jscrambler 6.4.26 → 6.4.28

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # jscrambler
 
+## 6.4.28
+
+### Patch Changes
+
+- [3d3cfc6]: Possibility to append or prepend scripts to specific files
+
+## 6.4.27
+
+### Patch Changes
+
+- [c346840]: Use private key for tagging
+
 ## 6.4.26
 
 ### Patch Changes

package/README.md

@@ -331,6 +331,29 @@ Instrument is used when you want to [Profile](https://docs.jscrambler.com/code-i
 
 **WARNING:** DO NOT SEND THIS CODE TO PRODUCTION AS IT IS NOT PROTECTED
 
+## Javascript Appending and Prepending
+
+This option is available in your configuration file and allows for Javascript files to be appended or prepended to specific files before protecting your code.
+It allows for multiple files to be affixed or prefixed with another file, without changing the original content of the file and more than one script can act on the same file - you can both append and prepend the same JS file with the desired scripts on the same protection.
+The concatenation of files can result in max file size errors - even though the original file may be under the max limit, the result of the concatenation may exceed this threshold.
+
+```json
+{
+  "beforeProtection": [
+    {
+      "type": "append-js",
+      "target": "/path/to/target/file.js",
+      "source": "/path/to/script/file.js"
+    },
+    {
+      "type": "prepend-js",
+      "target": "/path/to/target/file.js",
+      "source": "/path/to/script/file.js"
+    }
+  ]
+}
+```
+
 ## Symbol Table
 
 Jscrambler can import symbol tables to ensure certain global variables and object properties have specific names.

package/dist/bin/jscrambler.js

@@ -53,6 +53,61 @@ const validateForceAppEnvironment = env => {
   }
   return normalizeEnvironment;
 };
+const validateBeforeProtection = function () {
+  let beforeProtectionArray = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : [];
+  if (beforeProtectionArray.length === 0) {
+    return;
+  }
+  const mandatoryKeys = ['type', 'target', 'source'];
+  const usedTargets = new Set();
+  const usedSources = new Set();
+  beforeProtectionArray.filter(element => {
+    // Check if every array element has a type, a target and a source
+    const validateMandatoryKeys = mandatoryKeys.every(key => key in element);
+    if (!validateMandatoryKeys) {
+      console.error('Invalid structure on beforeProtection: each element must have the following structure { type: "type", target: "/path/to/target", source: "/path/to/script"}');
+      process.exit(1);
+    }
+    const {
+      target,
+      source,
+      type
+    } = element;
+
+    // Check if only valid types are being used
+    if (type !== _utils.APPEND_JS_TYPE && type !== _utils.PREPEND_JS_TYPE) {
+      console.error("Invalid type on beforeProtection: only \"".concat(_utils.APPEND_JS_TYPE, "\" or \"").concat(_utils.PREPEND_JS_TYPE, "\" are allowed."));
+      process.exit(1);
+    }
+
+    // Check if the provided files are js, mjs or cjs files
+    if (!(0, _utils.isJavascriptFile)(target) || !(0, _utils.isJavascriptFile)(source)) {
+      console.error('Invalid extension for beforeProtection target or source files: only *js, mjs and cjs* files can be used to append or prepend.');
+      process.exit(1);
+    }
+
+    // Check if the target has already been used as a source
+    if (usedTargets.has(source)) {
+      console.error("Error on beforeProtection: file \"".concat(source, "\" has already been used as target and can't be used as source."));
+      process.exit(1);
+    }
+    if (usedSources.has(target)) {
+      console.error("Error on beforeProtection: file \"".concat(target, "\" has already been used as source and can't be used as target."));
+      process.exit(1);
+    }
+
+    // Check if the target and source are the same
+    if (target === source) {
+      console.error("Error on beforeProtection: File \"".concat(target, "\" can't be used as both a target and a source."));
+      process.exit(1);
+    }
+
+    // Add the target and the source to the corresponding sets
+    usedTargets.add(target);
+    usedSources.add(source);
+  });
+  return beforeProtectionArray;
+};
 _commander.default.version(require('../../package.json').version).usage('[options] <file ...>').option('-a, --access-key <accessKey>', 'Access key').option('-c, --config <config>', 'Jscrambler configuration options').option('-H, --host <host>', 'Hostname').option('-i, --application-id <id>', 'Application ID').option('-o, --output-dir <dir>', 'Output directory').option('-p, --port <port>', 'Port').option('--base-path <path>', 'Base Path').option('--protocol <protocol>', 'Protocol (http or https)').option('--cafile <path>', 'Internal certificate authority').option('-C, --cwd <dir>', 'Current Working Directory').option('-s, --secret-key <secretKey>', 'Secret key').option('-m, --source-maps <id>', 'Download source maps').option('-R, --randomization-seed <seed>', 'Set randomization seed').option('--instrument', 'Instrument file(s) before start profiling. ATTENTION: previous profiling information will be deleted').option('--start-profiling', 'Starts profiling (assumes an already instrumented application)').option('--stop-profiling', 'Stops profiling').option('--code-hardening-threshold <threshold>', 'Set code hardening file size threshold. Format: {value}{unit="b,kb,mb"}. Example: 200kb', validateCodeHardeningThreshold).option('--recommended-order <bool>', 'Use recommended order', validateBool('recommended-order')).option('-W, --werror <bool>', 'Set werror flag value (default: true)', validateBool('werror')).option('--utc <bool>', 'Set UTC as the request time zone. Otherwise it uses the local time zone (default: true)', validateBool('utc')).option('--tolerate-minification <bool>', "Don't detect minification as malicious tampering (default: true)", validateBool('tolerate-minification')).option('--use-profiling-data <bool>', "(version 6.2 only) Protection should use the existing profiling data (default: true)", validateBool('use-profiling-data')).option('--profiling-data-mode <mode>', "(version 6.3 and above) Select profiling mode (default: automatic)", validateProfilingDataMode).option('--remove-profiling-data', "Removes the current application profiling information").option('--use-app-classification <bool>', '(version 6.3 and above) Protection should use Application Classification metadata when protecting (default: true)', validateBool('--use-app-classification')).option('--input-symbol-table <file>', '(version 6.3 and above) Protection should use symbol table when protecting. (default: no file)').option('--output-symbol-table <id>', '(version 6.3 and above) Download output symbol table (json)').option('--jscramblerVersion <version>', 'Use a specific Jscrambler version').option('--debugMode', 'Protect in debug mode').option('--skip-sources', 'Prevent source files from being updated').option('--force-app-environment <environment>', "(version 7.1 and above) Override application's environment detected automatically. Possible values: ".concat(availableEnvironments.toString()), validateForceAppEnvironment).option('--ensure-code-annotation <bool>', "(version 7.3 and above) Fail protection if no annotations are found on the source code (default: false)", validateBool('ensure-code-annotation')).option('-n <number>', "(version 7.2 and above) Create multiple protections at once.").parse(process.argv);
 let globSrc, filesSrc, config;
 
@@ -125,6 +180,9 @@ if (config.codeHardeningThreshold) {
 if (config.profilingDataMode) {
   config.profilingDataMode = validateProfilingDataMode(config.profilingDataMode);
 }
+if (config.beforeProtection) {
+  config.beforeProtection = validateBeforeProtection(config.beforeProtection);
+}
 globSrc = config.filesSrc;
 // If src paths have been provided
 if (_commander.default.args.length > 0) {
@@ -203,7 +261,8 @@ const {
   excludeList,
   numberOfProtections,
   ensureCodeAnnotation,
-  forceAppEnvironment
+  forceAppEnvironment,
+  beforeProtection
 } = config;
 const params = config.params;
 const incompatibleOptions = ['sourceMaps', 'instrument', 'startProfiling', 'stopProfiling'];
@@ -313,7 +372,8 @@ if (_commander.default.sourceMaps) {
       excludeList,
       ensureCodeAnnotation,
       numberOfProtections,
-      forceAppEnvironment
+      forceAppEnvironment,
+      beforeProtection
     });
     try {
       if (typeof werror !== 'undefined') {

package/dist/index.js

@@ -112,7 +112,8 @@ var _default = exports.default = {
    *  sources: Array.<{filename: string, content: string}>,
    *  filesSrc: Array.<string>,
    *  cwd: string,
-   *  appProfiling: ?object
+   *  appProfiling: ?object,
+   * runBeforeProtection?: Array<{type: string, target: string, source: string }>
    * }} opts
    * @returns {Promise<{extension: string, filename: string, content: *}>}
    */
@@ -121,7 +122,8 @@ var _default = exports.default = {
       sources,
       filesSrc,
       cwd,
-      appProfiling
+      appProfiling,
+      runBeforeProtection = []
     } = _ref;
     if (sources || filesSrc && filesSrc.length) {
       // prevent removing sources if profiling state is READY
@@ -145,7 +147,15 @@ var _default = exports.default = {
       if (debug) {
         console.log('Creating zip from source files');
       }
-      zipped = await (0, _zip.zip)(_filesSrc, cwd);
+      if (runBeforeProtection.length > 0) {
+        runBeforeProtection.map(element => {
+          if (!_filesSrc.includes(element.target)) {
+            console.error('Error on beforeProtection: Target files need to be in the files to protect list (or filesSrc).');
+            process.exit(1);
+          }
+        });
+      }
+      zipped = await (0, _zip.zip)(_filesSrc, cwd, runBeforeProtection);
     } else if (sources) {
       if (debug) {
         console.log('Creating zip from sources');
@@ -278,6 +288,7 @@ var _default = exports.default = {
     });
     let filesSrc = finalConfig.filesSrc;
     let filesDest = finalConfig.filesDest;
+    let runBeforeProtection = finalConfig.beforeProtection;
     if (sources) {
       filesSrc = undefined;
     }
@@ -317,7 +328,8 @@ var _default = exports.default = {
         sources,
         filesSrc,
         cwd,
-        appProfiling
+        appProfiling,
+        runBeforeProtection
       });
     } else {
       console.log('Update source files SKIPPED');

package/dist/utils.js

@@ -3,10 +3,15 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.PREPEND_JS_TYPE = exports.APPEND_JS_TYPE = void 0;
+exports.concatenate = concatenate;
 exports.getMatchedFiles = getMatchedFiles;
+exports.isJavascriptFile = isJavascriptFile;
 exports.validateNProtections = validateNProtections;
 var _glob = _interopRequireDefault(require("glob"));
 var _fs = _interopRequireDefault(require("fs"));
+var _fsExtra = require("fs-extra");
+var _path = require("path");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 /**
  * Return the list of matched files for minimatch patterns.
@@ -34,4 +39,55 @@ function validateNProtections(n) {
     process.exit(1);
   }
   return nProtections;
+}
+const APPEND_JS_TYPE = exports.APPEND_JS_TYPE = 'append-js';
+const PREPEND_JS_TYPE = exports.PREPEND_JS_TYPE = 'prepend-js';
+
+/**
+ * 
+ * @param {*} firstFile if prepending: script file; if appending: target file.
+ * @param {*} secondFile if prepending: target file; if appending: script file.
+ * @returns first and second files concatenated
+ */
+function handleScriptConcatenation(firstFile, secondFile) {
+  const firstFileContent = firstFile.toString('utf-8');
+  const secondFileContent = secondFile.toString('utf-8');
+  const concatenatedContent = firstFileContent + "\n" + secondFileContent;
+  return concatenatedContent;
+}
+
+/**
+ * 
+ * @param {*} scriptObject the object with the script content: { target: '/path/to/target/file', source: '/path/to/script/file', type: 'append-js' | 'prepend-js' }. Its used for both appending and prepending.
+ * @param {*} cwd current working directory, passed by argument
+ * @param {*} path file path (file being parsed)
+ * @param {*} buffer file contents
+ */
+function concatenate(scriptObject, cwd, path, buffer) {
+  let {
+    target
+  } = scriptObject;
+  if (cwd) {
+    target = (0, _path.join)(cwd, target);
+  }
+  target = (0, _path.normalize)(target);
+  if (target === path) {
+    const {
+      source,
+      type
+    } = scriptObject;
+    if (!(0, _fsExtra.existsSync)(source)) {
+      throw new Error('Provided script file does not exist');
+    }
+    const fileContent = (0, _fsExtra.readFileSync)(target);
+    const scriptContent = (0, _fsExtra.readFileSync)(source);
+    const concatContent = type === APPEND_JS_TYPE ? handleScriptConcatenation(fileContent, scriptContent) : handleScriptConcatenation(scriptContent, fileContent);
+    buffer = Buffer.from(concatContent, 'utf-8');
+  }
+  return buffer;
+}
+function isJavascriptFile(filename) {
+  const fileExtension = (0, _path.extname)(filename);
+  const validJsFileExtensions = ['.js', '.mjs', '.cjs'];
+  return validJsFileExtensions.includes(fileExtension);
 }

package/dist/zip.js

@@ -21,6 +21,7 @@ var _fsExtra = require("fs-extra");
 var _path2 = require("path");
 var _q = require("q");
 var _util = require("util");
+var _utils = require("./utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 // TODO Replace `sync` functions with async versions
 
@@ -28,7 +29,7 @@ const debug = !!process.env.DEBUG;
 
 // ./zip.js module is excluded from browser-like environments. We take advantage of that here.
 
-async function zip(files, cwd) {
+async function zip(files, cwd, runBeforeProtection) {
   debug && console.log('Zipping files', (0, _util.inspect)(files));
   const deferred = (0, _q.defer)();
   // Flag to detect if any file was added to the zip archive
@@ -77,6 +78,9 @@ async function zip(files, cwd) {
           name = files[i];
         }
         buffer = (0, _fsExtra.readFileSync)(sPath);
+        runBeforeProtection.map(element => {
+          buffer = (0, _utils.concatenate)(element, cwd, sPath, buffer);
+        });
       } else {
         // Else if it's a directory path
         zip.folder(sPath);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jscrambler",
   "description": "Jscrambler API client.",
-  "version": "6.4.26",
+  "version": "6.4.28",
   "homepage": "https://github.com/jscrambler/jscrambler",
   "author": "Jscrambler <support@jscrambler.com>",
   "repository": {