jscrambler 8.10.9 → 8.11.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # jscrambler
 
+## 8.11.1
+
+### Patch Changes
+
+- [e473dc2]: Fix axios vulnerability
+
+## 8.11.0
+
+### Minor Changes
+
+- [63d90aa]: Add support for custom labels in protection requests
+
 ## 8.10.9
 
 ### Patch Changes

package/README.md

@@ -26,6 +26,7 @@ If you're looking to gain control over third-party tags and achieve PCI DSS comp
     - [Instrument (`--instrument`)](#instrument---instrument)
   - [Symbol Table](#symbol-table)
   - [Global Names Prefix](#global-names-prefix)
+  - [Custom labels (customLabels)](#custom-labels-customlabels)
   - [API](#api)
     - [Quick example](#quick-example)
   - [Jscrambler Parameters](#jscrambler-parameters)
@@ -146,6 +147,7 @@ Options:
   --protection-report <string>            (version 8.4 and above) Protection id for the metadata report
   --use-global-names-on-modules <bool>    (version 8.5 and above) Force the usage of more complex names on modules (default: false)
   --generate-alias <bool>                 Generate alias for the transformations (default: true)
+  --custom-label <key=value>              Attach a custom label to the protection (repeatable)
   -h, --help                              output usage information
 ```
 
@@ -441,6 +443,33 @@ If you apply the previous configuration, all generated global variable names wil
 
 ***Note***: The `globalNamesPrefix` parameter must be **short** and **unintelligible** to avoid code size increase and automated attacks
 
+## Custom labels (customLabels)
+
+You can attach optional **custom labels** to a protection request: a plain object of string keys and string values. They are sent to the API as **`customLabels`** (for example to record build environment, version, or CI metadata). Your Jscrambler API version must support this field; on older APIs the client may omit it and print a warning.
+
+### Configuration file
+
+Add a `customLabels` object next to your other options (for example in `.jscramblerrc` or a file passed with `-c, --config`):
+
+```json
+{
+  "customLabels": {
+    "env": "production",
+    "version": "9.2.2"
+  }
+}
+```
+
+Keys must be non-empty strings; values must be strings (use quoted JSON for numeric-looking values, e.g. `"9.2.2"`).
+
+### CLI
+
+Use **`--custom-label`** with `key=value`. You can pass it multiple times. Only the first `=` splits the key from the value (so values may contain `=`). If the same key appears in the config file and on the command line, the **CLI value wins**.
+
+```bash
+jscrambler -c config.json --custom-label env=production --custom-label version=9.2.2 -o out/ "src/**/*.js"
+```
+
 ## API
 ```bash
 npm install jscrambler

package/dist/bin/jscrambler.js

@@ -106,7 +106,20 @@ const validateBeforeProtection = function () {
   });
   return beforeProtectionArray;
 };
-_commander.default.version(require('../../package.json').version).usage('[options] <file ...>').option('-a, --access-key <accessKey>', 'Access key').option('-c, --config <config>', 'Jscrambler configuration options').option('-H, --host <host>', 'Hostname').option('-i, --application-id <id>', 'Application ID').option('-o, --output-dir <dir>', 'Output directory').option('-p, --port <port>', 'Port').option('--base-path <path>', 'Base Path').option('--protocol <protocol>', 'Protocol (http or https)').option('--cafile <path>', 'Internal certificate authority').option('-C, --cwd <dir>', 'Current Working Directory').option('-s, --secret-key <secretKey>', 'Secret key').option('-m, --source-maps <id>', 'Download source maps').option('-R, --randomization-seed <seed>', 'Set randomization seed').option('--instrument', 'Instrument file(s) before start profiling. ATTENTION: previous profiling information will be deleted').option('--start-profiling', 'Starts profiling (assumes an already instrumented application)').option('--stop-profiling', 'Stops profiling').option('--code-hardening-threshold <threshold>', 'Set code hardening file size threshold. Format: {value}{unit="b,kb,mb"}. Example: 200kb', validateCodeHardeningThreshold).option('--recommended-order <bool>', 'Use recommended order', validateBool('recommended-order')).option('-W, --werror <bool>', 'Set werror flag value (default: true)', validateBool('werror')).option('--utc <bool>', 'Set UTC as the request time zone. Otherwise it uses the local time zone (default: true)', validateBool('utc')).option('--tolerate-minification <bool>', "Don't detect minification as malicious tampering (default: true)", validateBool('tolerate-minification')).option('--use-profiling-data <bool>', "(version 6.2 only) Protection should use the existing profiling data (default: true)", validateBool('use-profiling-data')).option('--profiling-data-mode <mode>', "(version 6.3 and above) Select profiling mode (default: automatic)", validateProfilingDataMode).option('--remove-profiling-data', "Removes the current application profiling information").option('--use-app-classification <bool>', '(version 6.3 and above) Protection should use Application Classification metadata when protecting (default: true)', validateBool('--use-app-classification')).option('--input-symbol-table <file>', '(version 6.3 and above) Protection should use symbol table when protecting. (default: no file)').option('--output-symbol-table <id>', '(version 6.3 and above) Download output symbol table (json)').option('--jscramblerVersion <version>', 'Use a specific Jscrambler version').option('--debugMode', 'Protect in debug mode').option('--skip-sources', 'Prevent source files from being updated').option('--force-app-environment <environment>', "(version 7.1 and above) Override application's environment detected automatically. Possible values: ".concat(availableEnvironments.toString()), validateForceAppEnvironment).option('--ensure-code-annotation <bool>', "(version 7.3 and above) Fail protection if no annotations are found on the source code (default: false)", validateBool('ensure-code-annotation')).option('-n <number>', "(version 7.2 and above) Create multiple protections at once.").option('--delete-protection-on-success <bool>', 'Deletes the protection files after they have been protected and downloaded (default: false)', validateBool('--delete-protection-on-success')).option('--mode <mode>', "(version 8.4 and above) Define protection mode. Possible values: automatic, manual (default: manual)", validateMode).option('--save-src <bool>', 'Protection should save application sources (default: true)', validateBool('--save-src')).option('--protection-report <string>', '(version 8.4 and above) Protection id for the metadata report').option('--use-global-names-on-modules <bool>', '(version 8.5 and above) Force the usage of more complex names on modules').option('--balance', '(version 8.4 and above) Gets the balance of the user').option('--generate-alias <bool>', '(version 8.5 and above) Generate alias for the transformations (default: true)', validateBool('--generate-alias')).parse(process.argv);
+const parseCustomLabelCommandLineOption = function (val) {
+  let accumulator = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  const idx = val.indexOf('=');
+  if (idx < 1) {
+    console.error("*--custom-label* expects key=value (for example --custom-label \"env=production\"), got \"".concat(val, "\""));
+    process.exit(1);
+  }
+  const key = val.slice(0, idx);
+  const value = val.slice(idx + 1);
+  return _objectSpread(_objectSpread({}, accumulator), {}, {
+    [key]: value
+  });
+};
+_commander.default.version(require('../../package.json').version).usage('[options] <file ...>').option('-a, --access-key <accessKey>', 'Access key').option('-c, --config <config>', 'Jscrambler configuration options').option('-H, --host <host>', 'Hostname').option('-i, --application-id <id>', 'Application ID').option('-o, --output-dir <dir>', 'Output directory').option('-p, --port <port>', 'Port').option('--base-path <path>', 'Base Path').option('--protocol <protocol>', 'Protocol (http or https)').option('--cafile <path>', 'Internal certificate authority').option('-C, --cwd <dir>', 'Current Working Directory').option('-s, --secret-key <secretKey>', 'Secret key').option('-m, --source-maps <id>', 'Download source maps').option('-R, --randomization-seed <seed>', 'Set randomization seed').option('--instrument', 'Instrument file(s) before start profiling. ATTENTION: previous profiling information will be deleted').option('--start-profiling', 'Starts profiling (assumes an already instrumented application)').option('--stop-profiling', 'Stops profiling').option('--code-hardening-threshold <threshold>', 'Set code hardening file size threshold. Format: {value}{unit="b,kb,mb"}. Example: 200kb', validateCodeHardeningThreshold).option('--recommended-order <bool>', 'Use recommended order', validateBool('recommended-order')).option('-W, --werror <bool>', 'Set werror flag value (default: true)', validateBool('werror')).option('--utc <bool>', 'Set UTC as the request time zone. Otherwise it uses the local time zone (default: true)', validateBool('utc')).option('--tolerate-minification <bool>', "Don't detect minification as malicious tampering (default: true)", validateBool('tolerate-minification')).option('--use-profiling-data <bool>', "(version 6.2 only) Protection should use the existing profiling data (default: true)", validateBool('use-profiling-data')).option('--profiling-data-mode <mode>', "(version 6.3 and above) Select profiling mode (default: automatic)", validateProfilingDataMode).option('--remove-profiling-data', "Removes the current application profiling information").option('--use-app-classification <bool>', '(version 6.3 and above) Protection should use Application Classification metadata when protecting (default: true)', validateBool('--use-app-classification')).option('--input-symbol-table <file>', '(version 6.3 and above) Protection should use symbol table when protecting. (default: no file)').option('--output-symbol-table <id>', '(version 6.3 and above) Download output symbol table (json)').option('--jscramblerVersion <version>', 'Use a specific Jscrambler version').option('--debugMode', 'Protect in debug mode').option('--skip-sources', 'Prevent source files from being updated').option('--force-app-environment <environment>', "(version 7.1 and above) Override application's environment detected automatically. Possible values: ".concat(availableEnvironments.toString()), validateForceAppEnvironment).option('--ensure-code-annotation <bool>', "(version 7.3 and above) Fail protection if no annotations are found on the source code (default: false)", validateBool('ensure-code-annotation')).option('-n <number>', "(version 7.2 and above) Create multiple protections at once.").option('--delete-protection-on-success <bool>', 'Deletes the protection files after they have been protected and downloaded (default: false)', validateBool('--delete-protection-on-success')).option('--mode <mode>', "(version 8.4 and above) Define protection mode. Possible values: automatic, manual (default: manual)", validateMode).option('--save-src <bool>', 'Protection should save application sources (default: true)', validateBool('--save-src')).option('--protection-report <string>', '(version 8.4 and above) Protection id for the metadata report').option('--use-global-names-on-modules <bool>', '(version 8.5 and above) Force the usage of more complex names on modules').option('--balance', '(version 8.4 and above) Gets the balance of the user').option('--generate-alias <bool>', '(version 8.5 and above) Generate alias for the transformations', validateBool('--generate-alias')).option('--custom-label <key=value>', 'Attach a custom label to the protection (repeatable). Example: --custom-label "env=production"', parseCustomLabelCommandLineOption, {}).parse(process.argv);
 let globSrc, filesSrc, config;
 
 // If -c, --config file was provided
@@ -117,6 +130,9 @@ if (_commander.default.config) {
 } else {
   config = {};
 }
+
+// Merge explicit config file (specified by CLI flag `--config`) with `.jscramblerrc` (`_config` fills undefined keys)
+config = (0, _lodash.default)(config, _config2.default);
 config.accessKey = _commander.default.accessKey || (config.keys ? config.keys.accessKey : undefined);
 config.secretKey = _commander.default.secretKey || (config.keys ? config.keys.secretKey : undefined);
 config.host = _commander.default.host || config.host;
@@ -174,7 +190,19 @@ if (_commander.default.forceAppEnvironment) {
 } else {
   config.forceAppEnvironment = config.forceAppEnvironment ? validateForceAppEnvironment(config.forceAppEnvironment) : undefined;
 }
-config = (0, _lodash.default)(config, _config2.default);
+
+// Validate customLabels from file config
+try {
+  config.customLabels = (0, _utils.validateCustomLabels)(config.customLabels);
+} catch (err) {
+  console.error(err.message);
+  process.exit(1);
+}
+// Merge file config with CLI `--custom-label` flags (CLI wins on duplicate keys)
+config.customLabels = _objectSpread(_objectSpread({}, config.customLabels), _commander.default.customLabel || {});
+if (Object.keys(config.customLabels).length === 0) {
+  delete config.customLabels;
+}
 config.numberOfProtections = (0, _utils.validateNProtections)(_commander.default.N);
 if (config.codeHardeningThreshold) {
   config.codeHardeningThreshold = validateCodeHardeningThreshold(config.codeHardeningThreshold);
@@ -281,7 +309,8 @@ const {
   saveSrc,
   globalNamesPrefix,
   useGlobalNamesOnModules,
-  generateAlias
+  generateAlias,
+  customLabels
 } = config;
 const params = config.params;
 const incompatibleOptions = ['sourceMaps', 'instrument', 'startProfiling', 'stopProfiling'];
@@ -425,7 +454,8 @@ if (_commander.default.balance) {
       saveSrc,
       globalNamesPrefix,
       useGlobalNamesOnModules,
-      generateAlias
+      generateAlias,
+      customLabels
     });
     try {
       if (typeof werror !== 'undefined') {

package/dist/cleanup-input-fields.js

@@ -16,9 +16,9 @@ function cleanupInputFields(args, fragments) {
     if (!hasFieldArg && typeof options[field] !== 'undefined') {
       options[field] = undefined;
       cleanedUpFragments = cleanedUpFragments.replace(new RegExp(",?[s|\n]*".concat(field)), '');
-      console.warn("This API Version does not support the ".concat(field, " argument."));
+      console.warn("Warning: This API Version does not support the '".concat(field, "' argument."));
     }
   }
-  ['tolerateMinification', 'useProfilingData', 'useAppClassification', 'inputSymbolTable', 'entryPoint', 'ensureCodeAnnotation', 'generateAlias'].forEach(fieldCleanUp);
+  ['tolerateMinification', 'useProfilingData', 'useAppClassification', 'inputSymbolTable', 'entryPoint', 'ensureCodeAnnotation', 'generateAlias', 'customLabels'].forEach(fieldCleanUp);
   return [options, cleanedUpFragments];
 }

package/dist/index.js

@@ -221,6 +221,7 @@ var _default = exports.default = {
   // {
   //   "filesSrc": [""],
   //   "params": {},
+  //   "customLabels": { "env": "production", "version": "9.2.2" },
   //   "cwd": "",
   //   "host": "api.jscrambler.com",
   //   "port": "443",
@@ -233,6 +234,9 @@ var _default = exports.default = {
   //
   // `params` if provided will replace all the application transformation parameters.
   //
+  // `customLabels` if provided attaches string key-value metadata to the protection request
+  // (API must support this field).
+  //
   // `cwd` allows you to set the current working directory to resolve problems with
   // relative paths with your `filesSrc` is outside the current working directory.
   //
@@ -286,7 +290,8 @@ var _default = exports.default = {
       saveSrc,
       globalNamesPrefix,
       useGlobalNamesOnModules,
-      generateAlias
+      generateAlias,
+      customLabels
     } = finalConfig;
     const {
       accessKey,
@@ -416,6 +421,10 @@ var _default = exports.default = {
       useGlobalNamesOnModules,
       generateAlias
     });
+    const normalizedCustomLabels = (0, _utils.validateCustomLabels)(customLabels);
+    if (Object.keys(normalizedCustomLabels).length) {
+      protectionOptions.customLabels = normalizedCustomLabels;
+    }
     if (finalConfig.inputSymbolTable) {
       const inputSymbolTableContents = await _fs.default.promises.readFile(finalConfig.inputSymbolTable, 'utf-8');
       protectionOptions.inputSymbolTable = inputSymbolTableContents;

package/dist/utils.js

@@ -7,8 +7,10 @@ exports.PREPEND_JS_TYPE = exports.APPEND_JS_TYPE = void 0;
 exports.concatenate = concatenate;
 exports.getMatchedFiles = getMatchedFiles;
 exports.isJavascriptFile = isJavascriptFile;
+exports.validateCustomLabels = validateCustomLabels;
 exports.validateNProtections = validateNProtections;
 exports.validateThresholdFn = void 0;
+require("core-js/modules/web.dom-collections.iterator.js");
 var _glob = require("glob");
 var _fs = _interopRequireDefault(require("fs"));
 var _path = require("path");
@@ -41,6 +43,33 @@ function validateNProtections(n) {
   }
   return nProtections;
 }
+
+/**
+ * Validate protection `customLabels`: a plain object with non-empty keys and string values.
+ * @param {*} customLabels From config or programmatic options; omit or pass `undefined` for none.
+ * @returns {Object.<string, string>} A shallow copy when valid; `{}` when `customLabels` is `undefined`.
+ * @throws {Error} If `customLabels` is `null`, an array, a non-object, or has invalid keys/values.
+ */
+function validateCustomLabels(customLabels) {
+  if (typeof customLabels === 'undefined') {
+    return {};
+  }
+  if (customLabels === null || typeof customLabels !== 'object' || Array.isArray(customLabels)) {
+    throw new Error('Invalid *customLabels*: expected a plain object. Eg: { "env": "production", "version": "9.2.2" }');
+  }
+  const out = {};
+  for (const key of Object.keys(customLabels)) {
+    if (!key) {
+      throw new Error('Invalid *customLabels*: keys must be non-empty strings. Eg: { "env": "production", "version": "9.2.2" }');
+    }
+    const value = customLabels[key];
+    if (typeof value !== 'string') {
+      throw new Error("Invalid *customLabels*: value for \"".concat(key, "\" must be a string. Eg: { \"env\": \"production\", \"version\": \"9.2.2\" }"));
+    }
+    out[key] = value;
+  }
+  return out;
+}
 const APPEND_JS_TYPE = exports.APPEND_JS_TYPE = 'append-js';
 const PREPEND_JS_TYPE = exports.PREPEND_JS_TYPE = 'prepend-js';
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jscrambler",
   "description": "Jscrambler Code Integrity API client.",
-  "version": "8.10.9",
+  "version": "8.11.1",
   "homepage": "https://github.com/jscrambler/jscrambler",
   "author": "Jscrambler <support@jscrambler.com>",
   "repository": {
@@ -21,7 +21,7 @@
     "node": ">= 12.17.0"
   },
   "dependencies": {
-    "axios": "1.13.5",
+    "axios": "1.15.0",
     "commander": "^2.8.1",
     "core-js": "3.38.1",
     "filesize-parser": "1.5.0",