Fix exposing of .env variables in Create React App

[moos]

Create React Apps have the nifty feature of getting environment variables either from the shell or .env files. These are then resolved and baked into the JS bundle by webpack.

When using debug, the entirety of your .env file gets exposed in the bundle, e.g.:

    function u() {
      var e;
      try {
        e = t.storage.debug
      } catch (e) {
      }
      return !e && "undefined" !== typeof r && "env" in r && (e = Object({
        NODE_ENV: "production",
        PUBLIC_URL: "",
        REACT_APP_FOO: "1"
      }).DEBUG), e
    }

This PR fixes that situation by moving the env access to a separate file that isn't accessed when in browser mode.

Also should resolve #467 (comment).

[coveralls]

Coverage increased (+1.2%) to 75.0% when pulling 3d42235 on moos:fix-cra-env into 22f9932 on visionmedia:master.

[coveralls]

Coverage increased (+1.2%) to 75.0% when pulling 3d42235 on moos:fix-cra-env into 22f9932 on visionmedia:master.

[coveralls]

Coverage increased (+2.2%) to 89.862% when pulling 86c9684 on moos:fix-cra-env into 5c7c61d on visionmedia:master.

[Qix-]

I'm 👎 on this. It's adding very specific checks where this is really a shortcoming in electron. Is this even still an issue? I know this is kind of an old PR.

[moos]

Yup - definitely still an issue. It's not an electron issue -- the code referenced above ends up in CRA bundle that's consumed by the browser, thereby exposing the entirety of CRA app's various .env files to the web site visitor -- clearly, an unintended (and hard-to-detect, unless you analyze the bundle -- I bet most app devs don't do that!) side-effect of .env + debug.

I'd be happy to submit an update if there is interest.

[Qix-]

Hi, sorry it took so long to get back. Could you rebase please? I'm okay with adding this check.

[moos]

So we can see that browser env was selected.

[moos]

--node and --electron get passed to test as process.env.npm_config_node and process.env.npm_config_electron.

[moos]

This is the critical part that was exposing process.env in the browser. It's been pulled out into the electron-specific flow.

[moos]

combines coverage for node + electron.

[moos]

holy 🐟 -- let's hope I don't have to do that again!

[moos]

Ping! Would hate to see this become stale again.