feat: set file basename to __file in production (#1368)

Author: chrisvfritz

Diff for: lib/index.js

@@ -170,10 +170,15 @@ var component = normalizer(
     code += `\n` + genHotReloadCode(id, hasFunctional, templateRequest)
   }
 
-  // Expose filename. This is used by the devtools and vue runtime warnings.
-  if (!isProduction) {
-    code += `\ncomponent.options.__file = ${JSON.stringify(rawShortFilePath)}`
-  }
+  // Expose filename. This is used by the devtools and Vue runtime warnings.
+  code += `\ncomponent.options.__file = ${
+    isProduction
+      // For security reasons, only expose the file's basename in production.
+      ? JSON.stringify(filename)
+      // Expose the file's full path in development, so that it can be opened
+      // from the devtools.
+      : JSON.stringify(rawShortFilePath)
+  }`
 
   code += `\nexport default component.exports`
   // console.log(code)

Diff for: test/advanced.spec.js

@@ -46,7 +46,7 @@ test('inherit queries on files', done => {
   })
 })
 
-test('expose filename', done => {
+test('expose file path as __file outside production', done => {
   mockBundleAndRun({
     entry: 'basic.vue'
   }, ({ module }) => {
@@ -55,6 +55,21 @@ test('expose filename', done => {
   })
 })
 
+test('expose file basename as __file in production', done => {
+  const origNodeEnv = process.env.NODE_ENV
+  process.env.NODE_ENV = 'production'
+  mockBundleAndRun(
+    {
+      entry: 'basic.vue'
+    },
+    ({ module }) => {
+      expect(module.__file).toBe('basic.vue')
+      process.env.NODE_ENV = origNodeEnv
+      done()
+    }
+  )
+})
+
 test('source map', done => {
   bundle({
     entry: 'basic.vue',