{"action":"opened","issue":{"url":"https://api.github.com/repos/babel/babel/issues/1567","labels_url":"https://api.github.com/repos/babel/babel/issues/1567/labels{/name}","comments_url":"https://api.github.com/repos/babel/babel/issues/1567/comments","events_url":"https://api.github.com/repos/babel/babel/issues/1567/events","html_url":"https://github.com/babel/babel/issues/1567","id":77803759,"number":1567,"title":"SourceMap issue: `sources` including full system paths","user":{"login":"getify","id":150330,"avatar_url":"https://avatars.githubusercontent.com/u/150330?v=3","gravatar_id":"","url":"https://api.github.com/users/getify","html_url":"https://github.com/getify","followers_url":"https://api.github.com/users/getify/followers","following_url":"https://api.github.com/users/getify/following{/other_user}","gists_url":"https://api.github.com/users/getify/gists{/gist_id}","starred_url":"https://api.github.com/users/getify/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/getify/subscriptions","organizations_url":"https://api.github.com/users/getify/orgs","repos_url":"https://api.github.com/users/getify/repos","events_url":"https://api.github.com/users/getify/events{/privacy}","received_events_url":"https://api.github.com/users/getify/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-18T20:59:23Z","updated_at":"2015-05-18T20:59:23Z","closed_at":null,"body":"Running this:\r\n\r\n```js\r\nbabel.transformFileSync(\r\n   path.join(__dirname,\"foo\",\"baz\",\"bam.js\"),\r\n   {\r\n      \tsourceMaps: true,\r\n\tsourceMapName: \"bam.es5.js\"\r\n   }\r\n);\r\n```\r\n\r\nProduces a sourcemap like this:\r\n\r\n```js\r\n{ version: 3,\r\n  sources: [ '/full/system/path/foo/baz/bam.js' ],\r\n  file: 'bar.js.map',\r\n  // ..\r\n}\r\n```\r\n\r\nAs you can see, by default the entire filesystem path is included in the `sources` list when `transformFile[Sync](..)` with an absolute file path. This would almost certainly **never** be the desired behavior for a web served sourcemap, but I can see it may be preferred for using sourcemaps in a node environment.\r\n\r\nI know there's the `sourceFileName` option, which you can override this listing(s) in `sources`. I assume the intended behavior is that you're supposed to calculate your own appropriate filepaths and set them with this setting, as the spec calls for them to be relative to the location of where the source map itself is served from. There's also `sourceRoot` which when set and added to the map, means the consumer of the sourcemap is supposed to assume that this value is prepended to every relative URL, including those in the `sources` list.\r\n\r\nSo, here's my concern: I think it's unsafe for the default behavior to include the entire filesystem path in `sources` if `sourceFileName` is not passed. This default behavior is quite easy to accidentally leak perhaps sensitive/private information in a publicly web accessible file (the source map).\r\n\r\nI think the default behavior should change to assume to include only the filename in `sources` with whatever path stripped. For usage in node, where I can imagine having the full path is useful, the `sourceFileName` can be obviously be used to provide a full path as necessary.\r\n\r\nI just think the default behavior here should be more conservative and web-safe.\r\n"}}