About import.meta.url

[NNBishoper]

Hi.

I use zip.js for my web project in browser.

Because of this, the bundle contains the env local path like "file:///*/@zip.js+zip.js@2.4.10/node_modules/@zip.js/zip.js/lib/zip-fs.js", which may cause the security issue.

Now my solution is to replace import.meta.url with '' before build, which is so trick.

Is there any way to solve this from your point of view. I think web project in browser is no need for this.

Thank you.

[gildas-lormeau]

Isn't this a bug in the bundling tool you're using?

[NNBishoper]

Isn't this a bug in the bundling tool you're using?

I don't think so. The project was built with Webpack in the building server, so import.meta.url would get the local env path, which is reasonable, like this:

// my usage

import { ZipReader, HttpReader, TextWriter, BlobWriter } from '@zip.js/zip.js';

// ...

// vendors.*.js

// ...

try{un="file:///*/@zip.js+zip.js@2.4.10/node_modules/@zip.js/zip.js/lib/zip-fs.js"}catch(cn){}Y({baseURL:un})

// ...

I just want to know is there any way to remove this by config, which I think is no need for web project in browser.

try {
	baseURL = import.meta.url;
} catch (error) {
	// ignored
}

If there is no good configurable way to solve this, I may keep the trick solution.

[gildas-lormeau]

It's a bug in webpack, here's the links to the corresponding issues webpack/webpack.js.org#6087, webpack/webpack#14445. It looks like it's adjustable though.

[gildas-lormeau]

@NNBishoper Did you try to set importMeta to false in your configuration file?

[NNBishoper]

@NNBishoper Did you try to set importMeta to false in your configuration file?

LGTM. I will try it later. Thank you so much.

[gildas-lormeau]

You're welcome. I'm closing and moving the issue in the Discussions tab to keep it visible.