch release 🙁 .

[jonniebigodes]

@brimtown this was brought to the attention of the team and from the flow of commits and the issue associated to it, needed to be patched with some urgency to prevent further damage to the people using gatsby.

[DSchau]

@brimtown you're definitely right, though. This probably should have been communicated and pushed out as something beyond a patch release. Minimally, we should have marked it as a breaking change so it shows up in CHANGELOG.md.

We're sorry for the confusion this has caused, and we'll attempt to improve the documentation and communication on these types of changes going forward!

[brimtown]

Thanks for the response. Appreciate the hard work yall are doing!

[elskwid]

@DSchau what @brimtown said. 😄 Thanks!