webfuscator 0.9.4

package/src/transforms/const-let-to-var.ts

@@ -0,0 +1,246 @@
+import traverse from '@babel/traverse'
+import type { NodePath, Scope, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { initializerReaches } from 'src/analysis/document-order'
+import { enclosingScopeHasDirectEval, isInsideWith } from 'src/utils/ast'
+import { hasConstantViolation } from 'src/utils/paths'
+
+/**
+ * Lifts safe lexical declarations to function-scoped `var`, renaming collisions
+ * caused by hoisting. TDZ reads, reassigned constants, captured loop bindings,
+ * uninitialized loop heads, program scope, `with`, and direct eval are refused.
+ *
+ * @example
+ * // ◀️ before
+ * function f() {
+ *   const x = 1;
+ *   return x;
+ * }
+ *
+ * // ▶️ after
+ * function f() {
+ *   var x = 1;
+ *   return x;
+ * }
+ */
+export function constLetToVar(ast: File): boolean {
+  const state = { changed: false }
+  traverse(ast, {
+    VariableDeclaration(path) {
+      const { kind } = path.node
+      if (kind !== 'let' && kind !== 'const') {
+        return
+      }
+      // Babel cannot see names supplied by `with` or direct eval.
+      if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+        return
+      }
+      // A `var` write would lose the `const` TypeError.
+      if (kind === 'const' && hasConstantViolation(path)) {
+        return
+      }
+      // Hoisted `var` reads `undefined` where a lexical binding throws in TDZ.
+      if (hasTdzRiskyReference(path)) {
+        return
+      }
+      // An uninitialized lexical loop head resets on each entry. `var` does not.
+      if (forHeadMissingInitializer(path)) {
+        return
+      }
+      // Top-level `var` creates a global property. Lexical declarations do not.
+      const blockScope = path.scope
+      const varScope = blockScope.getFunctionParent() ?? blockScope.getProgramParent()
+      if (varScope.path.isProgram()) {
+        return
+      }
+      // One `var` cannot preserve per-iteration bindings captured by closures.
+      if (capturedInEnclosingLoop(path)) {
+        return
+      }
+      transformBlockScopedVariable(path, varScope)
+      state.changed = true
+    },
+
+    ClassDeclaration(path) {
+      const { id } = path.node
+      if (!id) {
+        return
+      }
+      if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+        return
+      }
+
+      const { scope } = path.parentPath
+      if (!isVarScope(scope) && scope.parent!.hasBinding(id.name, { noUids: true })) {
+        path.scope.rename(id.name)
+        state.changed = true
+      }
+    },
+  })
+  return state.changed
+}
+
+const conflictingFunctionsVisitor: Visitor<{ names: string[] }> = {
+  Scope(path, { names }) {
+    for (const name of names) {
+      const binding = path.scope.getOwnBinding(name)
+      if (binding?.kind === 'hoisted') {
+        path.scope.rename(name)
+      }
+    }
+  },
+  Expression(path) {
+    path.skip()
+  },
+  Declaration(path) {
+    path.skip()
+  },
+}
+
+// Same-scope uses need a reachable initializer. Nested uses also need their
+// function value created after initialization.
+function hasTdzRiskyReference(path: NodePath<t.VariableDeclaration>): boolean {
+  const declHome = nearestFunctionOrProgram(path)
+  for (const name of Object.keys(path.getBindingIdentifiers())) {
+    const binding = path.scope.getBinding(name)
+    if (!binding) {
+      continue
+    }
+    for (const usage of [...binding.referencePaths, ...binding.constantViolations]) {
+      if (usage.findParent((ancestor) => ancestor === path)) {
+        return true
+      }
+      const usageHome = nearestFunctionOrProgram(usage)
+      if (usageHome === declHome) {
+        if (!initializerReaches(path, usage)) {
+          return true
+        }
+        continue
+      }
+      const nested = outermostNestedFunction(usage, declHome)
+      if (!nested || nested.isFunctionDeclaration() || !initializerReaches(path, nested)) {
+        return true
+      }
+    }
+  }
+  return false
+}
+
+function forHeadMissingInitializer(path: NodePath<t.VariableDeclaration>): boolean {
+  if (!t.isForStatement(path.parent) || path.key !== 'init') {
+    return false
+  }
+  return path.node.declarations.some((decl) => decl.init == null)
+}
+
+// A nested function or class can observe the loop's per-iteration binding.
+function capturedInEnclosingLoop(path: NodePath<t.VariableDeclaration>): boolean {
+  const loop = enclosingLoop(path)
+  if (!loop) {
+    return false
+  }
+  for (const name of Object.keys(path.getBindingIdentifiers())) {
+    const binding = path.scope.getBinding(name)
+    if (!binding) {
+      continue
+    }
+    for (const usage of [...binding.referencePaths, ...binding.constantViolations]) {
+      for (
+        let current = usage.parentPath;
+        current && current !== loop;
+        current = current.parentPath
+      ) {
+        if (current.isFunction() || current.isClass()) {
+          return true
+        }
+      }
+    }
+  }
+  return false
+}
+
+function transformBlockScopedVariable(
+  path: NodePath<t.VariableDeclaration>,
+  varScope: Scope,
+): void {
+  path.node.kind = 'var'
+
+  const bindingNames = Object.keys(path.getBindingIdentifiers())
+  for (const name of bindingNames) {
+    const binding = path.scope.getOwnBinding(name)
+    if (!binding) {
+      continue
+    }
+    binding.kind = 'var'
+  }
+
+  if (enclosingLoop(path) && !isVarInLoopHead(path)) {
+    for (const decl of path.node.declarations) {
+      // Without an initializer, `var` retains the prior iteration's value.
+      decl.init ??= t.buildUndefinedNode()
+    }
+  }
+
+  const blockScope = path.scope
+  if (varScope !== blockScope) {
+    for (const name of bindingNames) {
+      let newName = name
+      if (
+        blockScope.parent!.hasBinding(name, { noUids: true }) ||
+        blockScope.parent!.hasGlobal(name)
+      ) {
+        newName = blockScope.generateUid(name)
+        blockScope.rename(name, newName)
+      }
+
+      blockScope.moveBindingTo(newName, varScope)
+    }
+  }
+
+  blockScope.path.traverse(conflictingFunctionsVisitor, {
+    names: bindingNames,
+  })
+}
+
+function nearestFunctionOrProgram(path: NodePath): NodePath {
+  return path.findParent((ancestor) => ancestor.isFunction() || ancestor.isProgram())!
+}
+
+// The shallowest nested function decides when this use can run.
+function outermostNestedFunction(usage: NodePath, home: NodePath): NodePath | null {
+  let result: NodePath | null = null
+  for (let current = usage.parentPath; current && current !== home; current = current.parentPath) {
+    if (current.isFunction()) {
+      result = current
+    }
+  }
+  return result
+}
+
+function enclosingLoop(path: NodePath): NodePath<t.Loop> | null {
+  for (let current = path.parentPath; current; current = current.parentPath) {
+    if (current.isFunction()) {
+      return null
+    }
+    if (current.isLoop()) {
+      return current
+    }
+  }
+  return null
+}
+
+function isVarScope(scope: Scope): boolean {
+  return scope.path.isFunctionParent() || scope.path.isProgram()
+}
+
+function isVarInLoopHead(path: NodePath<t.VariableDeclaration>): boolean {
+  if (t.isForStatement(path.parent)) {
+    return path.key === 'init'
+  }
+  if (t.isForXStatement(path.parent)) {
+    return path.key === 'left'
+  }
+  return false
+}

package/src/transforms/const-to-let.ts

@@ -0,0 +1,38 @@
+import type { Visitor } from '@babel/traverse'
+import type { File } from '@babel/types'
+
+import { enclosingScopeHasDirectEval } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { hasConstantViolation } from 'src/utils/paths'
+
+/**
+ * Changes `const` to `let` when no write can observe the lost TypeError. Direct
+ * eval and recorded constant violations keep the declaration unchanged. Scope
+ * and TDZ behavior are otherwise identical.
+ *
+ * @example
+ * // ◀️ before
+ * const foo = "bar";
+ * const { a, b } = obj;
+ *
+ * // ▶️ after
+ * let foo = "bar";
+ * let { a, b } = obj;
+ */
+export function constToLet(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  VariableDeclaration(path, state) {
+    if (path.node.kind !== 'const') {
+      return
+    }
+    if (enclosingScopeHasDirectEval(path) || hasConstantViolation(path)) {
+      return
+    }
+    path.node.kind = 'let'
+    state.changed = true
+  },
+}

package/src/transforms/do-while-to-while.ts

@@ -0,0 +1,69 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { collectLoopLabels, generateLoopLabel, redirectContinues } from 'src/utils/loop-lowering'
+
+/**
+ * Rewrites `do` loops as `while (true)` with an exit test after the body.
+ * Continues become breaks from an inner block so they still reach that test.
+ * The inner label is omitted when nothing uses it.
+ *
+ * @example
+ * // ◀️ before
+ * do {
+ *   step();
+ *   if (skip()) continue;
+ *   log();
+ * } while (more());
+ *
+ * // ▶️ after
+ * while (true) {
+ *   _doIteration: {
+ *     step();
+ *     if (skip()) break _doIteration;
+ *     log();
+ *   }
+ *   if (!more()) break;
+ * }
+ */
+export function doWhileToWhile(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  DoWhileStatement(path, state) {
+    transformDoWhile(path)
+    state.changed = true
+  },
+}
+
+function transformDoWhile(path: NodePath<t.DoWhileStatement>): void {
+  const { node } = path
+  const { ourLabels } = collectLoopLabels(path)
+  const innerLabel = generateLoopLabel(path, 'doIteration')
+
+  const blockBody: t.BlockStatement = t.isBlockStatement(node.body)
+    ? node.body
+    : t.blockStatement([node.body])
+  const labeledBlock = t.labeledStatement(t.identifier(innerLabel), blockBody)
+  const exitTest = t.ifStatement(
+    t.unaryExpression('!', node.test),
+    t.blockStatement([t.breakStatement()]),
+  )
+  const whileStmt = t.whileStatement(
+    t.booleanLiteral(true),
+    t.blockStatement([labeledBlock, exitTest]),
+  )
+
+  const [newPath] = path.replaceWith(whileStmt)
+  const rewriteCount = redirectContinues(newPath, innerLabel, ourLabels)
+
+  // Keep the block so body bindings cannot shadow names in the exit test.
+  if (rewriteCount === 0) {
+    const whileBlock = newPath.node.body as t.BlockStatement
+    whileBlock.body = [blockBody, exitTest]
+  }
+}

package/src/transforms/drop-console.ts

@@ -0,0 +1,119 @@
+import traverse from '@babel/traverse'
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isSideEffectFree } from 'src/analysis/purity'
+import { isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Removes `console.*(...)` expression statements when `console` is not
+ * locally shadowed. Matches dot, bracket, and optional-chain forms.
+ * Leaves indirect uses alone (`console.log.call(...)`, assignments,
+ * `await console.log(...)`).
+ *
+ * @example
+ * // ◀️ before
+ * function foo() {
+ *   console.log("hi");
+ *   return "bar";
+ * }
+ * function bar(console) {
+ *   console.log("kept");
+ * }
+ *
+ * // ▶️ after
+ * function foo() {
+ *   return "bar";
+ * }
+ * function bar(console) {
+ *   console.log("kept");
+ * }
+ */
+export function dropConsole(ast: File): boolean {
+  // A reassigned global `console` can invoke user code.
+  if (globalConsoleIsReassigned(ast)) {
+    return false
+  }
+  return traverseForChanges(ast, visitor)
+}
+
+function globalConsoleIsReassigned(ast: File): boolean {
+  let reassigned = false
+  traverse(ast, {
+    Identifier(path) {
+      if (path.node.name !== 'console' || reassigned) {
+        return
+      }
+      // Per-call checks already handle local shadows.
+      if (path.scope.getBinding('console')) {
+        return
+      }
+      if (isWriteTarget(path)) {
+        reassigned = true
+        path.stop()
+      }
+    },
+  })
+  return reassigned
+}
+
+function isWriteTarget(path: NodePath<t.Identifier>): boolean {
+  const { node, parentPath } = path
+  if (!parentPath) {
+    return false
+  }
+  if (parentPath.isAssignmentExpression({ left: node })) {
+    return true
+  }
+  if (parentPath.isUpdateExpression({ argument: node })) {
+    return true
+  }
+  // Destructuring and iterator-loop targets also write the name.
+  return path.isBindingIdentifier()
+}
+
+const visitor: Visitor<ChangeState> = {
+  ExpressionStatement(path, state) {
+    const expr = path.node.expression
+    if (!t.isCallExpression(expr) && !t.isOptionalCallExpression(expr)) {
+      return
+    }
+    const { callee } = expr
+    if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee)) {
+      return
+    }
+    const { object } = callee
+    if (!t.isIdentifier(object) || object.name !== 'console') {
+      return
+    }
+    // `with` can supply a different `console` outside Babel's scope table.
+    if (path.scope.getBinding('console') || isInsideWith(path)) {
+      return
+    }
+    // Removing the call also removes argument and computed-key evaluation.
+    if (!callArgumentsAreInert(expr, callee, path)) {
+      return
+    }
+    path.remove()
+    state.changed = true
+  },
+}
+
+function callArgumentsAreInert(
+  expr: t.CallExpression | t.OptionalCallExpression,
+  callee: t.MemberExpression | t.OptionalMemberExpression,
+  path: NodePath<t.ExpressionStatement>,
+): boolean {
+  if (callee.computed && !isSideEffectFree(callee.property, path.scope, path)) {
+    return false
+  }
+  for (const arg of expr.arguments) {
+    if (!t.isExpression(arg) || !isSideEffectFree(arg, path.scope, path)) {
+      return false
+    }
+  }
+  return true
+}

package/src/transforms/drop-debugger.ts

@@ -0,0 +1,38 @@
+import type { Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Removes every `debugger` statement.
+ *
+ * @example
+ * // ◀️ before
+ * function foo() {
+ *   debugger;
+ *   return "bar";
+ * }
+ *
+ * // ▶️ after
+ * function foo() {
+ *   return "bar";
+ * }
+ */
+export function dropDebugger(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  DebuggerStatement(path, state) {
+    // Babel cannot remove a required single-statement child. Keep the slot valid
+    // with an empty statement.
+    if (Array.isArray(path.container)) {
+      path.remove()
+    } else {
+      path.replaceWith(t.emptyStatement())
+    }
+    state.changed = true
+  },
+}

package/src/transforms/expand-binary-assignment.ts

@@ -0,0 +1,94 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Rewrites arithmetic and bitwise compound assignments as `LHS = LHS op RHS`.
+ * Logical compound assignments are handled by `expandLogicalAssignment`.
+ *
+ * Member objects and computed keys are cached so the read and write use the same
+ * evaluated receiver. The cache assignment stays on the outer write target,
+ * which evaluates before its right side.
+ *
+ * Compound and expanded forms use the same operator semantics, including BigInt.
+ *
+ * @example
+ * // ◀️ before
+ * a += b;
+ * a **= 2;
+ * obj.x -= y;
+ * arr[idx()] |= v;
+ *
+ * // ▶️ after
+ * a = a + b;
+ * a = a ** 2;
+ * (_obj = obj).x = _obj.x - y;
+ * (_arr = arr)[_idx = idx()] = _arr[_idx] | v;
+ */
+export function expandBinaryAssignment(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  AssignmentExpression(path, state) {
+    if (lowerBinaryAssignment(path)) {
+      state.changed = true
+    }
+  },
+}
+
+const LOGICAL_COMPOUND = new Set(['||', '&&', '??'])
+
+function lowerBinaryAssignment(path: NodePath<t.AssignmentExpression>): boolean {
+  const { operator, left, right } = path.node
+  if (operator === '=' || operator.length < 2) {
+    return false
+  }
+  const op = operator.slice(0, -1)
+  if (LOGICAL_COMPOUND.has(op)) {
+    return false
+  }
+
+  const read = t.cloneNode(left, true)
+
+  if (t.isMemberExpression(left) && t.isMemberExpression(read)) {
+    // `with` can turn a bare object name into a getter or shadow a memo temp.
+    if (isInsideWith(path)) {
+      return false
+    }
+    const { object } = left
+    if (t.isExpression(object)) {
+      const memo = path.scope.maybeGenerateMemoised(object)
+      if (memo) {
+        read.object = memo
+        left.object = t.assignmentExpression('=', t.cloneNode(memo), object)
+      }
+    }
+
+    if (left.computed) {
+      const { property } = left
+      if (t.isExpression(property)) {
+        const memoProp = path.scope.maybeGenerateMemoised(property)
+        if (memoProp) {
+          read.property = memoProp
+          left.property = t.assignmentExpression('=', t.cloneNode(memoProp), property)
+        }
+      }
+    }
+  } else if (!t.isIdentifier(left)) {
+    return false
+  }
+
+  path.replaceWith(
+    t.assignmentExpression(
+      '=',
+      left,
+      t.binaryExpression(op as t.BinaryExpression['operator'], read as t.Expression, right),
+    ),
+  )
+  return true
+}

package/src/transforms/expand-logical-assignment.ts

@@ -0,0 +1,84 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Rewrites `||=`/`&&=`/`??=` as `LHS op (LHS = RHS)`. Member objects and
+ * computed keys are cached so the read and write use the same receiver.
+ *
+ * @example
+ * // ◀️ before
+ * a ||= b;
+ * a &&= b;
+ * a ??= b;
+ * obj.x ||= y;
+ * arr[idx()] ??= v;
+ *
+ * // ▶️ after
+ * a || (a = b);
+ * a && (a = b);
+ * a ?? (a = b);
+ * (_obj = obj).x || (_obj.x = y);
+ * (_arr = arr)[_idx = idx()] ?? (_arr[_idx] = v);
+ */
+export function expandLogicalAssignment(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  AssignmentExpression(path, state) {
+    if (lowerLogicalAssignment(path)) {
+      state.changed = true
+    }
+  },
+}
+
+function lowerLogicalAssignment(path: NodePath<t.AssignmentExpression>): boolean {
+  const { operator, left, right } = path.node
+  if (operator.length < 2) {
+    return false
+  }
+  const op = operator.slice(0, -1)
+  if (op !== '||' && op !== '&&' && op !== '??') {
+    return false
+  }
+
+  const lhs = t.cloneNode(left, true)
+
+  if (t.isMemberExpression(left) && t.isMemberExpression(lhs)) {
+    // `with` can turn a bare object name into a getter or shadow a memo temp.
+    if (isInsideWith(path)) {
+      return false
+    }
+    const { object } = left
+    if (t.isExpression(object)) {
+      const memo = path.scope.maybeGenerateMemoised(object)
+      if (memo) {
+        left.object = memo
+        lhs.object = t.assignmentExpression('=', t.cloneNode(memo), object)
+      }
+    }
+
+    if (left.computed) {
+      const { property } = left
+      if (t.isExpression(property)) {
+        const memoProp = path.scope.maybeGenerateMemoised(property)
+        if (memoProp) {
+          left.property = memoProp
+          lhs.property = t.assignmentExpression('=', t.cloneNode(memoProp), property)
+        }
+      }
+    }
+  } else if (!t.isIdentifier(left)) {
+    return false
+  }
+
+  path.replaceWith(
+    t.logicalExpression(op, lhs as t.Expression, t.assignmentExpression('=', left, right)),
+  )
+  return true
+}