yarn build and the project contains the entire source code #1062

neilyoung · 2019-03-11T12:56:38Z

I came across this accidently. In the past I was used to have an obfuscated version of my SPA after "npm run build".

With the latest react-static (which does not work correctly with npm run build, but it passes with yarn build, see here #1053) there is the full source code available in user's browser. In the beginning I thought, this is just because there is somewhere a file link to the source code in a map or so and it would be only visible to me, but after deploying it to a webserver it was also available to all.

Steps to reproduce:

react-static create
use "blank" target
To visualize the issue add a console.log("Hello World") in App.js, but you could also browse the source tree in developer console

render () {
    console.log("Hello World")
    return (

run yarn build
run `yarn serve``
open localhost:3000 in your browser
open developer console
find Hello World and click the right most link to 'App.js:9'

Find your sources. Bummer

I never had this with previous react-static versions.

The text was updated successfully, but these errors were encountered:

tannerlinsley · 2019-03-11T20:17:00Z

Yeah, this definitely is a problem. I'm not sure how it's happening, but it could be that source maps are not being configured properly for production builds. Would you be willing to look into this more?

neilyoung · 2019-03-12T01:30:09Z

Sorry for the late answer, wasn't watching. Yes, sure, if I can help, let's try something. But I need some kicks, things like this is not my daily doing..

tannerlinsley · 2019-03-12T04:34:53Z

After doing a search in the basic template on my machine for my computer usernametannerlinsley, this is the preview. So at least we know the files to look in...

neilyoung · 2019-03-12T07:09:09Z

Hmm. This is the entire contents of a new folder which sprang into my eyes for the very first time I dealt with 6.9.3 and which is not there in earlier versions. The directory is called artifacts at the same level as node_modules and dist and is created by a yarn build and yarn start

Interestingly enough during yarn build there is a console trace, which claims, the folder is about to be cleaned, but this seems to not happen or is reverted later on.

Good catches so far. 👍

neilyoung · 2019-03-12T08:50:05Z

https://github.com/nozzle/react-static/blob/master/CHANGELOG.md
??

neilyoung · 2019-03-12T12:08:30Z

I stepped back a couple of versions. From 5.9.7 (this was my first step back from 6.3.9, but it still had all the sourecode in webpack build) to now 4.6.2

Namely the core dependencies look so:

    "axios": "^0.16.2",
    "react": "^16.0.2",
    "react-dom": "^16.2.0",
    "react-router": "^4.2.0",
    "react-static": "^4.6.0",

With this setup there is a problem with the hotloader, so I commented it for now and will return to the old style hotloading later.

But in the end npm run build worked, no artifacts folder and npm run serve without source code

neilyoung · 2019-03-13T19:38:28Z

@tannerlinsley Wondering, why this issue does not have more attention. I would say nobody would like to see his source code on the web while thinking it is at least obfuscated...

tannerlinsley · 2019-03-13T19:46:10Z

It's at the top of my security/priority list for React Static. I appreciate your patience as we all work to figure this out.

neilyoung · 2019-03-13T19:46:51Z

@tannerlinsley Thanks. Take your time. I'm having a work around so far

tannerlinsley · 2019-03-13T19:57:07Z

It appears that source maps are being created for non-staging production builds. While this should be a togglable feature, this is a regression that should not be the default. We'll need to tweak this setting here: https://github.com/nozzle/react-static/blob/master/packages/react-static/src/static/webpack/webpack.config.prod.js#L90.

For react-static build --staging builds, we'll likely want to have this default to true and for production builds, default to false. It should also be configurable somehow in the future, but is not very important right now.

neilyoung · 2019-03-13T20:01:04Z

@tannerlinsley Makes sense. Anything to do for me?

tannerlinsley · 2019-03-13T20:04:23Z

You could create a PR that does what I outlined there. Then we can iterate on it, get it merged and cut a release asap.

neilyoung · 2019-03-13T20:06:10Z

Currently trying to figure out if it fixes it. I have patched the script in my copy. To no avail so far, but I also changed some dependencies...

…

Am 13.03.2019 um 21:04 schrieb Tanner Linsley ***@***.***>: You could create a PR that does what I outlined there. Then we can iterate on it, get it merged and cut a release asap. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1062 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAsnjCtmNq_6kRA4JBwgx0w-TnbEzDFSks5vWVnIgaJpZM4boiNq>.

tannerlinsley · 2019-03-13T20:08:21Z

An easy way to verify: confirm that files like dist/main.js.map are not being created.

neilyoung · 2019-03-13T20:08:50Z

OK, on duty

neilyoung · 2019-03-13T20:25:16Z

@tannerlinsley No such a PR wouldn't help. I have patched the flag in my copy of the script at line 90 to sourceMap=false. Nevertheless there is an artifact dir on a fresh project and yarn build also produces souremaps in dist.

tannerlinsley · 2019-03-13T20:34:33Z

Oh, sorry, there is one more that needs to be taken care of. https://github.com/nozzle/react-static/blob/master/packages/react-static/src/static/webpack/webpack.config.prod.js#L128 should be set appropriately as well.

neilyoung · 2019-03-13T20:37:32Z

Hmm.. and what would be a proper value here?

tannerlinsley · 2019-03-13T20:39:46Z

Similar to my prior statement, it should default to true during a staging build and default to false in a production build.

neilyoung · 2019-03-13T20:41:01Z

You mean

devtool: false,

instead of

devtool: 'source-map',

?

neilyoung · 2019-03-13T20:42:45Z

No, doesn't help. I'm out here :)

tannerlinsley · 2019-03-13T20:48:45Z

Curious how are you testing these changes locally?

tannerlinsley · 2019-03-13T20:49:18Z

Just want to make sure we're being thorough.

neilyoung · 2019-03-13T20:50:00Z

I'm patching the node_modules/react-static/src/static/webpack/webpack.config.dev.js in my project EDIT: Sorry, .prod.js of course

…

Am 13.03.2019 um 21:48 schrieb Tanner Linsley ***@***.***>: How are you testing these changes locally? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1062 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAsnjLSUElJ-SfBDL_k6D-8W55nFQkTgks5vWWQugaJpZM4boiNq>.

tannerlinsley · 2019-03-13T21:13:35Z

If you're altering src files, then you'll need to compile first. Or, you could alter the same file but in the lib directory.

neilyoung · 2019-03-13T21:16:54Z

Oops, stupid me. Altered in lib folder, to no avail

neilyoung · 2019-03-13T21:19:02Z

Oh wait. artifacts is still there, but no maps... testing

neilyoung · 2019-03-13T21:19:42Z

Yepp. Looks good. Will try to make a PR

tannerlinsley · 2019-03-13T21:19:56Z

Awesome. Thanks!

neilyoung · 2019-03-13T21:43:42Z

Done #1067

digitalkaoz · 2019-03-26T04:32:50Z

@tannerlinsley i prefer to have sourcemaps for my whole app. dont disable that, they are only loaded when the dev tools are open, they are not included in the bundles

neilyoung · 2019-03-26T06:34:18Z

I'm not fanatic on this. I could live with a config switch, which prevent the sourceMap deployment in release builds

digitalkaoz · 2019-03-26T13:17:32Z

Simply dont Upload the .map files. Its Up to you neilyoung <notifications@github.com> schrieb am Di., 26. März 2019, 00:34:

…

I'm not fanatic on this. I could live with a config switch, which prevent the sourceMap deployment in release builds — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1062 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAR615z738PQa2_BYpUdE47tliSGy5o-ks5vab9ugaJpZM4boiNq> .

tannerlinsley · 2019-03-26T13:22:17Z

We'll have a config option for this sourceMaps: true and possibly some other options. This option will likely default to false, given that most people don't need source maps in production.

Yes, you could easily just not upload them, but I think that would provide more trouble for people who repeatedly have to remove them or exclude them from the build directory, etc. While that's still possible, I think the flag will be more intuitive for both use cases.

neilyoung · 2019-03-26T13:29:34Z

@tannerlinsley I don't currently have it on top of my head: Where is that config option?

And yes, simply don't upload would solve it too :)

neilyoung · 2019-03-26T13:32:38Z

Simply dont Upload the .map files. Its Up to you

True. The problem was: I'm using a particular react-static app in a Java app. The entire build process finally just triggered npm run build and made a copy of the dist directory into the Java app before deployment. Out of the sudden a react-static update gave me the source maps. I simply just didn't notice... That was unlucky, indeed.

tannerlinsley · 2019-03-26T13:32:43Z

It's not there yet. We haven't added it yet. We're discussing it right now :)

neilyoung · 2019-03-26T13:33:23Z

Ah ok, sorry. Got that wrong. Confused meanwhile :)

digitalkaoz · 2019-03-26T13:39:00Z

I dont get the Problem with sourcemaps?! Your Code is there anyways if minified or not. neilyoung <notifications@github.com> schrieb am Di., 26. März 2019, 07:33:

…

Ah ok, sorry. Got that wrong. Confused meanwhile :) — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1062 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAR610YZv3GotPCRYWcx6Fk1ErtAkZ0uks5vaiGmgaJpZM4boiNq> .

neilyoung · 2019-03-26T13:40:14Z

Well yes and no. It is there but I try to make my best to make it as unreadable as possible. OK now?

digitalkaoz · 2019-03-26T13:44:39Z

Yeah sure, but why? Is it bad code? Do you have api keys in there? The minification is even revertable, we only minimize for the transport. Look around on big Sites, most if not all deliver sourcemaps neilyoung <notifications@github.com> schrieb am Di., 26. März 2019, 07:40:

…

Well yes and no. It is there but I try to make my best to make it as unreadable as possible. OK now? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1062 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAR61y4d9pe1fg7aZSyyx5yv_CXExy7tks5vaiNCgaJpZM4boiNq> .

tannerlinsley · 2019-03-26T13:47:21Z

@digitalkaoz, @neilyoung is using an obfuscator to keep some of his code as mangled as possible to deter copying and/or theft.

While I agree that any IP should technically be kept behind a server for security, it should be possible to remove sourcemaps and obfuscate code. The obfuscation is not React Static's responsibility, since this goes beyond the call of duty for the library, but it's merely a webpack extension to achieve it.

neilyoung · 2019-03-26T13:47:53Z

I'm not just minimizing. I'm also obfuscating. I don't have API keys in, but I also don't want to give anything away for nothing. This is not an open source project. Anyway, there is also not that much secret in the JS code, since it serves a well documented API in Java Spark. But you never know, who comes around and says he has seen it all... I just want to distract the average user to look behind the curtain. Whoever is able to make this readable code, has deserved it, shall take his an be damned :)

If that isn't opportun, than I don't know what arguments would convince you

neilyoung · 2019-03-26T13:49:35Z

Ah and yes, it is for sure bad code :)

tannerlinsley · 2019-03-26T13:50:12Z

This conversation is likely to get off topic past what has been discussed. If you guys have anything else that pertains to the technical implementation of this feature, let me know, otherwise, I'll consider this issue ready to close as soon as we release the code.

neilyoung · 2019-03-26T13:51:14Z

Right, feel free to close. I'm having my solutions

tannerlinsley mentioned this issue Mar 14, 2019

Uglify with sourceMap includeSources #1068

Closed

neilyoung mentioned this issue Mar 15, 2019

Q: Is there a way to control the strengths of webpack's uglifier/obfuscator (if there is one)? #1069

Closed

tannerlinsley closed this as completed Mar 26, 2019

yarn build and the project contains the entire source code #1062

yarn build and the project contains the entire source code #1062

Comments

neilyoung commented Mar 11, 2019 • edited

tannerlinsley commented Mar 11, 2019 • edited

neilyoung commented Mar 12, 2019 • edited

tannerlinsley commented Mar 12, 2019 • edited

neilyoung commented Mar 12, 2019

neilyoung commented Mar 12, 2019

neilyoung commented Mar 12, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019 via email

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019 • edited

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019 via email • edited

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

neilyoung commented Mar 13, 2019

neilyoung commented Mar 13, 2019

tannerlinsley commented Mar 13, 2019

neilyoung commented Mar 13, 2019

digitalkaoz commented Mar 26, 2019

neilyoung commented Mar 26, 2019

digitalkaoz commented Mar 26, 2019 via email

tannerlinsley commented Mar 26, 2019

neilyoung commented Mar 26, 2019

neilyoung commented Mar 26, 2019 • edited

tannerlinsley commented Mar 26, 2019

neilyoung commented Mar 26, 2019

digitalkaoz commented Mar 26, 2019 via email

neilyoung commented Mar 26, 2019

digitalkaoz commented Mar 26, 2019 via email

tannerlinsley commented Mar 26, 2019

neilyoung commented Mar 26, 2019

neilyoung commented Mar 26, 2019

tannerlinsley commented Mar 26, 2019

neilyoung commented Mar 26, 2019

neilyoung commented Mar 11, 2019 •

edited

tannerlinsley commented Mar 11, 2019 •

edited

neilyoung commented Mar 12, 2019 •

edited

tannerlinsley commented Mar 12, 2019 •

edited

tannerlinsley commented Mar 13, 2019 •

edited

neilyoung commented Mar 13, 2019 via email •

edited

neilyoung commented Mar 26, 2019 •

edited