webfuscator 0.9.4

package/src/transforms/ternary-to-if.ts

@@ -0,0 +1,387 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { isConditionalGate, reorderableToStatement } from 'src/utils/evaluation-order'
+import { isStandaloneDeclaration } from 'src/utils/paths'
+
+/**
+ * Lowers conditional expressions to `if` statements. Expression values use a
+ * temporary. Parameter defaults and repeating loop tests stay unchanged because
+ * hoisting would change when they run.
+ *
+ * @example
+ * // ◀️ before
+ * var y = a ? b : c;
+ * log(d ? e : f);
+ *
+ * // ▶️ after
+ * var y;
+ * if (a) { y = b; } else { y = c; }
+ * var _ternaryResult;
+ * if (d) { _ternaryResult = e; } else { _ternaryResult = f; }
+ * log(_ternaryResult);
+ */
+export function ternaryToIf(ast: File): boolean {
+  // Flatten sequences and logical gates before lifting ternaries. Replacements
+  // detach queued child paths, so every handler checks liveness.
+  const preparationChanged = traverseForChanges(ast, preparationVisitor)
+  const loweringChanged = traverseForChanges(ast, visitor)
+  return preparationChanged || loweringChanged
+}
+
+const preparationVisitor: Visitor<ChangeState> = {
+  ConditionalExpression(path, state) {
+    if (!isPathLive(path) || isInsideWith(path)) {
+      return
+    }
+    const stmtPath = path.getStatementParent()
+    if (!stmtPath) {
+      return
+    }
+    if (hoistEnclosingSequence(path, stmtPath) || lowerEnclosingLogical(path, stmtPath)) {
+      state.changed = true
+    }
+  },
+}
+
+const visitor: Visitor<ChangeState> = {
+  ConditionalExpression(path, state) {
+    // Statement replacement detaches queued siblings. `with` can also shadow the
+    // synthesized result temporary.
+    if (!isPathLive(path) || isInsideWith(path)) {
+      return
+    }
+    if (lowerConditional(path)) {
+      state.changed = true
+    }
+  },
+}
+
+function lowerConditional(path: NodePath<t.ConditionalExpression>): boolean {
+  const parent = path.parentPath
+  if (!parent) {
+    return false
+  }
+
+  const { test, consequent, alternate } = path.node
+
+  if (parent.isExpressionStatement() && parent.node.expression === path.node) {
+    parent.replaceWith(
+      t.ifStatement(
+        test,
+        t.blockStatement(seqToExpressionStatements(consequent)),
+        t.blockStatement(seqToExpressionStatements(alternate)),
+      ),
+    )
+    // Skip the orphaned path after replacing its parent.
+    path.skip()
+    return true
+  }
+  if (parent.isReturnStatement() && parent.node.argument === path.node) {
+    parent.replaceWith(
+      t.ifStatement(
+        test,
+        t.blockStatement(seqWithFinal(consequent, t.returnStatement)),
+        t.blockStatement(seqWithFinal(alternate, t.returnStatement)),
+      ),
+    )
+    path.skip()
+    return true
+  }
+  if (parent.isThrowStatement() && parent.node.argument === path.node) {
+    parent.replaceWith(
+      t.ifStatement(
+        test,
+        t.blockStatement(seqWithFinal(consequent, t.throwStatement)),
+        t.blockStatement(seqWithFinal(alternate, t.throwStatement)),
+      ),
+    )
+    path.skip()
+    return true
+  }
+  if (
+    parent.isAssignmentExpression() &&
+    parent.node.operator === '=' &&
+    t.isIdentifier(parent.node.left) &&
+    parent.node.right === path.node &&
+    parent.parentPath?.isExpressionStatement() &&
+    parent.parentPath.node.expression === parent.node
+  ) {
+    const target = parent.node.left
+    parent.parentPath.replaceWith(
+      t.ifStatement(
+        test,
+        t.blockStatement(seqWithAssignment(consequent, target)),
+        t.blockStatement(seqWithAssignment(alternate, target)),
+      ),
+    )
+    path.skip()
+    return true
+  }
+  if (
+    parent.isVariableDeclarator() &&
+    t.isIdentifier(parent.node.id) &&
+    parent.node.init === path.node &&
+    parent.parentPath?.isVariableDeclaration() &&
+    // Splitting lexical declarations would end TDZ early, and bare `const` is
+    // invalid. Keep their initializer behind a result temp.
+    parent.parentPath.node.kind === 'var' &&
+    parent.parentPath.node.declarations.length === 1 &&
+    isStandaloneDeclaration(parent.parentPath)
+  ) {
+    const declPath = parent.parentPath
+    const target = parent.node.id
+    declPath.replaceWithMultiple([
+      t.variableDeclaration(declPath.node.kind, [t.variableDeclarator(t.cloneNode(target))]),
+      t.ifStatement(
+        test,
+        t.blockStatement(seqWithAssignment(consequent, target)),
+        t.blockStatement(seqWithAssignment(alternate, target)),
+      ),
+    ])
+    path.skip()
+    return true
+  }
+
+  const stmtPath = path.getStatementParent()
+  if (!stmtPath) {
+    return false
+  }
+
+  if (isInsideAssignmentPattern(path, stmtPath)) {
+    return false
+  }
+  if (isInsideLoopHeader(path, stmtPath)) {
+    return false
+  }
+  // Lifting requires no short-circuit gate or earlier effect in the statement.
+  if (!reorderableToStatement(path, stmtPath)) {
+    return false
+  }
+
+  const { scope } = path
+  const tmpId = scope.generateUidIdentifier('ternaryResult')
+  scope.push({ id: t.cloneNode(tmpId) })
+
+  const ifStmt = t.ifStatement(
+    test,
+    t.blockStatement([
+      t.expressionStatement(t.assignmentExpression('=', t.cloneNode(tmpId), consequent)),
+    ]),
+    t.blockStatement([
+      t.expressionStatement(t.assignmentExpression('=', t.cloneNode(tmpId), alternate)),
+    ]),
+  )
+
+  // Detach the ternary before reusing its children in the new `if`.
+  path.replaceWith(t.cloneNode(tmpId))
+  stmtPath.insertBefore(ifStmt)
+  return true
+}
+
+function isInsideAssignmentPattern(path: NodePath, stmtPath: NodePath): boolean {
+  let ancestor: NodePath | null = path.parentPath
+  while (ancestor && ancestor !== stmtPath) {
+    if (ancestor.isAssignmentPattern()) {
+      return true
+    }
+    ancestor = ancestor.parentPath
+  }
+  return false
+}
+
+// Split the innermost sequence so its ternary reaches a safe statement position.
+function hoistEnclosingSequence(path: NodePath, stmtPath: NodePath): boolean {
+  const seqPath = findEnclosingSequence(path, stmtPath)
+  if (!seqPath) {
+    return false
+  }
+  const elements = seqPath.node.expressions
+  if (elements.length < 2) {
+    return false
+  }
+  const seqStmt = seqPath.getStatementParent()
+  if (!seqStmt) {
+    return false
+  }
+  // The sequence must run once at statement position without crossing a gate,
+  // case test, parameter default, loop header, or earlier effect.
+  if (
+    isInsideLoopHeader(seqPath, seqStmt) ||
+    isInsideAssignmentPattern(seqPath, seqStmt) ||
+    isInsideSwitchCaseTest(seqPath, seqStmt) ||
+    !reorderableToStatement(seqPath, seqStmt)
+  ) {
+    return false
+  }
+  const preceding = elements.slice(0, -1).map((e) => t.expressionStatement(t.cloneNode(e)))
+  const last = t.cloneNode(elements.at(-1)!)
+  seqPath.replaceWith(last)
+  seqStmt.insertBefore(preceding)
+  path.skip()
+  return true
+}
+
+// Hoisting from a case test would run its work before the switch reaches that case.
+function isInsideSwitchCaseTest(path: NodePath, stmtPath: NodePath): boolean {
+  let ancestor: NodePath | null = path.parentPath
+  while (ancestor && ancestor !== stmtPath) {
+    if (ancestor.isSwitchCase()) {
+      return true
+    }
+    ancestor = ancestor.parentPath
+  }
+  return false
+}
+
+// A live path must still occupy every recorded parent key up to the Program.
+function isPathLive(path: NodePath): boolean {
+  let cur: NodePath | null = path
+  while (cur) {
+    if (!cur.node) {
+      return false
+    }
+    const parent: NodePath | null = cur.parentPath
+    if (!parent) {
+      return cur.isProgram() || cur.isFile()
+    }
+    if (!parent.node) {
+      return false
+    }
+    const parentNode = parent.node as unknown as Record<string, unknown>
+    let held: unknown = parentNode[cur.key as string]
+    if (cur.listKey != null) {
+      const arr = parentNode[cur.listKey]
+      held = Array.isArray(arr) ? arr[cur.key as number] : arr
+    }
+    if (held !== cur.node) {
+      return false
+    }
+    cur = parent
+  }
+  return false
+}
+
+function findEnclosingSequence(
+  path: NodePath,
+  stmtPath: NodePath,
+): NodePath<t.SequenceExpression> | null {
+  let cur: NodePath = path
+  let parent = cur.parentPath
+  let found: NodePath<t.SequenceExpression> | null = null
+  while (parent && parent !== stmtPath) {
+    if (isConditionalGate(parent, cur)) {
+      return null
+    }
+    if (!found && parent.isSequenceExpression()) {
+      found = parent as NodePath<t.SequenceExpression>
+    }
+    cur = parent
+    parent = cur.parentPath
+  }
+  return found
+}
+
+// Convert an enclosing logical gate to a conditional so this pass remains
+// self-contained and can lower it on the next visit.
+function lowerEnclosingLogical(path: NodePath, stmtPath: NodePath): boolean {
+  const logical = findEnclosingShortCircuitLogical(path, stmtPath)
+  if (!logical || logical.removed || !logical.container) {
+    return false
+  }
+  const { node } = logical
+  const { left, right } = node
+  let test: t.Expression
+  let valueRef: t.Expression
+  if (t.isIdentifier(left) && logical.scope.hasBinding(left.name)) {
+    test = left
+    valueRef = t.cloneNode(left)
+  } else {
+    const tmp = logical.scope.generateUidIdentifierBasedOnNode(left)
+    logical.scope.push({ id: t.cloneNode(tmp) })
+    test = t.assignmentExpression('=', t.cloneNode(tmp), left)
+    valueRef = t.cloneNode(tmp)
+  }
+  const testExpr = node.operator === '??' ? t.binaryExpression('!=', test, t.nullLiteral()) : test
+  logical.replaceWith(
+    node.operator === '&&'
+      ? t.conditionalExpression(testExpr, right, valueRef)
+      : t.conditionalExpression(testExpr, valueRef, right),
+  )
+  path.skip()
+  return true
+}
+
+function findEnclosingShortCircuitLogical(
+  path: NodePath,
+  stmtPath: NodePath,
+): NodePath<t.LogicalExpression> | null {
+  let cur: NodePath = path
+  let parent = cur.parentPath
+  let found: NodePath<t.LogicalExpression> | null = null
+  while (parent && parent !== stmtPath) {
+    if (!found) {
+      if (
+        parent.isConditionalExpression() &&
+        (parent.node.consequent === cur.node || parent.node.alternate === cur.node)
+      ) {
+        return null
+      }
+      if (parent.isLogicalExpression() && parent.node.right === cur.node) {
+        found = parent as NodePath<t.LogicalExpression>
+      }
+    } else if (isConditionalGate(parent, cur)) {
+      return null
+    }
+    cur = parent
+    parent = cur.parentPath
+  }
+  return found
+}
+
+// Loop tests and updates repeat, while a `for` initializer runs once.
+function isInsideLoopHeader(path: NodePath, stmtPath: NodePath): boolean {
+  let ancestor: NodePath | null = path
+  while (ancestor && ancestor.parentPath !== stmtPath) {
+    ancestor = ancestor.parentPath
+  }
+  if (!ancestor) {
+    return false
+  }
+  if (stmtPath.isWhileStatement() || stmtPath.isDoWhileStatement()) {
+    return ancestor.parentKey === 'test'
+  }
+  if (stmtPath.isForStatement()) {
+    return ancestor.parentKey === 'test' || ancestor.parentKey === 'update'
+  }
+  return false
+}
+
+// Split sequences so later lifts target the right statement.
+function seqToExpressionStatements(expr: t.Expression): t.Statement[] {
+  if (t.isSequenceExpression(expr)) {
+    return expr.expressions.map((e) => t.expressionStatement(e))
+  }
+  return [t.expressionStatement(expr)]
+}
+
+// In return and throw, only the final sequence element supplies the value.
+function seqWithFinal(expr: t.Expression, build: (e: t.Expression) => t.Statement): t.Statement[] {
+  if (t.isSequenceExpression(expr)) {
+    const last = expr.expressions.at(-1)!
+    const init = expr.expressions.slice(0, -1).map((e) => t.expressionStatement(e))
+    return [...init, build(last)]
+  }
+  return [build(expr)]
+}
+
+// In a bare assignment, only the final sequence element supplies the value.
+function seqWithAssignment(expr: t.Expression, target: t.Identifier): t.Statement[] {
+  const build = (value: t.Expression): t.Statement =>
+    t.expressionStatement(t.assignmentExpression('=', t.cloneNode(target), value))
+  return seqWithFinal(expr, build)
+}

package/src/transforms/update-to-assignment.ts

@@ -0,0 +1,132 @@
+import type { Binding, NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { isDirectEvalCall, isInsideWith } from 'src/utils/ast'
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+
+/**
+ * Rewrites numeric updates as compound assignments for later expansion. Prefix
+ * results already match. Postfix forms require a position that discards the old
+ * value.
+ *
+ * BigInt differs because adding the number `1` throws. Only bindings proven to
+ * stay numeric are rewritten. Members and parameters stay unchanged.
+ *
+ * @example
+ * // ◀️ before
+ * let i = 0;
+ * i++;
+ * arr[++i] = 1;
+ * let n = 5n;
+ * n++;
+ *
+ * // ▶️ after
+ * let i = 0;
+ * i += 1;
+ * arr[i += 1] = 1;
+ * let n = 5n;
+ * n++;
+ */
+export function updateToAssignment(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  UpdateExpression(path, state) {
+    const { argument, prefix, operator } = path.node
+    if (!t.isIdentifier(argument)) {
+      return
+    }
+    if (!prefix && !valueIsDiscarded(path)) {
+      return
+    }
+    // `with` can retarget the name and defeat the numeric proof.
+    if (isInsideWith(path)) {
+      return
+    }
+    const binding = path.scope.getBinding(argument.name)
+    if (!isNumericBinding(binding)) {
+      return
+    }
+    // Direct eval anywhere in the binding's scope can change its type.
+    if (bindingScopeReachesDirectEval(binding!)) {
+      return
+    }
+    const compound = operator === '++' ? '+=' : '-='
+    path.replaceWith(t.assignmentExpression(compound, argument, t.numericLiteral(1)))
+    state.changed = true
+  },
+}
+
+function valueIsDiscarded(path: NodePath<t.UpdateExpression>): boolean {
+  const { parentPath } = path
+  if (!parentPath) {
+    return false
+  }
+  if (parentPath.isExpressionStatement()) {
+    return true
+  }
+  if (parentPath.isForStatement() && parentPath.node.update === path.node) {
+    return true
+  }
+  if (parentPath.isSequenceExpression()) {
+    return parentPath.node.expressions.at(-1) !== path.node
+  }
+  return false
+}
+
+// The initializer and every mutation must keep the binding numeric.
+function isNumericBinding(binding: Binding | undefined): boolean {
+  if (!binding || (binding.kind !== 'var' && binding.kind !== 'let')) {
+    return false
+  }
+  const declarator = binding.path.node
+  if (!t.isVariableDeclarator(declarator) || !t.isNumericLiteral(declarator.init)) {
+    return false
+  }
+  // Babel misses the string writes from an Annex B `for-in` initializer.
+  if (isForInOfLoopVariable(binding)) {
+    return false
+  }
+  return binding.constantViolations.every((violation) => keepsNumeric(violation.node))
+}
+
+// A sibling or nested direct eval can still close over and reassign the binding.
+function bindingScopeReachesDirectEval(binding: Binding): boolean {
+  let found = false
+  t.traverseFast(binding.scope.block, (node) => {
+    if (isDirectEvalCall(node)) {
+      found = true
+    }
+    return found ? t.traverseFast.stop : undefined
+  })
+  return found
+}
+
+function isForInOfLoopVariable(binding: Binding): boolean {
+  const declaration = binding.path.parentPath
+  if (!declaration || !declaration.isVariableDeclaration()) {
+    return false
+  }
+  const loop = declaration.parentPath
+  return (
+    loop != null &&
+    (loop.isForInStatement() || loop.isForOfStatement()) &&
+    loop.node.left === declaration.node
+  )
+}
+
+function keepsNumeric(node: t.Node): boolean {
+  if (t.isUpdateExpression(node)) {
+    return true
+  }
+  if (t.isVariableDeclarator(node)) {
+    return t.isNumericLiteral(node.init)
+  }
+  if (t.isAssignmentExpression(node)) {
+    return t.isNumericLiteral(node.right)
+  }
+  return false
+}

package/src/transforms/yodify-conditions.ts

@@ -0,0 +1,103 @@
+import type { Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from 'src/utils/change-tracking'
+import type { ChangeState } from 'src/utils/change-tracking'
+import { isLiteralShaped } from 'src/utils/literal'
+
+/**
+ * Moves a safe literal-shaped right operand to the left of a comparison.
+ * Relational operators are flipped after swapping.
+ *
+ * Unary operations over literals also count when their coercion cannot act.
+ *
+ * @example
+ * // ◀️ before
+ * if (x === 1) {}
+ * if (name !== "foo") {}
+ * if (count > 5) {}
+ * if (idx <= 10) {}
+ *
+ * // ▶️ after
+ * if (1 === x) {}
+ * if ("foo" !== name) {}
+ * if (5 < count) {}
+ * if (10 >= idx) {}
+ */
+export function yodifyConditions(ast: File): boolean {
+  return traverseForChanges(ast, visitor)
+}
+
+const visitor: Visitor<ChangeState> = {
+  BinaryExpression(path, state) {
+    const { node } = path
+    const op = node.operator
+    if (!isComparisonOp(op)) {
+      return
+    }
+    if (!t.isExpression(node.left)) {
+      return
+    }
+    if (isLiteralShaped(node.left)) {
+      return
+    }
+    // The moved right side must run no user code, including object coercion.
+    if (!swappingRightIsEffectFree(node.right)) {
+      return
+    }
+    // Relational comparison coerces left first, so a regexp operand cannot swap.
+    if (RELATIONAL_FLIP[op] !== undefined && containsRegExpLiteral(node.right)) {
+      return
+    }
+
+    const { left } = node
+    const { right } = node
+    node.left = right
+    node.right = left
+    const flipped = RELATIONAL_FLIP[op]
+    if (flipped !== undefined) {
+      node.operator = flipped
+    }
+    state.changed = true
+  },
+}
+
+const COMPARISON_OPS = new Set<string>(['==', '!=', '===', '!==', '<', '<=', '>', '>='])
+
+function isComparisonOp(op: string): boolean {
+  return COMPARISON_OPS.has(op)
+}
+
+const RELATIONAL_FLIP: Record<string, t.BinaryExpression['operator']> = {
+  '<': '>',
+  '>': '<',
+  '<=': '>=',
+  '>=': '<=',
+}
+
+// Numeric unary over regexp invokes ToPrimitive and cannot move earlier.
+function swappingRightIsEffectFree(node: t.Expression): boolean {
+  return isLiteralShaped(node) && !numericUnaryCoercesRegExp(node)
+}
+
+// `!` only propagates risk because ToBoolean never invokes object coercion.
+function numericUnaryCoercesRegExp(node: t.Node): boolean {
+  if (!t.isUnaryExpression(node) || !t.isExpression(node.argument)) {
+    return false
+  }
+  if (node.operator === '!') {
+    return numericUnaryCoercesRegExp(node.argument)
+  }
+  return t.isRegExpLiteral(node.argument) || numericUnaryCoercesRegExp(node.argument)
+}
+
+function containsRegExpLiteral(node: t.Expression): boolean {
+  if (t.isRegExpLiteral(node)) {
+    return true
+  }
+  if (t.isUnaryExpression(node) && t.isExpression(node.argument)) {
+    return containsRegExpLiteral(node.argument)
+  }
+  return false
+}