webfuscator 0.9.4

package/src/transforms/nullish-coalescing-to-ternary.ts

@@ -0,0 +1,77 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { lowerLogicalWriteStatement } from 'src/utils/logical-lowering'
+
+/**
+ * Rewrites `a ?? b` as a guarded assignment or `a != null ? a : b`. A
+ * side-effectful left side is cached. Loose inequality checks both nullish
+ * values in one comparison.
+ *
+ * @example
+ * // ◀️ before
+ * var x = a ?? b;
+ * f(get() ?? fallback);
+ *
+ * // ▶️ after
+ * var x = a;
+ * if (x == null) x = b;
+ * f((_t = get()) != null ? _t : fallback);
+ */
+export function nullishCoalescingToTernary(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  LogicalExpression(path, state) {
+    if (lowerNullishCoalescing(path)) {
+      state.changed = true
+    }
+  },
+}
+
+function lowerNullishCoalescing(path: NodePath<t.LogicalExpression>): boolean {
+  const { node } = path
+  if (node.operator !== '??') {
+    return false
+  }
+  // `with` can turn a repeated name into a getter and shadow a cache temp.
+  if (isInsideWith(path)) {
+    return false
+  }
+
+  if (lowerLogicalWriteStatement(path, nullishFallbackTest)) {
+    return true
+  }
+
+  const { scope } = path
+  let test: t.Expression
+  let consequent: t.Expression
+
+  if (t.isIdentifier(node.left) && scope.hasBinding(node.left.name)) {
+    test = node.left
+    consequent = t.cloneNode(node.left)
+  } else {
+    const tmp = scope.generateUidIdentifierBasedOnNode(node.left)
+    scope.push({ id: t.cloneNode(tmp) })
+    test = t.assignmentExpression('=', t.cloneNode(tmp), node.left)
+    consequent = t.cloneNode(tmp)
+  }
+
+  path.replaceWith(
+    t.conditionalExpression(
+      t.binaryExpression('!=', test, t.nullLiteral()),
+      consequent,
+      node.right,
+    ),
+  )
+  return true
+}
+
+function nullishFallbackTest(target: t.Identifier): t.Expression {
+  return t.binaryExpression('==', target, t.nullLiteral())
+}

package/src/transforms/numbers-to-strings.ts

@@ -0,0 +1,61 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Rewrites numeric literals as strings coerced with unary plus. Under `+`, `-`,
+ * or `~`, the existing operator supplies that coercion. Other unary operators
+ * keep the wrapper because their string behavior differs.
+ *
+ * Preparation has already converted numeric object keys to strings.
+ *
+ * @example
+ * // ◀️ before
+ * var x = arr[42] + 0.5 * 1e3;
+ * var y = -5 * ~3;
+ *
+ * // ▶️ after
+ * var x = arr[+"42"] + +"0.5" * +"1000";
+ * var y = -"5" * ~"3";
+ */
+export function numbersToStrings(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const NUMERIC_UNARIES = new Set(['+', '-', '~'])
+
+const visitor: Visitor<ChangeState> = {
+  NumericLiteral(path, state) {
+    // Non-computed keys are names, and class-field keys can still reach this pass.
+    if (isNonComputedKey(path)) {
+      return
+    }
+    const str = t.stringLiteral(String(path.node.value))
+    const { parent } = path
+    if (
+      t.isUnaryExpression(parent) &&
+      parent.argument === path.node &&
+      NUMERIC_UNARIES.has(parent.operator)
+    ) {
+      path.replaceWith(str)
+    } else {
+      path.replaceWith(t.unaryExpression('+', str))
+    }
+    path.skip()
+    state.changed = true
+  },
+}
+
+function isNonComputedKey(path: NodePath<t.NumericLiteral>): boolean {
+  const { parentPath } = path
+  if (!parentPath) {
+    return false
+  }
+  const parent = parentPath.node
+  return (
+    'key' in parent && parent.key === path.node && 'computed' in parent && parent.computed === false
+  )
+}

package/src/transforms/object-method-to-property.ts

@@ -0,0 +1,86 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isProtoKey } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Rewrites generator and async object methods as function-valued properties so
+ * later passes can lift and inline them.
+ *
+ * Plain methods stay concise because a function property would gain construction
+ * and `prototype`. Generator and async functions remain non-constructors. Any
+ * method using `super` also stays intact because a function has no HomeObject.
+ *
+ * Non-computed `__proto__` methods stay intact because the property form invokes
+ * ECMA-262 B.3.1 prototype-setting behavior. Computed keys create own properties
+ * and remain safe.
+ *
+ * @example
+ * // ◀️ before
+ * const o = {
+ *   async *stream() {},
+ *   plain() {},
+ *   get x() {
+ *     return 1;
+ *   },
+ * };
+ *
+ * // ▶️ after
+ * const o = {
+ *   stream: async function* () {},
+ *   plain() {},
+ *   get x() {
+ *     return 1;
+ *   },
+ * };
+ */
+export function objectMethodToProperty(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  ObjectMethod(path, state) {
+    const { node } = path
+    if (node.kind !== 'method' || (!node.generator && !node.async)) {
+      return
+    }
+    if (referencesSuper(path)) {
+      return
+    }
+    if (isNonComputedProtoKey(node)) {
+      return
+    }
+    const fn = t.functionExpression(null, node.params, node.body, node.generator, node.async)
+    path.replaceWith(t.objectProperty(node.key, fn, node.computed, false))
+    state.changed = true
+  },
+}
+
+function isNonComputedProtoKey(node: t.ObjectMethod): boolean {
+  return !node.computed && isProtoKey(node.key)
+}
+
+function referencesSuper(path: NodePath<t.ObjectMethod>): boolean {
+  const state = { found: false }
+  path.traverse(superVisitor, state)
+  return state.found
+}
+
+const superVisitor: Visitor<{ found: boolean }> = {
+  Function(path, state) {
+    if (path.isArrowFunctionExpression()) {
+      return
+    }
+    // A nested method's computed key can still use the outer HomeObject.
+    if ((path.isObjectMethod() || path.isClassMethod()) && path.node.computed) {
+      path.get('key').traverse(superVisitor, state)
+    }
+    path.skip()
+  },
+  Super(_path, state) {
+    state.found = true
+  },
+}

package/src/transforms/optional-chaining-to-ternary.ts

@@ -0,0 +1,225 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Rewrites optional chains as nested ternaries. Side-effectful receivers are
+ * cached, and member calls retain their `this`. Optional deletion short-circuits
+ * to `true` as required by ECMA-262 13.5.1.
+ *
+ * @example
+ * // ◀️ before
+ * obj?.m(arg);
+ * delete obj?.x;
+ * a?.b?.c;
+ *
+ * // ▶️ after
+ * obj == null ? void 0 : (_m = obj.m).call(obj, arg);
+ * obj == null ? true : delete obj.x;
+ * a == null ? void 0 : (_b = a.b) == null ? void 0 : _b.c;
+ */
+export function optionalChainingToTernary(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  OptionalMemberExpression(path, state) {
+    if (lowerOptionalChain(path)) {
+      state.changed = true
+    }
+  },
+  OptionalCallExpression(path, state) {
+    if (lowerOptionalChain(path)) {
+      state.changed = true
+    }
+  },
+}
+
+function lowerOptionalChain(path: OptionalPath): boolean {
+  // `with` can make a repeated receiver name invoke a getter twice.
+  if (isInsideWith(path)) {
+    return false
+  }
+  if (isInsideOptionalChain(path)) {
+    return false
+  }
+  // A tagged optional chain needs explicit parentheses to remain valid and keep
+  // the tag receiver.
+  if (isBareTaggedTemplateTag(path)) {
+    path.replaceWith(t.parenthesizedExpression(path.node))
+    path.skip()
+    return true
+  }
+  return transformChain(path)
+}
+
+// Wrap a direct tagged-template parent once.
+function isBareTaggedTemplateTag(path: OptionalPath): boolean {
+  const parent = path.parentPath
+  return parent != null && parent.isTaggedTemplateExpression() && parent.node.tag === path.node
+}
+
+type OptionalNode = t.OptionalMemberExpression | t.OptionalCallExpression
+type OptionalPath = NodePath<OptionalNode>
+
+function isInsideOptionalChain(path: NodePath): boolean {
+  const parent = path.parentPath
+  if (!parent) {
+    return false
+  }
+  if (parent.isOptionalMemberExpression()) {
+    return parent.node.object === path.node
+  }
+  if (parent.isOptionalCallExpression()) {
+    return parent.node.callee === path.node
+  }
+  return false
+}
+
+// Refuse member optional calls because `.call` is shadowable, `super` because its
+// HomeObject cannot move, and callee or tag chains because ternaries lose their
+// receiver. Check before mutating the chain.
+function chainIsUnsafe(path: OptionalPath): boolean {
+  let node: t.Node = path.node
+  for (;;) {
+    if (t.isOptionalCallExpression(node)) {
+      const callee: t.Node = node.callee
+      if (node.optional && (t.isMemberExpression(callee) || t.isOptionalMemberExpression(callee))) {
+        return true
+      }
+      if (t.isSuper(callee)) {
+        return true
+      }
+      node = callee
+    } else if (t.isOptionalMemberExpression(node)) {
+      const object: t.Node = node.object
+      if (t.isSuper(object)) {
+        return true
+      }
+      node = object
+    } else {
+      break
+    }
+  }
+  let child: t.Node = path.node
+  let parent = path.parentPath
+  while (parent?.isParenthesizedExpression() && parent.node.expression === child) {
+    child = parent.node
+    parent = parent.parentPath
+  }
+  if (!parent) {
+    return false
+  }
+  if ((parent.isCallExpression() || parent.isNewExpression()) && parent.node.callee === child) {
+    return true
+  }
+  return parent.isTaggedTemplateExpression() && parent.node.tag === child
+}
+
+function transformChain(path: OptionalPath): boolean {
+  if (chainIsUnsafe(path)) {
+    return false
+  }
+
+  const optionals: (t.MemberExpression | t.CallExpression)[] = []
+
+  let cur: NodePath = path
+  while (cur.isOptionalMemberExpression() || cur.isOptionalCallExpression()) {
+    const { node } = cur
+    if (node.optional) {
+      optionals.push(node as unknown as t.MemberExpression | t.CallExpression)
+    }
+    // Demotion keeps the same fields and removes `optional`.
+    if (cur.isOptionalMemberExpression()) {
+      ;(node as unknown as { type: string }).type = 'MemberExpression'
+      cur = cur.get('object') as NodePath
+    } else {
+      ;(node as unknown as { type: string }).type = 'CallExpression'
+      cur = cur.get('callee') as NodePath
+    }
+  }
+
+  if (optionals.length === 0) {
+    return false
+  }
+
+  const parent = path.parentPath
+  const isDelete =
+    parent !== null &&
+    parent.isUnaryExpression() &&
+    parent.node.operator === 'delete' &&
+    parent.node.argument === path.node
+
+  // `void 0` cannot be shadowed like `undefined`.
+  const shortCircuit: t.Expression = isDelete
+    ? t.booleanLiteral(true)
+    : t.unaryExpression('void', t.numericLiteral(0))
+
+  let replacementPath: NodePath = path
+
+  for (let i = optionals.length - 1; i >= 0; i--) {
+    const node = optionals[i]!
+    const isCall = t.isCallExpression(node)
+    const chain: t.Expression | t.Super = isCall
+      ? ((node as t.CallExpression).callee as t.Expression | t.Super)
+      : (node as t.MemberExpression).object
+
+    if (t.isSuper(chain)) {
+      return false
+    }
+
+    let check: t.Expression
+
+    if (path.scope.isStatic(chain)) {
+      check = chain
+    } else {
+      const tmp = path.scope.generateUidIdentifierBasedOnNode(chain)
+      path.scope.push({ id: t.cloneNode(tmp) })
+      check = t.assignmentExpression('=', t.cloneNode(tmp), chain)
+      if (isCall) {
+        ;(node as t.CallExpression).callee = t.cloneNode(tmp)
+      } else {
+        ;(node as t.MemberExpression).object = t.cloneNode(tmp)
+      }
+    }
+
+    // A cached member call needs its original receiver as `this`.
+    if (isCall && t.isMemberExpression(chain)) {
+      const callNode = node as t.CallExpression
+      const { object } = chain
+      if (!t.isSuper(object)) {
+        let context: t.Expression
+        const memoized = path.scope.maybeGenerateMemoised(object)
+        if (memoized) {
+          context = t.cloneNode(memoized)
+          chain.object = t.assignmentExpression('=', memoized, object)
+        } else {
+          context = t.cloneNode(object) as t.Expression
+        }
+        callNode.arguments.unshift(t.cloneNode(context))
+        callNode.callee = t.memberExpression(callNode.callee as t.Expression, t.identifier('call'))
+      }
+    }
+
+    const condition = t.binaryExpression('==', check, t.nullLiteral())
+
+    let alternate = replacementPath.node as t.Expression
+    if (isDelete && i === optionals.length - 1) {
+      alternate = t.unaryExpression('delete', alternate)
+    }
+
+    const newTernary = t.conditionalExpression(condition, shortCircuit, alternate)
+    const replaced: NodePath<t.ConditionalExpression> = replacementPath.replaceWith(newTernary)[0]
+    replacementPath = replaced.get('alternate')
+  }
+
+  if (isDelete) {
+    // The ternary already contains deletion, so replace the parent `delete` too.
+    parent!.replaceWith(path.node)
+  }
+  return true
+}

package/src/transforms/pack-declarations-into-parameters.ts

@@ -0,0 +1,233 @@
+import type { Binding, NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { enclosingScopeHasDirectEval, hasDuplicateParamNames } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { isLiteralShaped } from 'src/utils/literal'
+import { hasAnnexBFunctionAlias } from 'src/utils/paths'
+
+/**
+ * Moves leading literal-valued `var` declarations into trailing default
+ * parameters. Arrows, rest parameters, name collisions, and functions with
+ * callers that could fill a new slot stay unchanged.
+ *
+ * Packing also requires unchanged `arguments`, directive, and hoisting behavior.
+ *
+ * @example
+ * // ◀️ before
+ * function run() {
+ *   var x = 1;
+ *   return x;
+ * }
+ *
+ * // ▶️ after
+ * function run(x = 1) {
+ *   return x;
+ * }
+ */
+export function packDeclarationsIntoParameters(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  Function(path, state) {
+    if (packLeadingIntoParams(path)) {
+      state.changed = true
+    }
+  },
+}
+
+function packLeadingIntoParams(path: NodePath<t.Function>): boolean {
+  // Accessors have fixed arity. Method calls are not analyzable, and arrows do
+  // not own `arguments`.
+  if (
+    path.isArrowFunctionExpression() ||
+    path.isObjectMethod() ||
+    path.isClassMethod() ||
+    path.isClassPrivateMethod()
+  ) {
+    return false
+  }
+  // An Annex B alias splits call sites across bindings Babel does not connect.
+  if (hasAnnexBFunctionAlias(path)) {
+    return false
+  }
+  const { params } = path.node
+  if (params.some((param) => t.isRestElement(param))) {
+    return false
+  }
+  // Adding a default makes duplicate sloppy parameters a syntax error.
+  if (hasDuplicateParamNames(params)) {
+    return false
+  }
+
+  const { body } = path.node
+  if (!t.isBlockStatement(body)) {
+    return false
+  }
+  // A strict directive forbids a non-simple parameter list.
+  if (body.directives.length > 0) {
+    return false
+  }
+  // Defaults make `arguments` unmapped.
+  if (referencesArguments(path)) {
+    return false
+  }
+  // Direct eval can inspect the newly unmapped `arguments` by name.
+  if (enclosingScopeHasDirectEval(path)) {
+    return false
+  }
+  // A caller with extra arguments could fill the new parameter slot.
+  if (!allCallSitesRespectArity(path, params.length)) {
+    return false
+  }
+
+  const existingNames = collectParamNames(params)
+  // FunctionDeclarationInstantiation can replace a packed default with a hoisted
+  // same-named function.
+  const bodyFunctionNames = functionDeclarationNames(body)
+
+  let packed = false
+  while (body.body.length > 0) {
+    const stmt = body.body[0]!
+    if (!t.isVariableDeclaration(stmt) || stmt.kind !== 'var') {
+      break
+    }
+    if (stmt.declarations.length !== 1) {
+      break
+    }
+    const decl = stmt.declarations[0]!
+    if (!t.isIdentifier(decl.id)) {
+      break
+    }
+    if (!decl.init) {
+      break
+    }
+    if (!isLiteralShaped(decl.init)) {
+      break
+    }
+    if (existingNames.has(decl.id.name) || bodyFunctionNames.has(decl.id.name)) {
+      break
+    }
+
+    params.push(t.assignmentPattern(t.cloneNode(decl.id), decl.init))
+    existingNames.add(decl.id.name)
+    body.body.shift()
+    packed = true
+  }
+  return packed
+}
+
+function referencesArguments(path: NodePath<t.Function>): boolean {
+  let found = false
+  const argumentsVisitor: Visitor = {
+    Function(inner) {
+      if (inner.isArrowFunctionExpression()) {
+        // Arrows read the enclosing `arguments`.
+        return
+      }
+      // Non-arrow bodies bind `arguments`, but computed method keys use the
+      // enclosing scope.
+      const key = methodComputedKey(inner)
+      if (key) {
+        if (key.isIdentifier() && key.node.name === 'arguments') {
+          found = true
+        }
+        key.traverse(argumentsVisitor)
+      }
+      inner.skip()
+    },
+    Identifier(inner) {
+      if (inner.node.name === 'arguments' && inner.isReferencedIdentifier()) {
+        found = true
+      }
+    },
+  }
+  path.traverse(argumentsVisitor)
+  return found
+}
+
+function methodComputedKey(path: NodePath<t.Function>): NodePath | null {
+  if (
+    (path.isObjectMethod() || path.isClassMethod() || path.isClassPrivateMethod()) &&
+    path.node.computed
+  ) {
+    return path.get('key') as NodePath
+  }
+  return null
+}
+
+// Every outer and recursive reference must be a direct call within the original
+// arity and without spread.
+function allCallSitesRespectArity(path: NodePath<t.Function>, arity: number): boolean {
+  const external = functionBinding(path)
+  if (!external || !external.constant || !bindingCallsRespectArity(external, arity)) {
+    return false
+  }
+  if (path.isFunctionExpression() && path.node.id) {
+    const inner = path.scope.getBinding(path.node.id.name)
+    if (inner && (!inner.constant || !bindingCallsRespectArity(inner, arity))) {
+      return false
+    }
+  }
+  return true
+}
+
+function bindingCallsRespectArity(binding: Binding, arity: number): boolean {
+  for (const ref of binding.referencePaths) {
+    const parent = ref.parentPath
+    if (
+      !parent ||
+      !(parent.isCallExpression() || parent.isOptionalCallExpression()) ||
+      parent.node.callee !== ref.node
+    ) {
+      return false
+    }
+    const args = parent.node.arguments
+    if (args.length > arity || args.some((arg) => t.isSpreadElement(arg))) {
+      return false
+    }
+  }
+  return true
+}
+
+// Annex B can hoist function names from nested blocks into this function scope.
+function functionDeclarationNames(body: t.BlockStatement): Set<string> {
+  const names = new Set<string>()
+  t.traverseFast(body, (node) => {
+    if (t.isFunctionDeclaration(node) && node.id) {
+      names.add(node.id.name)
+      return t.traverseFast.skip
+    }
+    return node !== body && t.isFunction(node) ? t.traverseFast.skip : undefined
+  })
+  return names
+}
+
+function functionBinding(path: NodePath<t.Function>): Binding | null {
+  if (path.isFunctionDeclaration() && path.node.id) {
+    return path.scope.parent?.getBinding(path.node.id.name) ?? null
+  }
+  const parent = path.parentPath
+  if (
+    parent?.isVariableDeclarator() &&
+    parent.node.init === path.node &&
+    t.isIdentifier(parent.node.id)
+  ) {
+    return parent.scope.getBinding(parent.node.id.name) ?? null
+  }
+  return null
+}
+
+// Parameter names inside patterns and defaults also block duplicate packing.
+function collectParamNames(params: t.Function['params']): Set<string> {
+  const names = new Set<string>()
+  for (const param of params) {
+    for (const name of Object.keys(t.getBindingIdentifiers(param))) {
+      names.add(name)
+    }
+  }
+  return names
+}