Repository navigation
DefinePlugin inserts entire object when desired object property is missing #15559
Description
Bug report
What is the current behavior?
We collect a bunch of secrets into an object and pass them into Typescript with the DefinePlugin:
const secrets = Object.assign({}, locals, defaults);
const config = {
...
devtool: "source-map",
resolve: {
extensions: [".ts", ".tsx", ".js", ".jsx"],
fallback: {
crypto: false
}
},
module: { ... },
plugins: [
new CKEditorWebpackPlugin({language: "en"}),
new webpack.DefinePlugin({
secrets: secrets
})
],
entry: {
app: "./src/frontend/ts/main.tsx"
},
output: {
path: path.join(__dirname, "public/js"),
publicPath: "js/",
filename: "[name].js",
chunkFilename: "[name].js"
},
externals: {
"react": "React",
"react-dom": "ReactDOM"
}
};And then refer to them individually like:
pushManager.subscribe({
userVisibleOnly: true,
applicationServerKey: secrets.VAPID_PUB_KEY
});But, if a given property like VAPID_PUB_KEY, is missing, the entire secrets object is substituted in place of
just the secrets part of the expression, so that it ends up producing:
pushManager.subscribe({
userVisibleOnly: true,
applicationServerKey: { ... }.VAPID_PUB_KEY
});
What is the expected behavior?
I would expect either an error to be thrown or for nothing to be substituted in the place.
I hope I don't have to express the potential for this to expose data that was never intended to be included in public javascript.
Other relevant information:
webpack version: 5.70.0
Node.js version: v16.13.0
Operating System: MacOS 12.1, Ubuntu 20.04
Activity
sokra commentedon Mar 28, 2022
We can fix that case, but with
DefinePlugin({ secrets })you are sayingreplace the "secrets" variable with my secrets, do webpack is doing that. What you want to do instead is to define it more grandular via:so it only replaces the direct reference to a secret.
@vankop will fix the case with
secrets.VAPID_PUB_KEYnonetheless, but how should we behave in case ofsomeCall(secrets)... (we will inline the whole object)webpack-bot commentedon Jun 27, 2022
This issue had no activity for at least three months.
It's subject to automatic issue closing if there is no activity in the next 15 days.
vankop commentedon Jun 30, 2022
@sokra please take a look #15562
webpack-bot commentedon Oct 15, 2022
Issue was closed because of inactivity.
If you think this is still a valid issue, please file a new issue with additional information.
knightcode commentedon Apr 4, 2025
noticed this happening again
alexander-akait commentedon Apr 4, 2025
@knightcode Please provide reproducible test repo
fix: resolve DefinePlugin undefined member access in more chain forms
fix: handle import.meta object keys in DefinePlugin undefined member …