solid-start icon indicating copy to clipboard operation
solid-start copied to clipboard

[Bug?]: File system routes bundle local paths in prod builds

Open n-p-e opened this issue 8 months ago • 0 comments

Duplicates

  • [x] I have searched the existing issues

Latest version

  • [x] I have tested the latest version

Current behavior 😯

Currently the prod js builds created by vinxi build would include full absolute paths of routes like so

path: '/',
filePath: '/path/to/project/src/routes/index.tsx'
...
path: '/*404',
filePath: '/path/to/project/src/routes/[...404].tsx'
...

These don't affect functionality but might be a minor security risk if the path where you build the app somehow contains sensitive information.

The RPCs created by 'use server' also have similar issues. They produce a /path/to/src/routes/index.tsx?tsr-directive-use-server= string.

Expected behavior 🤔

Ideally the full paths don't get bundled in prod builds. filePath doesn't mean anything in browsers/ssr so changing the output to filePath: '/src/routes/[...404].tsx' shouldn't be harmful.

Steps to reproduce 🕹

Steps:

  1. Create a starter project git clone [email protected]:solidjs/solid-start && cd solid-start/examples/basic && pnpm install
  2. pnpm run build
  3. grep -Horn "$PWD" .vinxi/build/client/_build

You should see some js files include your PWD. They get served in the final build.

Context 🔦

No response

Your environment 🌎


n-p-e avatar May 31 '25 11:05 n-p-e