fix(admin): stop leaking entire process.env into client bundle#1588
fix(admin): stop leaking entire process.env into client bundle#1588rohilsurana merged 3 commits intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 58 minutes and 26 seconds.Comment |
Coverage Report for CI Build 25158296339Coverage remained the same at 41.963%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
The vite define block `"process.env": process.env` injects every environment variable from the build machine into the production JS bundle. This exposes secrets, internal URLs, and system paths to any user who loads the admin app. Replace with explicit allowlist of the single env var the app uses.
rohilsurana
force-pushed
the
fix/admin-vite-env-leak
branch
from
e35dc5f to
624587b
Compare
3 participants
Summary
"process.env": process.envin thedefineblock, which injects every environment variable from the build machine into the production JS bundleSECURITY_TEST_SECRET), building, and finding it in the output JS alongsideVAULT_ADDR,GOPRIVATE,SHELL,TMPDIR, etc.NEXT_PUBLIC_FRONTIER_CONNECT_URL(the single env var the app actually uses)Test plan
SECURITY_TEST_SECRET=canary— canary NOT present in output bundlefrontier-connectfallback URL still present in bundleVAULT_ADDR,GOPRIVATE,SHELLetc. all absent)