rules-webpack

RISK: 'eval-source-map' devtool generates source maps inside eval() calls — this bypasses Content Security Policies that forbid eval (unsafe-eval) and increases bundle parse time. FIX: use 'source-map' for production (external .map file) or 'cheap-module-source-map' for development.

RISK: `allowedHosts: 'all'` / `disableHostCheck: true` in webpack-dev-server disables DNS-rebinding protection — a malicious site can use DNS rebinding to read your local bundle source and make API requests to the dev server on your behalf. FIX: restrict to explicit hostnames or keep the default (localhost only).

RISK: `devServer.host: '0.0.0.0'` exposes the webpack-dev-server on all network interfaces, making your local source and HMR WebSocket accessible to any host on the same network. FIX: keep host at 'localhost' (default); use an explicit ngrok/Tailscale tunnel if remote access is needed.

RISK: Inlining environment variables that contain server-side secrets (SECRET/PASSWORD/PRIVATE_KEY) via EnvironmentPlugin or DefinePlugin bakes them into the client bundle — every visitor's browser receives them (CWE-312). FIX: prefix only public, browser-safe vars (e.g. REACT_APP_* or NEXT_PUBLIC_*); keep secrets server-side.

RISK: An 'eval*' devtool in a production webpack config causes the output bundle to wrap every module in eval() strings. This violates any `script-src` CSP that omits 'unsafe-eval' and leaks full source code in the browser DevTools. FIX: set devtool to 'source-map' for production so source maps are in external .map files, never in eval strings.

RISK: An absolute `output.publicPath` pointing to a third-party domain (not your own CDN) loads your application chunks from an untrusted origin — if that origin is compromised, all visitors execute attacker-controlled JavaScript. FIX: use a relative publicPath ('/' or './') or your own controlled CDN origin with Subresource Integrity hashes.

optimization.noEmitOnErrors was renamed to optimization.emitOnErrors (inverted) in webpack 5. Using the old key is silently ignored, defeating the intent. FIX: replace with `optimization: { emitOnErrors: false }` (webpack 5+).

ADVISORY: `source-map-loader` without an `exclude` pattern will attempt to follow sourceMappingURL references in every dependency, including node_modules — this can pull in source maps containing internal upstream comments or accidentally bundle files outside the project root. FIX: restrict with `exclude: /node_modules/`.