webfuscator 0.9.4

package/src/transforms/arguments-to-parameters.ts

@@ -0,0 +1,187 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { hasDuplicateParamNames } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { isInStrictContext } from 'src/utils/paths'
+
+/**
+ * Replaces `arguments[i]` reads with their mapped parameter in sloppy functions
+ * with simple parameter lists. Writes, deletion, reassigned parameters, and any
+ * escape of the arguments object make the mapping unsafe. Missing parameters
+ * are never added because that would change `fn.length`.
+ *
+ * @example
+ * // ◀️ before
+ * function foo(bar) {
+ *   log(arguments[0]);
+ * }
+ *
+ * // ▶️ after
+ * function foo(bar) {
+ *   log(bar);
+ * }
+ */
+export function argumentsToParameters(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  Function(path, state) {
+    if (processFunction(path)) {
+      state.changed = true
+    }
+  },
+}
+
+interface CollectState {
+  reads: { memPath: NodePath<t.MemberExpression>; index: number }[]
+  writtenIndices: Set<number>
+  mappingBroken: boolean
+}
+
+const collectVisitor: Visitor<CollectState> = {
+  Function(innerPath) {
+    if (!innerPath.isArrowFunctionExpression()) {
+      innerPath.skip()
+    }
+  },
+  Identifier(path, state) {
+    if (path.node.name !== 'arguments' || !path.isReferencedIdentifier()) {
+      return
+    }
+    if (path.scope.getBinding('arguments')) {
+      return
+    }
+    const parent = path.parentPath
+    // Any other use can expose or mutate the arguments object.
+    if (
+      (parent.isMemberExpression() || parent.isOptionalMemberExpression()) &&
+      parent.node.object === path.node
+    ) {
+      return
+    }
+    state.mappingBroken = true
+  },
+  AssignmentExpression(assignPath, state) {
+    // Reassignment replaces the mapped object.
+    if (
+      t.isIdentifier(assignPath.node.left, { name: 'arguments' }) &&
+      !assignPath.scope.getBinding('arguments')
+    ) {
+      state.mappingBroken = true
+    }
+  },
+  MemberExpression(memPath, state) {
+    const obj = memPath.node.object
+    if (!t.isIdentifier(obj) || obj.name !== 'arguments') {
+      return
+    }
+    if (memPath.scope.getBinding('arguments')) {
+      return
+    }
+
+    // Deleting an index breaks its parameter mapping.
+    if (memPath.parentPath?.isUnaryExpression({ operator: 'delete' })) {
+      state.mappingBroken = true
+      return
+    }
+
+    if (!memPath.node.computed) {
+      return
+    }
+    const prop = memPath.node.property
+    if (!t.isNumericLiteral(prop)) {
+      return
+    }
+    const index = prop.value
+    if (!Number.isInteger(index) || index < 0) {
+      return
+    }
+
+    if (memberIsWriteTarget(memPath)) {
+      state.writtenIndices.add(index)
+      return
+    }
+    state.reads.push({ memPath, index })
+  },
+}
+
+function processFunction(path: NodePath<t.Function>): boolean {
+  if (path.isArrowFunctionExpression()) {
+    return false
+  }
+  const { params } = path.node
+  // Rest, defaults, and destructuring make `arguments` unmapped.
+  if (!params.every((param) => t.isIdentifier(param))) {
+    return false
+  }
+  // Duplicate names map only their last index.
+  if (hasDuplicateParamNames(params)) {
+    return false
+  }
+  // Strict-mode `arguments` is not mapped to parameters.
+  if (isInStrictContext(path)) {
+    return false
+  }
+
+  const state: CollectState = { reads: [], writtenIndices: new Set(), mappingBroken: false }
+  path.traverse(collectVisitor, state)
+  if (state.mappingBroken || state.reads.length === 0) {
+    return false
+  }
+
+  let changed = false
+  for (const { memPath, index } of state.reads) {
+    // A written index and its parameter diverge when the argument was omitted.
+    if (state.writtenIndices.has(index)) {
+      continue
+    }
+    // Adding a parameter would change `fn.length`.
+    const param = params[index]
+    if (!param || !t.isIdentifier(param)) {
+      continue
+    }
+    // Reassigned parameters diverge when the argument was omitted.
+    const binding = path.scope.getBinding(param.name)
+    if (binding && binding.constantViolations.length > 0) {
+      continue
+    }
+    memPath.replaceWith(t.identifier(param.name))
+    changed = true
+  }
+  return changed
+}
+
+// Treat any occurrence under a write target as written. The conservative member
+// case only skips a safe substitution.
+function memberIsWriteTarget(memPath: NodePath<t.MemberExpression>): boolean {
+  const directParent = memPath.parentPath?.node
+  if (
+    directParent &&
+    (t.isForInStatement(directParent) || t.isForOfStatement(directParent)) &&
+    directParent.left === memPath.node
+  ) {
+    return true
+  }
+  // Writes may reach the member through an enclosing destructuring pattern.
+  let currentNode: t.Node = memPath.node
+  let cursor: NodePath | null = memPath.parentPath
+  while (cursor && !cursor.isStatement()) {
+    const parent = cursor.node
+    if (t.isUpdateExpression(parent)) {
+      return true
+    }
+    if (t.isAssignmentExpression(parent)) {
+      return parent.left === currentNode
+    }
+    if (t.isArrayPattern(parent) || t.isObjectPattern(parent) || t.isRestElement(parent)) {
+      return true
+    }
+    currentNode = parent
+    cursor = cursor.parentPath
+  }
+  return false
+}

package/src/transforms/arrow-to-function.ts

@@ -0,0 +1,225 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { enclosingScopeHasDirectEval, isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Lowers arrows with Babel's capture-aware `arrowFunctionToExpression`. Arrows
+ * that reach `super` stay intact. Values that escape visible call positions also
+ * stay intact because only the arrow rejects construction with `new`.
+ *
+ * @example
+ * // ◀️ before
+ * var fn = x => {
+ *   return x + 1;
+ * };
+ * var thisFn = function () {
+ *   var read = () => {
+ *     return this.x;
+ *   };
+ *   return read();
+ * };
+ * var escapes = [() => 1];
+ * class Sub extends Base {
+ *   m() {
+ *     var call = () => super.m();
+ *     return call();
+ *   }
+ * }
+ *
+ * // ▶️ after
+ * var fn = function (x) {
+ *   return x + 1;
+ * };
+ * var thisFn = function () {
+ *   var _this = this;
+ *   var read = function () {
+ *     return _this.x;
+ *   };
+ *   return read();
+ * };
+ * var escapes = [() => 1];
+ * class Sub extends Base {
+ *   m() {
+ *     var call = () => super.m();
+ *     return call();
+ *   }
+ * }
+ */
+export function arrowToFunction(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  ArrowFunctionExpression(path, state) {
+    if (!path.isArrowFunctionExpression()) {
+      return
+    }
+    if (
+      // The lowered function gains construction and `prototype`. Every use must
+      // remain visible so those differences cannot be observed.
+      !valueStaysInView(path) ||
+      arrowReferencesSuper(path) ||
+      inUnsafeCaptureContext(path) ||
+      usesReassignedArguments(path) ||
+      // `with` can shadow capture aliases, and direct eval can inspect the changed
+      // runtime meaning of `this` or `arguments`.
+      isInsideWith(path) ||
+      enclosingScopeHasDirectEval(path)
+    ) {
+      return
+    }
+    path.arrowFunctionToExpression({
+      allowInsertArrow: false,
+      noNewArrows: true,
+    })
+    state.changed = true
+  },
+}
+
+// Babel places captures in the nearest function body. Fields, static blocks,
+// parameter defaults, and computed method keys evaluate in a different scope or
+// at a different time.
+function inUnsafeCaptureContext(path: NodePath<t.ArrowFunctionExpression>): boolean {
+  for (let current: NodePath | null = path.parentPath; current; current = current.parentPath) {
+    if (current.isStaticBlock() || current.isClassProperty() || current.isClassPrivateProperty()) {
+      return true
+    }
+    if (current.isFunction()) {
+      if (current.isArrowFunctionExpression()) {
+        continue
+      }
+      return arrowIsOutsideBodyOf(path, current)
+    }
+    if (current.isProgram()) {
+      return false
+    }
+  }
+  return false
+}
+
+// Captures placed in the body cannot serve parameter defaults or computed keys.
+function arrowIsOutsideBodyOf(path: NodePath, fnPath: NodePath): boolean {
+  let child: NodePath = path
+  for (;;) {
+    const next: NodePath | null = child.parentPath
+    if (!next || next === fnPath) {
+      break
+    }
+    child = next
+  }
+  return child.listKey === 'params' || child.key === 'key'
+}
+
+// A capture snapshots `arguments` before any later reassignment.
+function usesReassignedArguments(path: NodePath<t.ArrowFunctionExpression>): boolean {
+  if (!referencesName(path, 'arguments')) {
+    return false
+  }
+  const fnPath = nearestNonArrowFunction(path)
+  return fnPath != null && reassignsName(fnPath, 'arguments')
+}
+
+// Immediate calls, discarded values, and bindings used only for immediate calls
+// keep every use visible. Any other escape could expose construction, binding,
+// or `prototype` behavior.
+function valueStaysInView(valuePath: NodePath): boolean {
+  const parent = valuePath.parentPath
+  if (!parent) {
+    return false
+  }
+  if (isImmediateCallee(valuePath, parent) || parent.isExpressionStatement()) {
+    return true
+  }
+  if (
+    !parent.isVariableDeclarator() ||
+    parent.node.init !== valuePath.node ||
+    !t.isIdentifier(parent.node.id)
+  ) {
+    return false
+  }
+  const binding = valuePath.scope.getBinding(parent.node.id.name)
+  if (!binding || !binding.constant) {
+    return false
+  }
+  return binding.referencePaths.every(
+    (ref) => ref.parentPath != null && isImmediateCallee(ref, ref.parentPath),
+  )
+}
+
+function isImmediateCallee(valuePath: NodePath, parent: NodePath): boolean {
+  return (
+    (parent.isCallExpression() || parent.isOptionalCallExpression()) &&
+    parent.node.callee === valuePath.node
+  )
+}
+
+function referencesName(path: NodePath, name: string): boolean {
+  let found = false
+  path.traverse({
+    Function(inner) {
+      if (!inner.isArrowFunctionExpression()) {
+        inner.skip()
+      }
+    },
+    Identifier(inner) {
+      if (inner.node.name === name && inner.isReferencedIdentifier()) {
+        found = true
+      }
+    },
+  })
+  return found
+}
+
+function reassignsName(fnPath: NodePath, name: string): boolean {
+  let found = false
+  fnPath.traverse({
+    Function(inner) {
+      // Nested arrows share this function's `arguments` binding.
+      if (!inner.isArrowFunctionExpression()) {
+        inner.skip()
+      }
+    },
+    AssignmentExpression(inner) {
+      // Destructuring can rebind `arguments`; member writes only mutate it.
+      if (Object.hasOwn(t.getBindingIdentifiers(inner.node.left), name)) {
+        found = true
+      }
+    },
+    UpdateExpression(inner) {
+      if (t.isIdentifier(inner.node.argument, { name })) {
+        found = true
+      }
+    },
+  })
+  return found
+}
+
+function nearestNonArrowFunction(path: NodePath): NodePath | null {
+  for (let current: NodePath | null = path.parentPath; current; current = current.parentPath) {
+    if (current.isFunction() && !current.isArrowFunctionExpression()) {
+      return current
+    }
+  }
+  return null
+}
+
+function arrowReferencesSuper(path: NodePath<t.ArrowFunctionExpression>): boolean {
+  const state: { found: boolean } = { found: false }
+  path.traverse(superCheckVisitor, state)
+  return state.found
+}
+
+const superCheckVisitor: Visitor<{ found: boolean }> = {
+  Function(path) {
+    if (!path.isArrowFunctionExpression()) {
+      path.skip()
+    }
+  },
+  Super(_path, state) {
+    state.found = true
+  },
+}