{"action":"created","issue":{"url":"https://api.github.com/repos/substack/node-browserify/issues/1405","labels_url":"https://api.github.com/repos/substack/node-browserify/issues/1405/labels{/name}","comments_url":"https://api.github.com/repos/substack/node-browserify/issues/1405/comments","events_url":"https://api.github.com/repos/substack/node-browserify/issues/1405/events","html_url":"https://github.com/substack/node-browserify/pull/1405","id":111910369,"number":1405,"title":"Remove unnecessary workaround to hide full path","user":{"login":"parshap","id":332258,"avatar_url":"https://avatars.githubusercontent.com/u/332258?v=3","gravatar_id":"","url":"https://api.github.com/users/parshap","html_url":"https://github.com/parshap","followers_url":"https://api.github.com/users/parshap/followers","following_url":"https://api.github.com/users/parshap/following{/other_user}","gists_url":"https://api.github.com/users/parshap/gists{/gist_id}","starred_url":"https://api.github.com/users/parshap/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parshap/subscriptions","organizations_url":"https://api.github.com/users/parshap/orgs","repos_url":"https://api.github.com/users/parshap/repos","events_url":"https://api.github.com/users/parshap/events{/privacy}","received_events_url":"https://api.github.com/users/parshap/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-10-16T20:59:45Z","updated_at":"2015-10-26T02:31:04Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/substack/node-browserify/pulls/1405","html_url":"https://github.com/substack/node-browserify/pull/1405","diff_url":"https://github.com/substack/node-browserify/pull/1405.diff","patch_url":"https://github.com/substack/node-browserify/pull/1405.patch"},"body":"This was previously added in 5fe121b to prevent the absolute path to the \"process\" module from exposed in the bundle.\r\n\r\nRecently a [change landed in *insert-module-globals*][1] that prevents this from happening in the first place by using relative paths instead of absolute paths, thus this workaround is no longer needed.\r\n\r\n[1]: https://github.com/substack/insert-module-globals/pull/54\r\n\r\nThis is technically a breaking change for those who are calling `require(\"_process\")` directly (which should not happen as it was never advertised as a public api). Should probably wait for a major version release anyway.\r\n\r\n**There are currently failing tests:** \r\n\r\n```\r\n    not ok 2 - cwd directory visible\r\n      ---\r\n      found: 2675\r\n      wanted: -1\r\n      compare: ===\r\n      at:\r\n        file: test/leak.js\r\n        line: 32\r\n        column: 11\r\n      source: |\r\n        t.equal(src.indexOf(process.cwd()), -1, 'cwd directory visible');\r\n      stack: >\r\n        test/leak.js:32:11\r\n        ...\r\n```\r\n\r\nThis is because the test checks for the existence of `process.cwd()` in the bundle, which exists because the basedir of the bundle is set to `/tmp/...` and the relative path from `/tmp/...` to where the process module is happens to include the `process.cwd()` substring in it: `../../../home/parshap/projects/node-browserify/node_modules/process/browser.js`.\r\n\r\nI'm not sure what the right approach is here.\r\n\r\n1. Is this ok, or we are allowing too much to be exposed in the odd case that the bundle basedir is in a completely different directory than where the browserify `node_modules` directory is?\r\n\r\n1. If it's ok, how should the test be changed? Should this assertion be removed?\r\n\r\n1. If it's not ok, should we add the same kind of workaround for `Buffer.isBuffer` (e.g., add a `require(\"_is-buffer\")` builtin)?"},"comment":{"url":"https://api.github.com/repos/substack/node-browserify/issues/comments/151004993","html_url":"https://github.com/substack/node-browserify/pull/1405#issuecomment-151004993","issue_url":"https://api.github.com/repos/substack/node-browserify/issues/1405","id":151004993,"user":{"login":"zertosh","id":830952,"avatar_url":"https://avatars.githubusercontent.com/u/830952?v=3","gravatar_id":"","url":"https://api.github.com/users/zertosh","html_url":"https://github.com/zertosh","followers_url":"https://api.github.com/users/zertosh/followers","following_url":"https://api.github.com/users/zertosh/following{/other_user}","gists_url":"https://api.github.com/users/zertosh/gists{/gist_id}","starred_url":"https://api.github.com/users/zertosh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zertosh/subscriptions","organizations_url":"https://api.github.com/users/zertosh/orgs","repos_url":"https://api.github.com/users/zertosh/repos","events_url":"https://api.github.com/users/zertosh/events{/privacy}","received_events_url":"https://api.github.com/users/zertosh/received_events","type":"User","site_admin":false},"created_at":"2015-10-26T02:31:04Z","updated_at":"2015-10-26T02:31:04Z","body":"As far as using relative paths for `process` and `buffer` (with the updated insert-module-globals), I think it's great. With relative paths you get deterministic builds in projects that have a local browserify (most everyone?).\r\n\r\nAs far as the information leaking that using `_process` aims to protect from: Before this change, you'd leak info if you used a local browserify, but not any info about your project if you used a global browserify. This change reverses that. Having `basedir` be outside of the project directory is like using a globally installed browserify.\r\n\r\nI'm totally in favor of this change since projects tend to use their own browserify. The test should be modified so that `basedir` is the `cwd` (so just omit it), and that's it.\r\n"}}