jscrambler 8.6.6 → 8.7.1-next.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # jscrambler
 
+## 8.7.1-next.0
+
+### Patch Changes
+
+- [ecba0c7]: new beforeProtection type: webpack-ignore-vendors
+
+## 8.7.0
+
+### Minor Changes
+
+- [d0b95d7]: Added metadata report feature on cli
+
 ## 8.6.6
 
 ### Patch Changes

package/README.md

@@ -135,6 +135,8 @@ Options:
   -n <number>                             (version 7.2 and above) Create multiple protections at once.
   --delete-protection-on-success <bool>   Deletes the protection files after they have been protected and downloaded (default: false)
   --mode <mode>                           (version 8.4 and above) Define protection mode. Possible values: automatic, manual (default: manual)
+  --save-src <bool>                       Protection should save application sources (default: true)
+  --protection-report <string>            (version 8.4 and above) Protection id for the metadata report
   -h, --help                              output usage information
 ```
 
@@ -352,6 +354,10 @@ The concatenation of files can result in max file size errors - even though the
       "type": "prepend-js",
       "target": "/path/to/target/file.js",
       "source": "/path/to/script/file.js"
+    },
+    {
+      "type": "webpack-ignore-vendors",
+      "report": "/path/to/webpack/stats.json"
     }
   ]
 }

package/dist/bin/jscrambler.js

@@ -10,6 +10,7 @@ var _filesizeParser = _interopRequireDefault(require("filesize-parser"));
 var _config2 = _interopRequireDefault(require("../config"));
 var _ = _interopRequireDefault(require("../"));
 var _utils = require("../utils");
+var _fs = _interopRequireDefault(require("fs"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
@@ -66,57 +67,87 @@ const validateBeforeProtection = function () {
   if (beforeProtectionArray.length === 0) {
     return;
   }
-  const mandatoryKeys = ['type', 'target', 'source'];
-  const usedTargets = new Set();
-  const usedSources = new Set();
   beforeProtectionArray.filter(element => {
-    // Check if every array element has a type, a target and a source
-    const validateMandatoryKeys = mandatoryKeys.every(key => key in element);
-    if (!validateMandatoryKeys) {
-      console.error('Invalid structure on beforeProtection: each element must have the following structure { type: "type", target: "/path/to/target", source: "/path/to/script"}');
-      process.exit(1);
-    }
     const {
-      target,
-      source,
       type
     } = element;
+    switch (type) {
+      case _utils.APPEND_JS_TYPE:
+      case _utils.PREPEND_JS_TYPE:
+        const mandatoryKeys = ['type', 'target', 'source'];
+        const usedTargets = new Set();
+        const usedSources = new Set();
 
-    // Check if only valid types are being used
-    if (type !== _utils.APPEND_JS_TYPE && type !== _utils.PREPEND_JS_TYPE) {
-      console.error("Invalid type on beforeProtection: only \"".concat(_utils.APPEND_JS_TYPE, "\" or \"").concat(_utils.PREPEND_JS_TYPE, "\" are allowed."));
-      process.exit(1);
-    }
+        // Check if every array element has a type, a target and a source
+        const validateMandatoryKeys = mandatoryKeys.every(key => key in element);
+        if (!validateMandatoryKeys) {
+          console.error('Invalid structure on beforeProtection: each element must have the following structure { type: "type", target: "/path/to/target", source: "/path/to/script"}');
+          process.exit(1);
+        }
+        const {
+          target,
+          source
+        } = element;
 
-    // Check if the provided files are js, mjs or cjs files
-    if (!(0, _utils.isJavascriptFile)(target) || !(0, _utils.isJavascriptFile)(source)) {
-      console.error('Invalid extension for beforeProtection target or source files: only *js, mjs and cjs* files can be used to append or prepend.');
-      process.exit(1);
-    }
+        // Check if the provided files are js, mjs or cjs files
+        if (!(0, _utils.isJavascriptFile)(target) || !(0, _utils.isJavascriptFile)(source)) {
+          console.error("Invalid extension for beforeProtection (".concat(type, ") target or source files: only *js, mjs and cjs* files can be used to append or prepend."));
+          process.exit(1);
+        }
 
-    // Check if the target has already been used as a source
-    if (usedTargets.has(source)) {
-      console.error("Error on beforeProtection: file \"".concat(source, "\" has already been used as target and can't be used as source."));
-      process.exit(1);
-    }
-    if (usedSources.has(target)) {
-      console.error("Error on beforeProtection: file \"".concat(target, "\" has already been used as source and can't be used as target."));
-      process.exit(1);
-    }
+        // Check if the target has already been used as a source
+        if (usedTargets.has(source)) {
+          console.error("Error on beforeProtection (".concat(type, "): file \"").concat(source, "\" has already been used as target and can't be used as source."));
+          process.exit(1);
+        }
+        if (usedSources.has(target)) {
+          console.error("Error on beforeProtection (".concat(type, "): file \"").concat(target, "\" has already been used as source and can't be used as target."));
+          process.exit(1);
+        }
 
-    // Check if the target and source are the same
-    if (target === source) {
-      console.error("Error on beforeProtection: File \"".concat(target, "\" can't be used as both a target and a source."));
-      process.exit(1);
-    }
+        // Check if the target and source are the same
+        if (target === source) {
+          console.error("Error on beforeProtection (".concat(type, "): File \"").concat(target, "\" can't be used as both a target and a source."));
+          process.exit(1);
+        }
 
-    // Add the target and the source to the corresponding sets
-    usedTargets.add(target);
-    usedSources.add(source);
+        // Add the target and the source to the corresponding sets
+        usedTargets.add(target);
+        usedSources.add(source);
+        break;
+      case _utils.WEBPACK_IGNORE_VENDORS:
+        if (!("report" in element)) {
+          console.error("Invalid structure on beforeProtection (".concat(type, "): \"report\" property is mandatory for this type"));
+          process.exit(1);
+        }
+        if (!_fs.default.existsSync(element.report)) {
+          console.error("Error on beforeProtection (".concat(type, "): source webpack report does not exist."));
+          process.exit(1);
+        }
+        const content = _fs.default.readFileSync(element.report, 'utf8');
+        let report;
+        try {
+          report = JSON.parse(content);
+        } catch (e) {
+          console.error("Error on beforeProtection (".concat(type, "): invalid source webpack report. Reason: ").concat(e.message));
+          process.exit(1);
+        }
+        element.excludeModules = new Map();
+        for (let module of report.modules) {
+          if (module.name && module.name.includes('/node_modules/')) {
+            element.excludeModules.set(module.id, module.name);
+          }
+        }
+        console.log("beforeProtection (".concat(type, "): Webpack report \"").concat(_path.default.basename(element.report), "\" was loaded"));
+        break;
+      default:
+        console.error("Invalid type on beforeProtection (".concat(type, "): only \"").concat(_utils.APPEND_JS_TYPE, "\", \"").concat(_utils.PREPEND_JS_TYPE, "\" or \"").concat(_utils.WEBPACK_IGNORE_VENDORS, "\" are allowed."));
+        process.exit(1);
+    }
   });
   return beforeProtectionArray;
 };
-_commander.default.version(require('../../package.json').version).usage('[options] <file ...>').option('-a, --access-key <accessKey>', 'Access key').option('-c, --config <config>', 'Jscrambler configuration options').option('-H, --host <host>', 'Hostname').option('-i, --application-id <id>', 'Application ID').option('-o, --output-dir <dir>', 'Output directory').option('-p, --port <port>', 'Port').option('--base-path <path>', 'Base Path').option('--protocol <protocol>', 'Protocol (http or https)').option('--cafile <path>', 'Internal certificate authority').option('-C, --cwd <dir>', 'Current Working Directory').option('-s, --secret-key <secretKey>', 'Secret key').option('-m, --source-maps <id>', 'Download source maps').option('-R, --randomization-seed <seed>', 'Set randomization seed').option('--instrument', 'Instrument file(s) before start profiling. ATTENTION: previous profiling information will be deleted').option('--start-profiling', 'Starts profiling (assumes an already instrumented application)').option('--stop-profiling', 'Stops profiling').option('--code-hardening-threshold <threshold>', 'Set code hardening file size threshold. Format: {value}{unit="b,kb,mb"}. Example: 200kb', validateCodeHardeningThreshold).option('--recommended-order <bool>', 'Use recommended order', validateBool('recommended-order')).option('-W, --werror <bool>', 'Set werror flag value (default: true)', validateBool('werror')).option('--utc <bool>', 'Set UTC as the request time zone. Otherwise it uses the local time zone (default: true)', validateBool('utc')).option('--tolerate-minification <bool>', "Don't detect minification as malicious tampering (default: true)", validateBool('tolerate-minification')).option('--use-profiling-data <bool>', "(version 6.2 only) Protection should use the existing profiling data (default: true)", validateBool('use-profiling-data')).option('--profiling-data-mode <mode>', "(version 6.3 and above) Select profiling mode (default: automatic)", validateProfilingDataMode).option('--remove-profiling-data', "Removes the current application profiling information").option('--use-app-classification <bool>', '(version 6.3 and above) Protection should use Application Classification metadata when protecting (default: true)', validateBool('--use-app-classification')).option('--input-symbol-table <file>', '(version 6.3 and above) Protection should use symbol table when protecting. (default: no file)').option('--output-symbol-table <id>', '(version 6.3 and above) Download output symbol table (json)').option('--jscramblerVersion <version>', 'Use a specific Jscrambler version').option('--debugMode', 'Protect in debug mode').option('--skip-sources', 'Prevent source files from being updated').option('--force-app-environment <environment>', "(version 7.1 and above) Override application's environment detected automatically. Possible values: ".concat(availableEnvironments.toString()), validateForceAppEnvironment).option('--ensure-code-annotation <bool>', "(version 7.3 and above) Fail protection if no annotations are found on the source code (default: false)", validateBool('ensure-code-annotation')).option('-n <number>', "(version 7.2 and above) Create multiple protections at once.").option('--delete-protection-on-success <bool>', 'Deletes the protection files after they have been protected and downloaded (default: false)', validateBool('--delete-protection-on-success')).option('--mode <mode>', "(version 8.4 and above) Define protection mode. Possible values: automatic, manual (default: manual)", validateMode).option('--save-src <bool>', 'Protection should save application sources (default: true)', validateBool('--save-src')).parse(process.argv);
+_commander.default.version(require('../../package.json').version).usage('[options] <file ...>').option('-a, --access-key <accessKey>', 'Access key').option('-c, --config <config>', 'Jscrambler configuration options').option('-H, --host <host>', 'Hostname').option('-i, --application-id <id>', 'Application ID').option('-o, --output-dir <dir>', 'Output directory').option('-p, --port <port>', 'Port').option('--base-path <path>', 'Base Path').option('--protocol <protocol>', 'Protocol (http or https)').option('--cafile <path>', 'Internal certificate authority').option('-C, --cwd <dir>', 'Current Working Directory').option('-s, --secret-key <secretKey>', 'Secret key').option('-m, --source-maps <id>', 'Download source maps').option('-R, --randomization-seed <seed>', 'Set randomization seed').option('--instrument', 'Instrument file(s) before start profiling. ATTENTION: previous profiling information will be deleted').option('--start-profiling', 'Starts profiling (assumes an already instrumented application)').option('--stop-profiling', 'Stops profiling').option('--code-hardening-threshold <threshold>', 'Set code hardening file size threshold. Format: {value}{unit="b,kb,mb"}. Example: 200kb', validateCodeHardeningThreshold).option('--recommended-order <bool>', 'Use recommended order', validateBool('recommended-order')).option('-W, --werror <bool>', 'Set werror flag value (default: true)', validateBool('werror')).option('--utc <bool>', 'Set UTC as the request time zone. Otherwise it uses the local time zone (default: true)', validateBool('utc')).option('--tolerate-minification <bool>', "Don't detect minification as malicious tampering (default: true)", validateBool('tolerate-minification')).option('--use-profiling-data <bool>', "(version 6.2 only) Protection should use the existing profiling data (default: true)", validateBool('use-profiling-data')).option('--profiling-data-mode <mode>', "(version 6.3 and above) Select profiling mode (default: automatic)", validateProfilingDataMode).option('--remove-profiling-data', "Removes the current application profiling information").option('--use-app-classification <bool>', '(version 6.3 and above) Protection should use Application Classification metadata when protecting (default: true)', validateBool('--use-app-classification')).option('--input-symbol-table <file>', '(version 6.3 and above) Protection should use symbol table when protecting. (default: no file)').option('--output-symbol-table <id>', '(version 6.3 and above) Download output symbol table (json)').option('--jscramblerVersion <version>', 'Use a specific Jscrambler version').option('--debugMode', 'Protect in debug mode').option('--skip-sources', 'Prevent source files from being updated').option('--force-app-environment <environment>', "(version 7.1 and above) Override application's environment detected automatically. Possible values: ".concat(availableEnvironments.toString()), validateForceAppEnvironment).option('--ensure-code-annotation <bool>', "(version 7.3 and above) Fail protection if no annotations are found on the source code (default: false)", validateBool('ensure-code-annotation')).option('-n <number>', "(version 7.2 and above) Create multiple protections at once.").option('--delete-protection-on-success <bool>', 'Deletes the protection files after they have been protected and downloaded (default: false)', validateBool('--delete-protection-on-success')).option('--mode <mode>', "(version 8.4 and above) Define protection mode. Possible values: automatic, manual (default: manual)", validateMode).option('--save-src <bool>', 'Protection should save application sources (default: true)', validateBool('--save-src')).option('--protection-report <string>', '(version 8.4 and above) Protection id for the metadata report').parse(process.argv);
 let globSrc, filesSrc, config;
 
 // If -c, --config file was provided
@@ -368,6 +399,15 @@ if (_commander.default.sourceMaps) {
     console.error(debug ? error : error.message || error);
     process.exit(1);
   });
+} else if (_commander.default.protectionReport) {
+  (async () => {
+    try {
+      await _.default.getProtectionMetadata(clientSettings, _commander.default.protectionReport, _commander.default.outputDir);
+    } catch (error) {
+      console.error(debug ? error : error.message || error);
+      process.exit(1);
+    }
+  })();
 } else {
   // Go, go, go
   (async () => {

package/dist/get-protection-default-fragments.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = _default;
+exports.getIntrospection = getIntrospection;
 var introspection = _interopRequireWildcard(require("./introspection"));
 function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
 function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }

package/dist/index.js

@@ -19,7 +19,7 @@ var _constants = require("./constants");
 var _zip = require("./zip");
 var introspection = _interopRequireWildcard(require("./introspection"));
 var _utils = require("./utils");
-var _getProtectionDefaultFragments = _interopRequireDefault(require("./get-protection-default-fragments"));
+var _getProtectionDefaultFragments = _interopRequireWildcard(require("./get-protection-default-fragments"));
 function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
 function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
@@ -150,7 +150,7 @@ var _default = exports.default = {
       }
       if (runBeforeProtection.length > 0) {
         runBeforeProtection.map(element => {
-          if (!_filesSrc.includes(element.target)) {
+          if ((element.type === _utils.PREPEND_JS_TYPE || element.type === _utils.APPEND_JS_TYPE) && !_filesSrc.includes(element.target)) {
             console.error('Error on beforeProtection: Target files need to be in the files to protect list (or filesSrc).');
             process.exit(1);
           }
@@ -764,7 +764,7 @@ var _default = exports.default = {
     if (typeof destCallback === 'function') {
       destCallback(download, filesDest);
     } else {
-      await fsPromises.writeFile(_path.default.join(filesDest, "".concat(protectionId, "_symbolTable.json")), download);
+      await _fs.default.promises.writeFile(_path.default.join(filesDest, "".concat(protectionId, "_symbolTable.json")), download);
     }
   },
   /**
@@ -1108,6 +1108,84 @@ var _default = exports.default = {
     const dataArg = result.args.find(arg => arg.name === 'data');
     const isFieldSupported = dataArg && dataArg.type.inputFields.some(e => e.name === field);
     return isFieldSupported;
+  },
+  async getProtectionMetadata(conf, protectionId, outputDir) {
+    const INVALID_PARAMETERS = ['original', 'initialCleanup', 'wrapUp'];
+    const finalConfig = buildFinalConfig(conf);
+    const {
+      applicationId,
+      host,
+      port,
+      basePath,
+      protocol,
+      cafile,
+      keys,
+      jscramblerVersion,
+      proxy,
+      utc,
+      clientId
+    } = finalConfig;
+    const {
+      accessKey,
+      secretKey
+    } = keys;
+    const client = new this.Client({
+      accessKey,
+      secretKey,
+      host,
+      port,
+      basePath,
+      protocol,
+      cafile,
+      jscramblerVersion,
+      proxy,
+      utc,
+      clientId
+    });
+    const appSource = await (0, _getProtectionDefaultFragments.getIntrospection)(client, 'ApplicationSource');
+    if (!appSource.fields.some(_ref6 => {
+      let {
+        name
+      } = _ref6;
+      return name === 'transformedContentHash';
+    })) {
+      console.error("\"Protection report\" it's only available on Jscrambler version 8.4 and above.");
+      process.exit(1);
+    }
+    const response = await this.getApplicationProtection(client, applicationId, protectionId, {
+      application: '_id',
+      applicationProtection: '_id, applicationId, parameters, version, areSubscribersOrdered, useRecommendedOrder, tolerateMinification, profilingDataMode, useAppClassification, browsers, sourceMaps, sources { filename, transformedContentHash, metrics { transformation } }'
+    });
+    errorHandler(response);
+    const sourcesInfo = response.data.applicationProtection.sources.map(source => {
+      const parameters = source.metrics.filter(metric => !INVALID_PARAMETERS.includes(metric.transformation));
+      return {
+        filename: source.filename,
+        sha256Checksum: source.transformedContentHash,
+        parameters: parameters.map(param => param.transformation)
+      };
+    });
+    const metadataJson = JSON.stringify({
+      applicationId: response.data.applicationProtection.applicationId,
+      // eslint-disable-next-line no-underscore-dangle
+      protectionId: response.data.applicationProtection._id,
+      jscramblerVersion: response.data.applicationProtection.version,
+      areSubscribersOrdered: response.data.applicationProtection.areSubscribersOrdered,
+      useRecommendedOrder: response.data.applicationProtection.useRecommendedOrder,
+      tolerateMinification: response.data.applicationProtection.tolerateMinification,
+      profilingDataMode: response.data.applicationProtection.profilingDataMode,
+      useAppClassification: response.data.applicationProtection.useAppClassification,
+      browsers: response.data.applicationProtection.browsers,
+      sourceMaps: response.data.applicationProtection.sourceMaps,
+      parameters: response.data.applicationProtection.parameters,
+      sources: sourcesInfo
+    }, null, 2);
+    if (outputDir) {
+      await _fs.default.promises.writeFile(outputDir, metadataJson);
+      console.log("Protection Report ".concat(protectionId, " saved in ").concat(outputDir));
+    } else {
+      console.log(metadataJson);
+    }
   }
 };
 function getFileFromUrl(client, url) {