Skip to content

#1128 - Read FORCE_CONFIG_PATH at runtime in production builds #1161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EmbryoSpace wants to merge 1 commit into
base: development
Choose a base branch
from
Open

#1128 - Read FORCE_CONFIG_PATH at runtime in production builds #1161

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion public/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -424,7 +424,7 @@
mmgisglobal.role = "#{role}";
mmgisglobal.groups = "#{groups}";
mmgisglobal.NODE_ENV = "#{NODE_ENV}";
mmgisglobal.FORCE_CONFIG_PATH = "%FORCE_CONFIG_PATH%";
mmgisglobal.FORCE_CONFIG_PATH = "#{FORCE_CONFIG_PATH}";

@devin-ai-integration devin-ai-integration Bot Nov 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Forced configuration paths with ampersands fail

When FORCE_CONFIG_PATH contains &, Pug inserts & into the JavaScript string. loadConfigJson fetches the altered path, so the configured mission fails to load.

Learn more

Production builds convert this HTML into a Pug template, which escapes interpolated values as HTML. Script elements do not decode HTML entities, so an escaped character becomes part of the URL passed to loadConfigJson. This affects ampersands, apostrophes, and other escaped characters in an otherwise valid forced configuration path.

Example: With FORCE_CONFIG_PATH=public/R&D/config.json, the page sets the path to public/R&D/config.json. The browser requests that encoded path rather than public/R&D/config.json, and the mission fails to load.

Recommended fix: Serialize the runtime value as a JavaScript string for the script context rather than HTML-escaping it. Account for the HTML script closing sequence when generating the string, and test paths containing & and apostrophes in a rendered production page.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

mmgisglobal.CLEARANCE_NUMBER = "#{CLEARANCE_NUMBER}";
mmgisglobal.HOSTS = "#{HOSTS}";
mmgisglobal.PORT = "#{PORT}";
Expand Down
Loading