Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Vite: Improve handling of preview annotations #28798
base: next
Are you sure you want to change the base?
Vite: Improve handling of preview annotations #28798
Changes from 29 commits
a724e02
74be16e
e625e78
71c7c57
cdfe782
869d9e1
f33697e
52c56a5
d873110
7d1b3f0
1038c75
eddb6cd
d0c7fb5
1e98912
a404e3a
aef9463
83c947a
9cd753e
be2e4c8
27153b2
941324f
9391e2a
3f4900b
3235249
4ad25a5
300f6f4
531b527
3349a93
502248b
5680d8d
f5af3eb
48f2b8d
d411b19
d43c165
f8fdac1
90411b1
cc21e5f
00ecf1c
70dbdfd
7572f4c
ba7be49
984cb72
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't this pose a security vulnerability? Leaking the build-environment's filesystem directory-structure to the client bundle? I'm not a security expert at all, I just recall a few CVEs coming our way for exactly this, and I know we go out of our way in other places to ensure that nothing above the project root ends up in the bundle.
And maybe I'm misunderstanding this whole thing, and this doesn't actually end up in the bundle, and then it's fine. I was mostly just gauging this from the new tests.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, this only "leaks" the full path to vite - but vite will then replace it with the import of the correct output chunk upon bundling.