Path of Vue component file is exposed by __vue_options__.__file.

[songsiqi]

I use vue-loader@^9.

__vue_options__.__file = "/Users/username/Documents/path/to/component.vue"
__vue_options__.render = __vue_template__.render
__vue_options__.staticRenderFns = __vue_template__.staticRenderFns

How to avoid this?

[LinusBorg]

This is disabled in production and is used in development to provide better error messages.

[fritx]

Excuse me, how to turn that minimize on ???

[LinusBorg]

Just minimize your code, e.g. with uglify webpack plugin. We already do or in our template.

[justblender]

I'm sorry for bumping this old issue, but is there any reason why even production builds now expose component's filename? Maybe there should be a way to disable this behavior?

[LinusBorg]

See:

vue-loader/lib/index.js

Lines 178 to 186 in f0beed3

	// Expose filename. This is used by the devtools and Vue runtime warnings.
	code += `\ncomponent.options.__file = ${
	isProduction
	// For security reasons, only expose the file's basename in production.
	? JSON.stringify(filename)
	// Expose the file's full path in development, so that it can be opened
	// from the devtools.
	: JSON.stringify(rawShortFilePath.replace(/\\/g, '/'))
	}`

[justblender]

I've seen this code multiple times. I just want to have a way to disable this behaviour since I don't rely on devtools and runtime warnings in production 😞 Maybe I shouldn't have migrated to Webpack 4..

[LinusBorg]

you can always

• Fork vue-loader
• Remove the code you don't like.

If you actually want to make an effort to have this changed in vue-loader itself, please open a feature request with an explanation about why this is a problem for you and why offering a way to remove it is valuable to you, and if you want to help us even more, send a PR.

Debates in months-old, closed issues easily get lost.

[ghost]

I have created #1446 to document the behavior.

[2-5]

For those who inspected their minified bundles and were most surprised by this undocumented sensitive information leak, here is how to fix it if you use webpack. We are going to go over the vue-loader output and strip it with a regular expression, with the help of the string-replace-loader plugin:

npm install --save-dev string-replace-loader

And in your webpack config:

module: {
  rules: [
    {
      test: /\.vue$/,
      use: [
        {
          loader: 'string-replace-loader',
          options: {
            search: '\\.options\\.__file = ".*"',
            replace: '.options.__file = "a.vue"',
            flags: '',
          },
        },
        { loader: 'vue-loader' },
      ],
    },
  ],
},

Of course, it's relatively fragile, so check periodically that it's still working.