Lodash is exported to window

Do you want to request a feature or report a bug?

Bug

What is the current behavior?

import lodash from 'lodash';

Open a page in browser, go to console type window._. It is not undefined.

If the current behavior is a bug, please provide the steps to reproduce.

The source code is this:

  if (typeof define == 'function' && typeof define.amd == 'object' && define.amd) {
    // Expose lodash to the global object when an AMD loader is present to avoid
    // errors in cases where lodash is loaded by a script tag and not intended
    // as an AMD module. See http://requirejs.org/docs/errors.html#mismatch for
    // more details.
    root._ = _;

The transpiled code looks like the following:

 if (true) {
    // Expose lodash to the global object when an AMD loader is present to avoid
    // errors in cases where lodash is loaded by a script tag and not intended
    // as an AMD module. See http://requirejs.org/docs/errors.html#mismatch for
    // more details.
    root._ = _;

What is the expected behavior?

window._ should be undefined

If this is a feature request, what is motivation or use case for changing the behavior?

Please mention other relevant information such as the browser version, Node.js version, webpack version and Operating System.

webpack 2.2.0

Author: Fantashit

1 thought on “Lodash is exported to window

  1. @Vanuan

    how come it’s an established path to leak globals if you’re using RequireJS

    There’s good reading here and here. In the case of Lodash, it can’t be registered as a named module to allow it to be more easily aliased as underscore (Backbone support, etc.). When Lodash is loaded on a page there’s no way to know if it was loaded by an AMD loader or a traditional script tag so it has to export itself to the global object to handle the case where it’s on a page with an AMD loader but not loaded by it. If I recall correctly these paths where done at the time with the guidance of @jrburke, the creator of RequireJS and the AMD format.

    Update:
    Ah yes, here it is, see the code suggestions section of the RequireJS wiki.
    It points to these examples. Check out the amdWebGlobal.js example.

    BTW #3017 gets a 👍 from me based on Webpack’s current level of support.

Comments are closed.