webfuscator 0.9.4

package/src/utils/evaluation-order.ts

@@ -0,0 +1,178 @@
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+
+import { isPure } from 'src/analysis/purity'
+
+// Moving a gated node can change whether it runs.
+export function isConditionalGate(parent: NodePath, cur: NodePath): boolean {
+  if (parent.isLogicalExpression() && parent.node.right === cur.node) {
+    return true
+  }
+  if (
+    parent.isConditionalExpression() &&
+    (parent.node.consequent === cur.node || parent.node.alternate === cur.node)
+  ) {
+    return true
+  }
+  if (parent.isOptionalMemberExpression()) {
+    // Computed keys run only after the optional base proves non-nullish.
+    if (parent.node.object === cur.node) {
+      return parent.node.optional
+    }
+    if (parent.node.computed && parent.node.property === cur.node) {
+      return true
+    }
+  }
+  if (parent.isOptionalCallExpression()) {
+    if (parent.node.callee === cur.node) {
+      return parent.node.optional
+    }
+    // Arguments run only once the callee proves non-nullish.
+    if (parent.node.arguments.some((arg) => arg === cur.node)) {
+      return true
+    }
+  }
+  return false
+}
+
+// Hoisting to statement position requires no gate or earlier observable work.
+export function reorderableToStatement(path: NodePath, stmtPath: NodePath): boolean {
+  let cur: NodePath = path
+  let parent = cur.parentPath
+  while (parent && parent !== stmtPath) {
+    if (isConditionalGate(parent, cur)) {
+      return false
+    }
+    if (precedingEvaluationHasSideEffect(parent, cur)) {
+      return false
+    }
+    cur = parent
+    parent = cur.parentPath
+  }
+  return true
+}
+
+// Unknown parent shapes are unsafe. Known operands use `isPure` with their live
+// scope and path.
+function precedingEvaluationHasSideEffect(parentPath: NodePath, curPath: NodePath): boolean {
+  const parent = parentPath.node
+  const cur = curPath.node
+
+  if (t.isBinaryExpression(parent)) {
+    return parent.right === cur && impure([parentPath.get('left') as NodePath])
+  }
+  if (
+    t.isLogicalExpression(parent) ||
+    t.isUnaryExpression(parent) ||
+    t.isSpreadElement(parent) ||
+    t.isVariableDeclarator(parent)
+  ) {
+    return false
+  }
+  if (t.isVariableDeclaration(parent)) {
+    const declarators = precedingSiblings(parentPath, 'declarations', cur)
+    return impure(declarators.map((decl) => decl.get('init') as NodePath))
+  }
+  if (t.isAssignmentExpression(parent) && parent.right === cur) {
+    const target = parentPath.get('left') as NodePath
+    // Compound assignment reads its target before the right side. Plain `=`
+    // only resolves the write reference.
+    if (parent.operator === '=') {
+      return !writeReferenceIsPure(target)
+    }
+    return !compoundTargetReadIsPure(target)
+  }
+  if (t.isSequenceExpression(parent)) {
+    return impure(precedingSiblings(parentPath, 'expressions', cur))
+  }
+  if (
+    t.isCallExpression(parent) ||
+    t.isOptionalCallExpression(parent) ||
+    t.isNewExpression(parent)
+  ) {
+    const args = parentPath.get('arguments') as NodePath[]
+    const index = args.findIndex((arg) => arg.node === cur)
+    if (index === -1) {
+      return false
+    }
+    return impure([parentPath.get('callee') as NodePath, ...args.slice(0, index)])
+  }
+  if (t.isMemberExpression(parent) || t.isOptionalMemberExpression(parent)) {
+    return parent.property === cur && impure([parentPath.get('object') as NodePath])
+  }
+  if (t.isArrayExpression(parent)) {
+    return impure(precedingSiblings(parentPath, 'elements', cur))
+  }
+  if (t.isObjectProperty(parent)) {
+    return parent.value === cur && parent.computed && impure([parentPath.get('key') as NodePath])
+  }
+  if (t.isObjectExpression(parent)) {
+    return precedingSiblings(parentPath, 'properties', cur).some((prop) => !propertyIsPure(prop))
+  }
+  if (t.isTemplateLiteral(parent)) {
+    return impure(precedingSiblings(parentPath, 'expressions', cur))
+  }
+  if (t.isConditionalExpression(parent)) {
+    // Branches were caught as gates, leaving only the test here.
+    return false
+  }
+  return true
+}
+
+// List entries evaluated before `cur` are the ones a hoist must cross.
+function precedingSiblings<T extends NodePath>(
+  parentPath: NodePath,
+  listKey: string,
+  cur: t.Node,
+): T[] {
+  const siblings = parentPath.get(listKey) as T[]
+  return siblings.slice(
+    0,
+    siblings.findIndex((sibling) => sibling.node === cur),
+  )
+}
+
+function isPurePath(path: NodePath): boolean {
+  return isPure(path.node, path.scope, path)
+}
+
+function impure(paths: (NodePath | null | undefined)[]): boolean {
+  return paths.some((path) => path != null && path.node != null && !isPurePath(path))
+}
+
+// Member targets evaluate their base and computed key before the right side.
+function writeReferenceIsPure(target: NodePath): boolean {
+  if (target.isIdentifier()) {
+    return true
+  }
+  if (target.isMemberExpression()) {
+    return (
+      isPurePath(target.get('object') as NodePath) &&
+      (!target.node.computed || isPurePath(target.get('property') as NodePath))
+    )
+  }
+  return false
+}
+
+// Compound assignment reads the target. Members and unresolved names may invoke
+// accessors.
+function compoundTargetReadIsPure(target: NodePath): boolean {
+  return target.isIdentifier() && isPurePath(target)
+}
+
+function propertyIsPure(propPath: NodePath): boolean {
+  const prop = propPath.node
+  if (t.isSpreadElement(prop)) {
+    return false
+  }
+  if (t.isObjectMethod(prop)) {
+    return !prop.computed || isPurePath(propPath.get('key') as NodePath)
+  }
+  if (t.isObjectProperty(prop)) {
+    if (prop.computed && !isPurePath(propPath.get('key') as NodePath)) {
+      return false
+    }
+    return t.isExpression(prop.value) && isPurePath(propPath.get('value') as NodePath)
+  }
+  return false
+}

package/src/utils/literal.ts

@@ -0,0 +1,96 @@
+import * as t from '@babel/types'
+
+const MAX_STRING_LITERAL_LENGTH = 4096
+
+// RegExp literals allocate mutable objects and are not primitive values.
+export function isPrimitiveLiteral(node: t.Node): boolean {
+  return (
+    t.isStringLiteral(node) ||
+    t.isNumericLiteral(node) ||
+    t.isBooleanLiteral(node) ||
+    t.isNullLiteral(node) ||
+    t.isBigIntLiteral(node)
+  )
+}
+
+// `+bigint` is the only literal-shaped unary form that throws.
+export function isLiteralShaped(node: t.Node): boolean {
+  return literalShapeKind(node) !== null
+}
+
+// Unary minus and bitwise not preserve BigInt; unary plus throws on it.
+function literalShapeKind(node: t.Node): 'bigint' | 'other' | null {
+  if (t.isBigIntLiteral(node)) {
+    return 'bigint'
+  }
+  if (isPrimitiveLiteral(node) || t.isRegExpLiteral(node)) {
+    return 'other'
+  }
+  if (t.isUnaryExpression(node)) {
+    const inner = literalShapeKind(node.argument)
+    if (inner === null) {
+      return null
+    }
+    if (node.operator === '!') {
+      return 'other'
+    }
+    if (node.operator === '+') {
+      return inner === 'bigint' ? null : 'other'
+    }
+    if (node.operator === '-' || node.operator === '~') {
+      return inner
+    }
+  }
+  return null
+}
+
+export function valueToLiteral(value: unknown): t.Expression | null {
+  if (typeof value === 'string') {
+    if (value.length > MAX_STRING_LITERAL_LENGTH) {
+      return null
+    }
+    return t.stringLiteral(value)
+  }
+  if (typeof value === 'boolean') {
+    return t.booleanLiteral(value)
+  }
+  if (value === null) {
+    return t.nullLiteral()
+  }
+  if (value === undefined) {
+    // `void 0` cannot be shadowed like the identifier `undefined`.
+    return t.unaryExpression('void', t.numericLiteral(0))
+  }
+  if (typeof value === 'bigint') {
+    // A UnaryExpression lets the generator parenthesize negative BigInt where
+    // precedence requires it.
+    if (value < 0n) {
+      return t.unaryExpression('-', t.bigIntLiteral(-value))
+    }
+    return t.bigIntLiteral(value)
+  }
+  if (typeof value === 'number') {
+    if (Number.isNaN(value) || !Number.isFinite(value)) {
+      return null
+    }
+    if (Object.is(value, -0)) {
+      return t.unaryExpression('-', t.numericLiteral(0))
+    }
+    if (value < 0) {
+      return t.unaryExpression('-', t.numericLiteral(-value))
+    }
+    return t.numericLiteral(value)
+  }
+  if (Array.isArray(value)) {
+    const elements: t.Expression[] = []
+    for (const item of value) {
+      const lit = valueToLiteral(item)
+      if (!lit) {
+        return null
+      }
+      elements.push(lit)
+    }
+    return t.arrayExpression(elements)
+  }
+  return null
+}

package/src/utils/logical-lowering.ts

@@ -0,0 +1,132 @@
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+
+import { isSideEffectFree } from 'src/analysis/purity'
+import { isStandaloneDeclaration } from 'src/utils/paths'
+
+// Lowers a short-circuit expression assigned to a bare identifier:
+//
+//   x = L;
+//   if (<fallbackTest(x)>) x = R;
+//
+// `fallbackTest` selects `!x`, `x`, or `x == null`. The parent must accept a
+// multi-statement replacement.
+export function lowerLogicalWriteStatement(
+  path: NodePath<t.LogicalExpression>,
+  fallbackTest: (target: t.Identifier) => t.Expression,
+): boolean {
+  const { node } = path
+  const parent = path.parentPath
+  if (!parent) {
+    return false
+  }
+
+  if (
+    parent.isVariableDeclarator() &&
+    parent.node.init === node &&
+    t.isIdentifier(parent.node.id)
+  ) {
+    const declStmt = parent.parentPath
+    if (
+      !declStmt?.isVariableDeclaration() ||
+      // The split would emit illegal `const x;` and then write it.
+      declStmt.node.kind === 'const' ||
+      declStmt.node.declarations.length !== 1 ||
+      !isStandaloneDeclaration(declStmt)
+    ) {
+      return false
+    }
+    const target = parent.node.id
+    // The split writes `x` before evaluating the right side. Refuse any right
+    // side that could observe the new value or the ended TDZ.
+    if (rightCanObserveTarget(node.right, target.name)) {
+      return false
+    }
+    declStmt.replaceWithMultiple([
+      t.variableDeclaration(declStmt.node.kind, [
+        t.variableDeclarator(t.cloneNode(target), node.left),
+      ]),
+      guardedReassignment(target, fallbackTest, node.right),
+    ])
+    return true
+  }
+
+  if (
+    parent.isAssignmentExpression() &&
+    parent.node.operator === '=' &&
+    parent.node.right === node &&
+    t.isIdentifier(parent.node.left)
+  ) {
+    const exprStmt = parent.parentPath
+    if (!exprStmt?.isExpressionStatement() || exprStmt.node.expression !== parent.node) {
+      return false
+    }
+    const target = parent.node.left
+    // An unresolved name may be a global accessor. The split adds a getter read
+    // and can add a second setter call.
+    if (!path.scope.getBinding(target.name)) {
+      return false
+    }
+    // Writing first would change `x = 0 || x` before the right side reads `x`.
+    if (
+      !isSideEffectFree(node.right, path.scope, path) ||
+      referencesName(node.right, target.name)
+    ) {
+      return false
+    }
+    exprStmt.replaceWithMultiple([
+      t.expressionStatement(t.assignmentExpression('=', t.cloneNode(target), node.left)),
+      guardedReassignment(target, fallbackTest, node.right),
+    ])
+    return true
+  }
+
+  return false
+}
+
+// Calls, getters, and suspension can observe the target through code outside the
+// expression, even when the target name does not appear directly.
+function rightCanObserveTarget(rightNode: t.Node, targetName: string): boolean {
+  let observes = false
+  t.traverseFast(rightNode, (node) => {
+    if (
+      (t.isIdentifier(node) && node.name === targetName) ||
+      t.isCallExpression(node) ||
+      t.isOptionalCallExpression(node) ||
+      t.isNewExpression(node) ||
+      t.isTaggedTemplateExpression(node) ||
+      t.isMemberExpression(node) ||
+      t.isOptionalMemberExpression(node) ||
+      t.isAwaitExpression(node) ||
+      t.isYieldExpression(node)
+    ) {
+      observes = true
+    }
+    return observes ? t.traverseFast.stop : undefined
+  })
+  return observes
+}
+
+function referencesName(node: t.Node, name: string): boolean {
+  let found = false
+  t.traverseFast(node, (child) => {
+    if (!found && t.isIdentifier(child) && child.name === name) {
+      found = true
+    }
+    return found ? t.traverseFast.skip : undefined
+  })
+  return found
+}
+
+function guardedReassignment(
+  target: t.Identifier,
+  fallbackTest: (target: t.Identifier) => t.Expression,
+  value: t.Expression,
+): t.IfStatement {
+  return t.ifStatement(
+    fallbackTest(t.cloneNode(target)),
+    t.blockStatement([
+      t.expressionStatement(t.assignmentExpression('=', t.cloneNode(target), value)),
+    ]),
+  )
+}

package/src/utils/loop-lowering.ts

@@ -0,0 +1,109 @@
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+
+/**
+ * Collects labels whose body is this loop. Their `continue` statements must be
+ * redirected after lowering. A hoisted initializer belongs outside the
+ * outermost label.
+ */
+export function collectLoopLabels(path: NodePath<t.Statement>): {
+  outermost: NodePath<t.Statement>
+  ourLabels: Set<string>
+} {
+  const ourLabels = new Set<string>()
+  let outermost: NodePath<t.Statement> = path
+  for (;;) {
+    const parent = outermost.parentPath
+    if (!parent?.isLabeledStatement() || parent.node.body !== outermost.node) {
+      break
+    }
+    outermost = parent
+    ourLabels.add(parent.node.label.name)
+  }
+  return { outermost, ourLabels }
+}
+
+/**
+ * Generates an inner-block label after reserving labels above and inside the
+ * loop. `scope.generateUid` alone can miss an enclosing user label.
+ */
+export function generateLoopLabel(path: NodePath<t.Statement>, hint: string): string {
+  const taken = new Set<string>()
+  let ancestor: NodePath | null = path.parentPath
+  while (ancestor) {
+    if (ancestor.isLabeledStatement()) {
+      taken.add(ancestor.node.label.name)
+    }
+    ancestor = ancestor.parentPath
+  }
+  path.traverse({
+    LabeledStatement(inner) {
+      taken.add(inner.node.label.name)
+    },
+  })
+  // `generateUid` supplies its own counter, even after stripping hint digits.
+  let name = path.scope.generateUid(hint)
+  while (taken.has(name)) {
+    name = path.scope.generateUid(hint)
+  }
+  return name
+}
+
+/**
+ * Redirects this loop's `continue` statements to the lowered inner block.
+ * Nested loops, other labels, and nested functions stay untouched. The count
+ * lets callers omit an unused label.
+ */
+export function redirectContinues(
+  rootPath: NodePath,
+  innerLabel: string,
+  ourLabels: Set<string>,
+): number {
+  const state: RedirectState = { count: 0, innerLabel, ourLabels, rootPath }
+  rootPath.traverse(redirectVisitor, state)
+  return state.count
+}
+
+interface RedirectState {
+  count: number
+  innerLabel: string
+  ourLabels: Set<string>
+  rootPath: NodePath
+}
+
+const redirectVisitor: Visitor<RedirectState> = {
+  Function(path) {
+    path.skip()
+  },
+  ContinueStatement(path, state) {
+    const { label } = path.node
+    if (!label) {
+      if (!hasInterposedLoop(path, state.rootPath)) {
+        path.replaceWith(t.breakStatement(t.identifier(state.innerLabel)))
+        state.count++
+      }
+      return
+    }
+    if (state.ourLabels.has(label.name)) {
+      path.replaceWith(t.breakStatement(t.identifier(state.innerLabel)))
+      state.count++
+    }
+  },
+}
+
+function hasInterposedLoop(path: NodePath, rootPath: NodePath): boolean {
+  let current: NodePath | null = path.parentPath
+  while (current && current !== rootPath) {
+    if (
+      current.isForStatement() ||
+      current.isForInStatement() ||
+      current.isForOfStatement() ||
+      current.isWhileStatement() ||
+      current.isDoWhileStatement()
+    ) {
+      return true
+    }
+    current = current.parentPath
+  }
+  return false
+}

package/src/utils/paths.ts

@@ -0,0 +1,103 @@
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+
+// Only statement-list positions accept several replacements. Loop heads do not.
+export function isStandaloneDeclaration(declPath: NodePath<t.VariableDeclaration>): boolean {
+  const owner = declPath.parentPath
+  if (!owner) {
+    return false
+  }
+  if (owner.isForStatement() && owner.node.init === declPath.node) {
+    return false
+  }
+  if (owner.isForInStatement() && owner.node.left === declPath.node) {
+    return false
+  }
+  if (owner.isForOfStatement() && owner.node.left === declPath.node) {
+    return false
+  }
+  return owner.isBlock() || owner.isSwitchCase()
+}
+
+// Babel treats destructured writes as binding identifiers. Labels must still be
+// excluded because they bind no variable.
+export function referencesOrWritesVariable(path: NodePath<t.Identifier>): boolean {
+  if (path.parentPath?.isLabeledStatement()) {
+    return false
+  }
+  // Separate calls avoid an incorrect `never` narrowing across `||`.
+  const isRead = path.isReferencedIdentifier()
+  const isWrite = path.isBindingIdentifier()
+  return isRead || isWrite
+}
+
+// Replacing a callee or tag member with a bare value would lose its `this`.
+export function isCalleeOrTagOf(path: NodePath): boolean {
+  const parent = path.parentPath
+  if (!parent) {
+    return false
+  }
+  if (
+    (parent.isCallExpression() || parent.isOptionalCallExpression()) &&
+    parent.node.callee === path.node
+  ) {
+    return true
+  }
+  return parent.isTaggedTemplateExpression() && parent.node.tag === path.node
+}
+
+// Strictness comes from modules, classes, or an enclosing directive prologue.
+export function isInStrictContext(path: NodePath): boolean {
+  for (let current: NodePath | null = path; current; current = current.parentPath) {
+    if (current.isClass()) {
+      return true
+    }
+    if (current.isProgram()) {
+      return current.node.sourceType === 'module' || hasUseStrictDirective(current.node.directives)
+    }
+    if (
+      current.isFunction() &&
+      t.isBlockStatement(current.node.body) &&
+      hasUseStrictDirective(current.node.body.directives)
+    ) {
+      return true
+    }
+  }
+  return false
+}
+
+function hasUseStrictDirective(directives: readonly t.Directive[]): boolean {
+  return directives.some((directive) => directive.value.value === 'use strict')
+}
+
+// ECMA-262 B.3.3 gives sloppy block-level functions a `var` alias that Babel
+// omits from the enclosing scope. Renaming, moving, or removing one can expose it.
+export function hasAnnexBFunctionAlias(path: NodePath): boolean {
+  if (!path.isFunctionDeclaration()) {
+    return false
+  }
+  const parent = path.parentPath
+  if (!parent || parent.isProgram()) {
+    return false
+  }
+  if (
+    parent.isBlockStatement() &&
+    parent.key === 'body' &&
+    parent.parentPath != null &&
+    parent.parentPath.isFunction()
+  ) {
+    return false
+  }
+  return !isInStrictContext(parent)
+}
+
+// A later write to `const` must keep throwing after transformation.
+export function hasConstantViolation(path: NodePath<t.VariableDeclaration>): boolean {
+  for (const name of Object.keys(path.getBindingIdentifiers())) {
+    const binding = path.scope.getBinding(name)
+    if (binding && binding.constantViolations.length > 0) {
+      return true
+    }
+  }
+  return false
+}

package/src/utils/random.ts

@@ -0,0 +1,22 @@
+// Mulberry32 is deterministic per seed and is not cryptographic.
+export function mulberry32(seed: number): () => number {
+  let state = seed >>> 0
+  return () => {
+    state = (state + 0x6d_2b_79_f5) >>> 0
+    let t = state
+    t = Math.imul(t ^ (t >>> 15), t | 1)
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61)
+    return ((t ^ (t >>> 14)) >>> 0) / 4_294_967_296
+  }
+}
+
+// Fisher-Yates shuffle, in place.
+export function shuffleInPlace<T>(items: T[], rng: () => number): T[] {
+  for (let index = items.length - 1; index > 0; index--) {
+    const pick = Math.floor(rng() * (index + 1))
+    const swapped = items[index]!
+    items[index] = items[pick]!
+    items[pick] = swapped
+  }
+  return items
+}