webfuscator 0.9.4

package/src/preparation/expand-template-literals.ts

@@ -0,0 +1,92 @@
+import traverse from '@babel/traverse'
+import type { Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInDirectivePrologue } from 'src/utils/ast'
+
+/**
+ * Rewrites safe template literals as string concatenation. Tagged templates
+ * stay intact because the tag receives their quasi structure.
+ *
+ * Templates use the "string" ToPrimitive hint, while `x + ""` uses "default".
+ * Those hints can call object coercion methods in a different order, so only
+ * expressions known to produce primitives are expanded.
+ *
+ * An empty first quasi still matters. It makes `` `${5}` `` produce `"5"`
+ * instead of the number `5`.
+ *
+ * @example
+ * // ◀️ before
+ * var msg = `sum is ${a + b}`;
+ * var raw = `static text`;
+ *
+ * // ▶️ after
+ * var msg = "sum is " + (a + b);
+ * var raw = "static text";
+ */
+export function expandTemplateLiterals(ast: File): void {
+  traverse(ast, visitor)
+}
+
+const visitor: Visitor = {
+  TemplateLiteral(path) {
+    const { parent } = path
+    if (t.isTaggedTemplateExpression(parent) && parent.quasi === path.node) {
+      return
+    }
+
+    const { quasis, expressions } = path.node
+
+    if (expressions.length === 0) {
+      // Rewriting a leading template as a string would create a directive.
+      if (t.isExpressionStatement(parent) && isInDirectivePrologue(path.parentPath!)) {
+        return
+      }
+      path.replaceWith(t.stringLiteral(quasiValue(quasis[0])))
+      return
+    }
+
+    for (const expr of expressions) {
+      if (!t.isExpression(expr) || !producesPrimitive(expr)) {
+        return
+      }
+    }
+
+    let result: t.Expression = t.stringLiteral(quasiValue(quasis[0]))
+
+    for (let i = 0; i < expressions.length; i++) {
+      const expr = expressions[i] as t.Expression
+      result = t.binaryExpression('+', result, expr)
+      const nextQuasi = quasis[i + 1]
+      if (nextQuasi) {
+        const value = quasiValue(nextQuasi)
+        if (value !== '') {
+          result = t.binaryExpression('+', result, t.stringLiteral(value))
+        }
+      }
+    }
+
+    path.replaceWith(result)
+  },
+}
+
+// These expression kinds always produce primitives, making the coercion hint
+// irrelevant. Any kind that can produce an object is excluded.
+function producesPrimitive(node: t.Expression): boolean {
+  return (
+    t.isStringLiteral(node) ||
+    t.isNumericLiteral(node) ||
+    t.isBooleanLiteral(node) ||
+    t.isNullLiteral(node) ||
+    t.isBigIntLiteral(node) ||
+    t.isTemplateLiteral(node) ||
+    t.isBinaryExpression(node) ||
+    t.isUnaryExpression(node) ||
+    t.isUpdateExpression(node)
+  )
+}
+
+function quasiValue(quasi: t.TemplateElement | undefined): string {
+  return quasi?.value.cooked ?? quasi?.value.raw ?? ''
+}

package/src/preparation/rewrite-class-fields.ts

@@ -0,0 +1,320 @@
+import traverse from '@babel/traverse'
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInsideWith, isProtoKey } from 'src/utils/ast'
+import { isPrimitiveLiteral } from 'src/utils/literal'
+
+/**
+ * Moves safe instance fields into the constructor and safe static fields into
+ * static blocks. The whole class stays intact unless every field can be lowered.
+ *
+ * `Object.defineProperty` preserves CreateDataProperty semantics. A plain
+ * assignment could invoke an inherited setter or fail on an inherited read-only
+ * property. Static blocks also preserve the class binding and `this`.
+ *
+ * Accessor collisions, special keys, inferred names, constructor parameter
+ * scope, and relocated `this`, `super`, or `new.target` can all expose a rewrite.
+ * Private or computed fields, derived classes, `with`, and a shadowed `Object`
+ * are therefore refused.
+ *
+ * @example
+ * // ◀️ before
+ * class A {
+ *   x = 1;
+ *   static z = 2;
+ * }
+ *
+ * // ▶️ after
+ * class A {
+ *   constructor() {
+ *     Object.defineProperty(this, "x", {
+ *       value: 1,
+ *       writable: true,
+ *       enumerable: true,
+ *       configurable: true
+ *     });
+ *   }
+ *   static {
+ *     Object.defineProperty(this, "z", {
+ *       value: 2,
+ *       writable: true,
+ *       enumerable: true,
+ *       configurable: true
+ *     });
+ *   }
+ * }
+ */
+export function rewriteClassFields(ast: File): void {
+  traverse(ast, visitor)
+}
+
+const FORBIDDEN_STATIC_KEYS = new Set([
+  'length',
+  'name',
+  'prototype',
+  '__proto__',
+  'caller',
+  'arguments',
+])
+
+const visitor = {
+  Class(path: NodePath<t.Class>) {
+    const memberPaths = path.get('body.body')
+    const instanceFields: t.ClassProperty[] = []
+    const staticFields: t.ClassProperty[] = []
+    let hasPrivateField = false
+    let hasComputedAccessor = false
+    const instanceAccessorKeys = new Set<string>()
+    const staticAccessorKeys = new Set<string>()
+    let ctorPath: NodePath<t.ClassMethod> | null = null
+
+    for (const memberPath of memberPaths) {
+      const member = memberPath.node
+      if (t.isClassProperty(member)) {
+        ;(member.static ? staticFields : instanceFields).push(member)
+      } else if (t.isClassPrivateProperty(member)) {
+        hasPrivateField = true
+      } else if (t.isClassMethod(member) && member.kind === 'constructor') {
+        ctorPath = memberPath as NodePath<t.ClassMethod>
+      } else if (t.isClassMethod(member) && (member.kind === 'get' || member.kind === 'set')) {
+        const name = plainKeyName(member.key)
+        if (member.computed || name === null) {
+          hasComputedAccessor = true
+        } else {
+          ;(member.static ? staticAccessorKeys : instanceAccessorKeys).add(name)
+        }
+      }
+    }
+
+    if (instanceFields.length === 0 && staticFields.length === 0) {
+      return
+    }
+    if (
+      !canDesugar(path, {
+        instanceFields,
+        staticFields,
+        hasPrivateField,
+        hasComputedAccessor,
+        instanceAccessorKeys,
+        staticAccessorKeys,
+        ctorPath,
+      })
+    ) {
+      return
+    }
+
+    // Path methods keep Babel's queued sibling paths aligned after each edit.
+    for (const memberPath of memberPaths) {
+      const member = memberPath.node
+      if (!t.isClassProperty(member)) {
+        continue
+      }
+      if (member.static) {
+        memberPath.replaceWith(t.staticBlock([defineField(t.thisExpression(), member)]))
+      } else {
+        memberPath.remove()
+      }
+    }
+
+    if (instanceFields.length > 0) {
+      const installs = instanceFields.map((field) => defineField(t.thisExpression(), field))
+      if (ctorPath) {
+        ctorPath.get('body').unshiftContainer('body', installs)
+      } else {
+        path
+          .get('body')
+          .unshiftContainer(
+            'body',
+            t.classMethod(
+              'constructor',
+              t.identifier('constructor'),
+              [],
+              t.blockStatement(installs),
+            ),
+          )
+      }
+    }
+  },
+}
+
+interface Collected {
+  instanceFields: t.ClassProperty[]
+  staticFields: t.ClassProperty[]
+  hasPrivateField: boolean
+  hasComputedAccessor: boolean
+  instanceAccessorKeys: Set<string>
+  staticAccessorKeys: Set<string>
+  ctorPath: NodePath<t.ClassMethod> | null
+}
+
+function canDesugar(path: NodePath<t.Class>, c: Collected): boolean {
+  if (c.hasPrivateField || c.hasComputedAccessor || path.node.superClass != null) {
+    return false
+  }
+  // `with` and outer bindings can redirect the synthesized `Object` reference.
+  if (isInsideWith(path) || objectIsShadowed(path, c.ctorPath)) {
+    return false
+  }
+  if (c.instanceFields.length > 0 && c.ctorPath && !hasSimpleParams(c.ctorPath.node)) {
+    return false
+  }
+  for (const field of c.instanceFields) {
+    if (!instanceFieldIsSafe(field, c.ctorPath != null, c.instanceAccessorKeys)) {
+      return false
+    }
+  }
+  for (const field of c.staticFields) {
+    if (!staticFieldIsSafe(field, c.staticAccessorKeys)) {
+      return false
+    }
+  }
+  return true
+}
+
+function objectIsShadowed(
+  path: NodePath<t.Class>,
+  ctorPath: NodePath<t.ClassMethod> | null,
+): boolean {
+  return (
+    path.scope.getBinding('Object') != null ||
+    (ctorPath != null && ctorPath.scope.getBinding('Object') != null)
+  )
+}
+
+// ECMA-262 10.2.2 initializes base-class fields before parameter defaults.
+// Moving fields into the body reverses that order for non-simple parameters.
+function hasSimpleParams(ctor: t.ClassMethod): boolean {
+  return ctor.params.every((param) => t.isIdentifier(param))
+}
+
+function instanceFieldIsSafe(
+  field: t.ClassProperty,
+  hasCtor: boolean,
+  accessorKeys: Set<string>,
+): boolean {
+  if (field.computed || !isPlainKey(field.key) || isProtoKey(field.key)) {
+    return false
+  }
+  if (shadowsAccessor(field.key, accessorKeys)) {
+    return false
+  }
+  if (field.value != null && isAnonymousFunctionDefinition(field.value)) {
+    return false
+  }
+  if (hasCtor) {
+    // Only a literal cannot capture a constructor parameter or local.
+    return field.value == null || isPrimitiveLiteral(field.value)
+  }
+  return field.value == null || !initObservesMethodContext(field.value, false)
+}
+
+function staticFieldIsSafe(field: t.ClassProperty, accessorKeys: Set<string>): boolean {
+  if (field.computed || !isPlainKey(field.key) || isForbiddenStaticKey(field.key)) {
+    return false
+  }
+  if (shadowsAccessor(field.key, accessorKeys)) {
+    return false
+  }
+  if (field.value == null) {
+    return true
+  }
+  if (isAnonymousFunctionDefinition(field.value)) {
+    return false
+  }
+  // Static blocks can change how these context-sensitive forms resolve.
+  return !containsPrivateName(field.value) && !initObservesMethodContext(field.value, true)
+}
+
+// CreateDataProperty ignores a same-named accessor. Lowering could reorder it.
+function shadowsAccessor(key: t.Node, accessorKeys: Set<string>): boolean {
+  const name = plainKeyName(key)
+  return name !== null && accessorKeys.has(name)
+}
+
+function containsPrivateName(node: t.Node): boolean {
+  let found = false
+  t.traverseFast(node, (child) => {
+    if (t.isPrivateName(child)) {
+      found = true
+    }
+    return found ? t.traverseFast.stop : undefined
+  })
+  return found
+}
+
+// These descriptor flags match CreateDataProperty.
+function defineField(target: t.Expression, field: t.ClassProperty): t.ExpressionStatement {
+  return t.expressionStatement(
+    t.callExpression(t.memberExpression(t.identifier('Object'), t.identifier('defineProperty')), [
+      target,
+      t.stringLiteral(plainKeyName(field.key)!),
+      t.objectExpression([
+        t.objectProperty(t.identifier('value'), fieldValue(field)),
+        t.objectProperty(t.identifier('writable'), t.booleanLiteral(true)),
+        t.objectProperty(t.identifier('enumerable'), t.booleanLiteral(true)),
+        t.objectProperty(t.identifier('configurable'), t.booleanLiteral(true)),
+      ]),
+    ]),
+  )
+}
+
+function fieldValue(field: t.ClassProperty): t.Expression {
+  return field.value ?? t.unaryExpression('void', t.numericLiteral(0))
+}
+
+// Numeric and BigInt keys both pass through ToPropertyKey, so `1` and `1n`
+// name `"1"`.
+function plainKeyName(key: t.Node): string | null {
+  if (t.isIdentifier(key)) {
+    return key.name
+  }
+  if (t.isStringLiteral(key)) {
+    return key.value
+  }
+  if (t.isNumericLiteral(key) || t.isBigIntLiteral(key)) {
+    return String(key.value)
+  }
+  return null
+}
+
+function isPlainKey(key: t.Node): boolean {
+  return plainKeyName(key) !== null
+}
+
+function isForbiddenStaticKey(key: t.Node): boolean {
+  if (t.isIdentifier(key) || t.isStringLiteral(key)) {
+    return FORBIDDEN_STATIC_KEYS.has(plainKeyName(key)!)
+  }
+  return false
+}
+
+// A descriptor would infer `"value"` instead of the field key as `.name`.
+function isAnonymousFunctionDefinition(node: t.Node): boolean {
+  return (
+    t.isArrowFunctionExpression(node) ||
+    (t.isFunctionExpression(node) && node.id == null) ||
+    (t.isClassExpression(node) && node.id == null)
+  )
+}
+
+// Relocation changes `new.target`, `super`, and static `this`. Nested non-arrow
+// functions rebind them and do not count.
+function initObservesMethodContext(node: t.Node, forbidThis: boolean): boolean {
+  let found = false
+  t.traverseFast(node, (child) => {
+    if (t.isFunction(child) && !t.isArrowFunctionExpression(child)) {
+      return t.traverseFast.skip
+    }
+    if (
+      t.isSuper(child) ||
+      (t.isMetaProperty(child) && child.meta.name === 'new' && child.property.name === 'target') ||
+      (forbidThis && t.isThisExpression(child))
+    ) {
+      found = true
+    }
+    return found ? t.traverseFast.skip : undefined
+  })
+  return found
+}

package/src/preparation/split-sequence-expressions.ts

@@ -0,0 +1,40 @@
+import traverse from '@babel/traverse'
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInDirectivePrologue } from 'src/utils/ast'
+
+/**
+ * Splits comma-sequenced expression statements into one statement each.
+ *
+ * @example
+ * // ◀️ before
+ * a(), b(), c();
+ *
+ * // ▶️ after
+ * a();
+ * b();
+ * c();
+ */
+export function splitSequenceExpressions(ast: File): void {
+  traverse(ast, visitor)
+}
+
+const visitor = {
+  ExpressionStatement(path: NodePath<t.ExpressionStatement>) {
+    if (!t.isSequenceExpression(path.node.expression)) {
+      return
+    }
+    if (typeof path.listKey !== 'string') {
+      return
+    }
+    // Splitting a leading string out of a sequence could create a directive.
+    const [first] = path.node.expression.expressions
+    if (t.isStringLiteral(first) && isInDirectivePrologue(path)) {
+      return
+    }
+    const statements = path.node.expression.expressions.map((expr) => t.expressionStatement(expr))
+    path.replaceWithMultiple(statements)
+  },
+}

package/src/preparation/split-variable-declarations.ts

@@ -0,0 +1,39 @@
+import traverse from '@babel/traverse'
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+/**
+ * Splits multi-declarator `var`/`let`/`const` into one declarator per statement,
+ * preserving the kind. Loop heads and exports stay intact because their parent
+ * slots do not accept several statements.
+ *
+ * @example
+ * // ◀️ before
+ * var a = 1, b = 2, c;
+ * let x = 1, y = 2;
+ *
+ * // ▶️ after
+ * var a = 1;
+ * var b = 2;
+ * var c;
+ * let x = 1;
+ * let y = 2;
+ */
+export function splitVariableDeclarations(ast: File): void {
+  traverse(ast, visitor)
+}
+
+const visitor = {
+  VariableDeclaration(path: NodePath<t.VariableDeclaration>) {
+    if (typeof path.listKey !== 'string') {
+      return
+    }
+    if (path.node.declarations.length <= 1) {
+      return
+    }
+    const { kind } = path.node
+    const replacements = path.node.declarations.map((decl) => t.variableDeclaration(kind, [decl]))
+    path.replaceWithMultiple(replacements)
+  },
+}

package/src/preparation/stringify-object-keys.ts

@@ -0,0 +1,107 @@
+import traverse from '@babel/traverse'
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isProtoKey } from 'src/utils/ast'
+
+/**
+ * Rewrites property keys in object literals and classes as computed strings.
+ * Already-computed keys, private names, and class constructors stay unchanged.
+ * A method named `["constructor"]` is not a constructor and may be rewritten.
+ *
+ * The ECMA-262 B.3.1 `__proto__` setter form also stays unchanged.
+ * `{ __proto__: x }` sets `[[Prototype]]`, while `{ ["__proto__"]: x }` creates
+ * an own property.
+ *
+ * @example
+ * // ◀️ before
+ * const o = { foo: 1, bar() { return 2; }, [computed]: 3 };
+ * class A { m() {} static s() {} }
+ *
+ * // ▶️ after
+ * const o = { ["foo"]: 1, ["bar"]() { return 2; }, [computed]: 3 };
+ * class A { ["m"]() {} static ["s"]() {} }
+ */
+export function stringifyObjectKeys(ast: File): void {
+  traverse(ast, visitor)
+}
+
+const visitor = {
+  ObjectProperty(path: NodePath<t.ObjectProperty>) {
+    if (isProtoSetter(path.node) || keyOrderIsSpreadSensitive(path)) {
+      return
+    }
+    if (stringifyKey(path.node)) {
+      path.node.shorthand = false
+    }
+  },
+  ObjectMethod(path: NodePath<t.ObjectMethod>) {
+    if (keyOrderIsSpreadSensitive(path)) {
+      return
+    }
+    stringifyKey(path.node)
+  },
+  ClassMethod(path: { node: t.ClassMethod }) {
+    if (path.node.kind === 'constructor') {
+      return
+    }
+    stringifyKey(path.node)
+  },
+}
+
+// With a spread present, V8 moves non-computed accessors after data properties
+// but leaves computed accessors in place. Rewriting would reorder own keys.
+function keyOrderIsSpreadSensitive(path: NodePath<t.ObjectProperty | t.ObjectMethod>): boolean {
+  const object = path.parentPath
+  if (!object || !object.isObjectExpression()) {
+    return false
+  }
+  const { properties } = object.node
+  const hasSpread = properties.some((prop) => t.isSpreadElement(prop))
+  if (!hasSpread) {
+    return false
+  }
+  return properties.some(
+    (prop) =>
+      t.isObjectMethod(prop) && (prop.kind === 'get' || prop.kind === 'set') && !prop.computed,
+  )
+}
+
+function isProtoSetter(node: t.ObjectProperty): boolean {
+  return !node.computed && !node.shorthand && isProtoKey(node.key)
+}
+
+function stringifyKey(node: t.ObjectProperty | t.ObjectMethod | t.ClassMethod): boolean {
+  if (node.computed) {
+    return false
+  }
+  if (t.isPrivateName(node.key)) {
+    return false
+  }
+  const stringKey = keyToString(node.key)
+  if (stringKey === null) {
+    return false
+  }
+  // Babel 8 narrows keyed nodes by `computed`, so both fields need widening.
+  const rewritten = node as t.ObjectProperty | t.ObjectMethod | t.ClassMethod
+  rewritten.key = t.stringLiteral(stringKey)
+  rewritten.computed = true
+  return true
+}
+
+function keyToString(key: t.Node): string | null {
+  if (t.isIdentifier(key)) {
+    return key.name
+  }
+  if (t.isStringLiteral(key)) {
+    return key.value
+  }
+  if (t.isNumericLiteral(key)) {
+    return String(key.value)
+  }
+  if (t.isBigIntLiteral(key)) {
+    return key.value.toString()
+  }
+  return null
+}

package/src/preparation/wrap-single-statements.ts

@@ -0,0 +1,63 @@
+import traverse from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+type LoopNode =
+  | t.WhileStatement
+  | t.DoWhileStatement
+  | t.ForStatement
+  | t.ForInStatement
+  | t.ForOfStatement
+
+/**
+ * Wraps single-statement bodies of control-flow constructs in BlockStatements,
+ * and converts concise arrow bodies into block bodies with an explicit `return`.
+ * Leaves an `IfStatement` alternate alone so `else if` chains survive.
+ *
+ * @example
+ * // ◀️ before
+ * if (x) log(1);
+ * else log(2);
+ * var fn = x => x + 1;
+ *
+ * // ▶️ after
+ * if (x) {
+ *   log(1);
+ * } else {
+ *   log(2);
+ * }
+ * var fn = x => {
+ *   return x + 1;
+ * };
+ */
+export function wrapSingleStatements(ast: File): void {
+  traverse(ast, visitor as Parameters<typeof traverse>[1])
+}
+
+const visitor = {
+  IfStatement(path: { node: t.IfStatement }) {
+    const { node } = path
+    if (!t.isBlockStatement(node.consequent)) {
+      node.consequent = t.blockStatement([node.consequent])
+    }
+    if (node.alternate && !t.isBlockStatement(node.alternate) && !t.isIfStatement(node.alternate)) {
+      node.alternate = t.blockStatement([node.alternate])
+    }
+  },
+  Loop(path: { node: LoopNode }) {
+    wrapLoopBody(path.node)
+  },
+  ArrowFunctionExpression(path: { node: t.ArrowFunctionExpression }) {
+    const { node } = path
+    if (!t.isBlockStatement(node.body)) {
+      node.body = t.blockStatement([t.returnStatement(node.body)])
+      node.expression = false
+    }
+  },
+} as const
+
+function wrapLoopBody(node: LoopNode): void {
+  if (!t.isBlockStatement(node.body)) {
+    node.body = t.blockStatement([node.body])
+  }
+}