Skip to content

fix: prevent DOM elements with id="process" from hijacking environment detection - #540

Merged
ts-thomas merged 1 commit into
nextapps-de:masterfrom
FovirDev:fix/environment-detection
May 29, 2026
Merged

fix: prevent DOM elements with id="process" from hijacking environment detection#540
ts-thomas merged 1 commit into
nextapps-de:masterfrom
FovirDev:fix/environment-detection

Conversation

@FovirDev

@FovirDev FovirDev commented May 23, 2026

Copy link
Copy Markdown
Contributor

Problem

Browsers implement named access on windows object, which means any DOM element with an id attribute can be accessed via window.<id>.

For example, if an attribute's id is process, like:

<h2 id="process">Process</h2>

Then, window.process points to a DOM element instead of being undefined.

And FlexSearch's bundle entry point contains:

if(typeof module!=='undefined')self=module;else if(typeof process !== 'undefined')self=process;self._factory=_f;

When window.process is a DOM element, typeof process !== 'undefined' is true, so self is assigned to the DOM element, causing FlexSearch initialization to fail.

Fix

Add a typeof process.env !== 'undefined' to exclude DOM elements

if(typeof module!=='undefined')self=module;else if(typeof process !== 'undefined' && typeof process.env !== 'undefined')self=process;self._factory=_f;

@ts-thomas

Copy link
Copy Markdown
Contributor

Thanks a lot for this fix 🙏🙌

@ts-thomas
ts-thomas merged commit 6091f80 into nextapps-de:master May 29, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants