webfuscator 1.2.0 → 1.3.0

package/src/transforms/pack.ts

@@ -10,6 +10,103 @@ import { isCalleeOrTagOf, isInStrictContext, referencesOrWritesVariable } from '
 import { mulberry32 } from '../utils/random'
 import { StringGenerator } from '../utils/string-generator'
 
+// The ECMAScript intrinsics and the common host globals. A detached Function
+// body reaches every one of them and gets the same value, so pack can leave them
+// bare. The CommonJS wrapper names (require, module, exports, __dirname,
+// __filename) are left out on purpose. They are function parameters, not
+// properties of the global object, so a Function body cannot see them and pack
+// routes them like any other free name. `skipGlobals: true` opts into this list.
+const STANDARD_GLOBALS: readonly string[] = [
+  'globalThis',
+  'self',
+  'Infinity',
+  'NaN',
+  'undefined',
+  'parseInt',
+  'parseFloat',
+  'isNaN',
+  'isFinite',
+  'decodeURI',
+  'decodeURIComponent',
+  'encodeURI',
+  'encodeURIComponent',
+  'escape',
+  'unescape',
+  'btoa',
+  'atob',
+  'structuredClone',
+  'fetch',
+  'queueMicrotask',
+  'setTimeout',
+  'clearTimeout',
+  'setInterval',
+  'clearInterval',
+  'setImmediate',
+  'clearImmediate',
+  'Object',
+  'Function',
+  'Boolean',
+  'Symbol',
+  'BigInt',
+  'Number',
+  'Math',
+  'Date',
+  'String',
+  'RegExp',
+  'JSON',
+  'Promise',
+  'Proxy',
+  'Reflect',
+  'Error',
+  'EvalError',
+  'RangeError',
+  'ReferenceError',
+  'SyntaxError',
+  'TypeError',
+  'URIError',
+  'AggregateError',
+  'Array',
+  'Map',
+  'Set',
+  'WeakMap',
+  'WeakSet',
+  'WeakRef',
+  'FinalizationRegistry',
+  'ArrayBuffer',
+  'SharedArrayBuffer',
+  'DataView',
+  'Atomics',
+  'Int8Array',
+  'Uint8Array',
+  'Uint8ClampedArray',
+  'Int16Array',
+  'Uint16Array',
+  'Int32Array',
+  'Uint32Array',
+  'Float32Array',
+  'Float64Array',
+  'BigInt64Array',
+  'BigUint64Array',
+  'console',
+  'crypto',
+  'performance',
+  'Intl',
+  'URL',
+  'URLSearchParams',
+  'TextEncoder',
+  'TextDecoder',
+  'WebAssembly',
+  'window',
+  'document',
+  'location',
+  'postMessage',
+  'alert',
+  'confirm',
+  'global',
+  'process',
+  'Buffer',
+]
+
 /**
  * Serializes the whole program to a string and rebuilds it at runtime through
  * the `Function` constructor. A detached function body only reaches true globals
@@ -17,13 +114,11 @@ import { StringGenerator } from '../utils/string-generator'
  * bundler-injected binding, or a live import, none reachable from the body and
  * none distinguishable from a global at build time, so free names are routed
  * through a parameter object whose accessors run in the original top-level scope
- * and resolve each name there. Import declarations return above the call. `eval`
- * is left un-routed so a direct eval still reads the body scope. Names inside a
- * `with` stay un-routed too, since they may resolve against the with object at
- * runtime. Export statements cannot live inside a Function body, so pack throws
- * on them. It packs everything else as written. Code that needs `import.meta`,
- * top-level await, dynamic `import()`, or a top-level `arguments` will not run
- * once moved into a Function body.
+ * and resolve each name there. Imports remain above the call. Names inside
+ * `with` stay bare so the object still controls lookup. A Function body cannot
+ * contain exports, so pack throws when it finds one. Code that needs
+ * `import.meta`, top-level await, dynamic `import()`, or top-level `arguments`
+ * will not run after the move.
  *
  * @example
  * // ◀️ before
@@ -94,14 +189,19 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
   const readProperties = new Map<string, string>()
   const typeofProperties = new Map<string, string>()
   const settable = new Set<string>()
+  const freshProperty = (): string => {
+    let property: string
+    do {
+      // `__proto__` as an object-literal key would set the prototype rather
+      // than name an accessor.
+      property = generator.next()
+    } while (property === '__proto__')
+    return property
+  }
   const propertyFor = (registry: Map<string, string>, name: string): string => {
     let property = registry.get(name)
     if (property === undefined) {
-      do {
-        // `__proto__` as an object-literal key would set the prototype rather
-        // than name an accessor.
-        property = generator.next()
-      } while (property === '__proto__')
+      property = freshProperty()
       registry.set(name, property)
     }
     return property
@@ -109,12 +209,28 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
   const memberFor = (property: string): t.MemberExpression =>
     t.memberExpression(t.identifier(objectName), t.stringLiteral(property), true)
 
+  // Import locals read as free once detached but are unreachable from a Function
+  // body, so they route even when the caller lists them in skipGlobals.
+  const importedNames = new Set<string>()
+  for (const declaration of importDeclarations) {
+    for (const specifier of declaration.specifiers) {
+      importedNames.add(specifier.local.name)
+    }
+  }
+  const skipOption = ctx.pack?.skipGlobals ?? false
+  let skipNames: readonly string[] = []
+  if (skipOption === true) {
+    skipNames = STANDARD_GLOBALS
+  } else if (skipOption !== false) {
+    skipNames = skipOption
+  }
+  const skip = new Set<string>(skipNames)
+
   const isRoutable = (path: NodePath<t.Identifier>): boolean => {
     const name = path.node.name
-    // The wrapper parameter stays as written. `arguments` and `eval` are never
-    // routed: `arguments` binds to its own function's object, and leaving `eval`
-    // bare keeps a direct eval reading the body scope rather than the global one.
-    if (name === objectName || name === 'arguments' || name === 'eval') {
+    // Keep the wrapper parameter and `arguments` bare. The latter must bind to
+    // the wrapper function's own arguments object.
+    if (name === objectName || name === 'arguments') {
       return false
     }
     // Inside `with`, a free name may resolve to a property of the with object at
@@ -125,10 +241,28 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
     if (!referencesOrWritesVariable(path)) {
       return false
     }
-    return !path.scope.getBinding(name)
+    if (path.scope.getBinding(name)) {
+      return false
+    }
+    return importedNames.has(name) || !skip.has(name)
   }
 
+  // A strict script's top-level `this` is the global object, but a strict
+  // Function called plainly sees `undefined`. Rather than reach for `.call`,
+  // route top-level `this` through a captured property like any free name.
+  const routeTopLevelThis = bodyStrict && !wasModule
+  let thisProperty: string | null = null
+
   const routingVisitor: Visitor = {
+    ThisExpression(path) {
+      if (!routeTopLevelThis || !isTopLevelThis(path)) {
+        return
+      }
+      if (thisProperty === null) {
+        thisProperty = freshProperty()
+      }
+      path.replaceWith(memberFor(thisProperty))
+    },
     UnaryExpression(path) {
       if (path.node.operator !== 'typeof') {
         return
@@ -161,18 +295,13 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
   }
   programPath.traverse(routingVisitor)
 
-  // The script completion value is its trailing expression; returning it keeps
-  // `eval` of the packed output producing the same value.
   const body = programNode.body
-  const lastStatement = body.at(-1)
-  if (lastStatement && t.isExpressionStatement(lastStatement)) {
-    body[body.length - 1] = t.returnStatement(lastStatement.expression)
-  }
-
   const innerDirectives = bodyStrict ? [t.directive(t.directiveLiteral('use strict'))] : []
   const innerCode = generate(t.program(body, innerDirectives, 'script'), {
     minified: true,
     comments: false,
+    // `comments: false` still allows @license and @preserve.
+    shouldPrintComment: () => false,
   }).code
 
   const objectExpression = buildAccessorObject({
@@ -181,6 +310,7 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
     settable,
     setterParam,
     strict: bodyStrict,
+    thisProperty,
   })
 
   const constructorReference = shadowedConstructor
@@ -193,16 +323,7 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
     t.stringLiteral(objectName),
     t.stringLiteral(innerCode),
   ])
-  // A strict script keeps top-level `this` bound to the global object. A plainly
-  // called strict function would instead see `undefined`, so pass the global
-  // `this` of the sloppy output script.
-  const invocation =
-    bodyStrict && !wasModule
-      ? t.callExpression(t.memberExpression(wrapper, t.identifier('call')), [
-          t.thisExpression(),
-          objectExpression,
-        ])
-      : t.callExpression(wrapper, [objectExpression])
+  const invocation = t.callExpression(wrapper, [objectExpression])
 
   programNode.body = [...importDeclarations, t.expressionStatement(invocation)]
   programNode.directives = []
@@ -238,6 +359,45 @@ function bindsFunctionConstructor(declaration: t.ImportDeclaration): boolean {
   return declaration.specifiers.some((specifier) => specifier.local.name === 'Function')
 }
 
+// A `this` refers to the top-level `this` when no enclosing non-arrow function,
+// class field, or static block captures it before the program does. A computed
+// member key is the exception: it evaluates in the scope surrounding its method
+// or field, not that member's `this`, so a `this` reached through a boundary's
+// `key` skips it and keeps looking outward. `thisBinding` keeps every path
+// predicate off the walked `current`, whose narrowed union would otherwise trip
+// NodePath's invariant generic when reassigned to `child`.
+function isTopLevelThis(path: NodePath<t.ThisExpression>): boolean {
+  let child: NodePath = path
+  let current: NodePath | null = path.parentPath
+  while (current) {
+    const binding = thisBinding(current)
+    if (binding === 'program') {
+      return true
+    }
+    if (binding === 'captured' && child.key !== 'key') {
+      return false
+    }
+    child = current
+    current = current.parentPath
+  }
+  return false
+}
+
+function thisBinding(boundary: NodePath): 'captured' | 'program' | null {
+  if (boundary.isProgram()) {
+    return 'program'
+  }
+  if (
+    (boundary.isFunction() && !boundary.isArrowFunctionExpression()) ||
+    boundary.isClassProperty() ||
+    boundary.isClassPrivateProperty() ||
+    boundary.isStaticBlock()
+  ) {
+    return 'captured'
+  }
+  return null
+}
+
 function isBareDeleteArgument(path: NodePath<t.Identifier>): boolean {
   const parent = path.parentPath
   return (
@@ -291,11 +451,12 @@ interface AccessorObjectSpec {
   setterParam: string
   settable: Set<string>
   strict: boolean
+  thisProperty: string | null
   typeofProperties: Map<string, string>
 }
 
 function buildAccessorObject(spec: AccessorObjectSpec): t.ObjectExpression {
-  const properties: t.ObjectMethod[] = []
+  const properties: (t.ObjectMethod | t.ObjectProperty)[] = []
   for (const [name, property] of spec.readProperties) {
     properties.push(
       t.objectMethod(
@@ -336,5 +497,11 @@ function buildAccessorObject(spec: AccessorObjectSpec): t.ObjectExpression {
       ),
     )
   }
+  // This is a data property. Its `this` value evaluates in the output script's
+  // top-level scope, where `this` is the global object. A getter would bind
+  // `this` to the accessor object instead.
+  if (spec.thisProperty !== null) {
+    properties.push(t.objectProperty(t.stringLiteral(spec.thisProperty), t.thisExpression()))
+  }
   return t.objectExpression(properties)
 }

package/src/transforms/remove-unused-code.ts

@@ -1,10 +1,9 @@
 import traverse from '@babel/traverse'
-import type { NodePath, Scope, Visitor } from '@babel/traverse'
+import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { isSideEffectFree } from '../analysis/purity'
-import { isDirectEvalCall } from '../utils/ast'
 import type { ChangeState } from '../utils/change-tracking'
 import { hasAnnexBFunctionAlias } from '../utils/paths'
 
@@ -28,10 +27,7 @@ export function removeUnusedCode(ast: File): boolean {
   // then maintain counts during removal.
   crawlProgramScope(ast)
   let anyChanged = false
-  const state: SweepState = {
-    changed: true,
-    evalReachableScopes: collectEvalReachableScopes(ast),
-  }
+  const state: ChangeState = { changed: true }
   while (state.changed) {
     state.changed = false
     traverse(ast, sweepVisitor, undefined, state)
@@ -51,49 +47,19 @@ function crawlProgramScope(ast: File): void {
   })
 }
 
-// Direct eval can read otherwise unreferenced bindings in its scope ancestry.
-// Sweep state keeps this set local to one pass.
-interface SweepState extends ChangeState {
-  evalReachableScopes: Set<t.Node>
-}
-
-function collectEvalReachableScopes(ast: File): Set<t.Node> {
-  const reachable = new Set<t.Node>()
-  traverse(ast, {
-    CallExpression(path) {
-      if (!isDirectEvalCall(path.node)) {
-        return
-      }
-      let scope: Scope | undefined = path.scope
-      while (scope) {
-        reachable.add(scope.block)
-        scope = scope.parent
-      }
-    },
-  })
-  return reachable
-}
-
-function bindingReachableByEval(
-  binding: { scope: Scope },
-  evalReachableScopes: Set<t.Node>,
-): boolean {
-  return evalReachableScopes.has(binding.scope.block)
-}
-
-const sweepVisitor: Visitor<SweepState> = {
+const sweepVisitor: Visitor<ChangeState> = {
   VariableDeclarator(path, state) {
-    if (tryRemoveDeclarator(path, state.evalReachableScopes)) {
+    if (tryRemoveDeclarator(path)) {
       state.changed = true
     }
   },
   FunctionDeclaration(path, state) {
-    if (tryRemoveFunctionDecl(path, state.evalReachableScopes)) {
+    if (tryRemoveFunctionDecl(path)) {
       state.changed = true
     }
   },
   ClassDeclaration(path, state) {
-    if (tryRemoveClassDecl(path, state.evalReachableScopes)) {
+    if (tryRemoveClassDecl(path)) {
       state.changed = true
     }
   },
@@ -126,10 +92,7 @@ function dereferenceSubtree(rootPath: NodePath): void {
   rootPath.traverse(dereferenceVisitor)
 }
 
-function tryRemoveDeclarator(
-  path: NodePath<t.VariableDeclarator>,
-  evalReachableScopes: Set<t.Node>,
-): boolean {
+function tryRemoveDeclarator(path: NodePath<t.VariableDeclarator>): boolean {
   const declaration = path.parentPath
   if (!declaration || !declaration.isVariableDeclaration()) {
     return false
@@ -170,10 +133,6 @@ function tryRemoveDeclarator(
   if (binding.constantViolations.length > 0) {
     return false
   }
-  if (bindingReachableByEval(binding, evalReachableScopes)) {
-    return false
-  }
-
   if (path.node.init) {
     dereferenceSubtree(path.get('init') as NodePath)
   }
@@ -185,10 +144,7 @@ function tryRemoveDeclarator(
   return true
 }
 
-function tryRemoveFunctionDecl(
-  path: NodePath<t.FunctionDeclaration>,
-  evalReachableScopes: Set<t.Node>,
-): boolean {
+function tryRemoveFunctionDecl(path: NodePath<t.FunctionDeclaration>): boolean {
   if (isExported(path)) {
     return false
   }
@@ -211,20 +167,13 @@ function tryRemoveFunctionDecl(
   if (binding.constantViolations.length > 0) {
     return false
   }
-  if (bindingReachableByEval(binding, evalReachableScopes)) {
-    return false
-  }
-
   dereferenceSubtree(path.get('body') as NodePath)
   path.scope.removeBinding(id.name)
   path.remove()
   return true
 }
 
-function tryRemoveClassDecl(
-  path: NodePath<t.ClassDeclaration>,
-  evalReachableScopes: Set<t.Node>,
-): boolean {
+function tryRemoveClassDecl(path: NodePath<t.ClassDeclaration>): boolean {
   if (isExported(path)) {
     return false
   }
@@ -265,10 +214,6 @@ function tryRemoveClassDecl(
   if (binding.constantViolations.length > 0) {
     return false
   }
-  if (bindingReachableByEval(binding, evalReachableScopes)) {
-    return false
-  }
-
   dereferenceSubtree(path.get('body') as NodePath)
   if (path.node.superClass) {
     dereferenceSubtree(path.get('superClass') as NodePath)

package/src/transforms/rename-identifiers.ts

@@ -4,7 +4,7 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import type { TransformContext } from '../options'
-import { isDirectEvalCall, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import { hasAnnexBFunctionAlias, referencesOrWritesVariable } from '../utils/paths'
 import { mulberry32 } from '../utils/random'
 import { StringGenerator } from '../utils/string-generator'
@@ -31,6 +31,7 @@ import { StringGenerator } from '../utils/string-generator'
  */
 export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
   const generator = new StringGenerator(ctx.stringGeneratorMode, mulberry32(ctx.seed))
+  const separatedDirectExports = separateDirectExports(ast.program)
 
   let programScope: Scope | undefined
   traverse(ast, {
@@ -40,14 +41,14 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
     },
   })
   if (!programScope) {
-    return false
+    return separatedDirectExports
   }
   programScope.crawl()
 
   const liveAncestors = new Map<Scope, Set<Binding>>()
   // Reserve unbound names so generated bindings cannot capture them.
   const freeNames = new Set<string>()
-  // `with` and direct eval pin bindings to their source names.
+  // A reference inside `with` pins its binding to the source name.
   const unrenamable = new Set<Binding>()
   // Reserve pinned source names globally, including before their binding is seen.
   const pinnedNames = new Set<string>()
@@ -82,19 +83,6 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
         scope = scope.parent
       }
     },
-    CallExpression(path) {
-      // Direct eval can read every visible binding by its source name.
-      if (!isDirectEvalCall(path.node)) {
-        return
-      }
-      let scope: Scope | undefined = path.scope
-      while (scope) {
-        for (const name of Object.keys(scope.bindings)) {
-          pin(scope.bindings[name]!, name)
-        }
-        scope = scope.parent
-      }
-    },
     FunctionDeclaration(path) {
       // ECMA-262 B.3.3 gives sloppy block functions an alias Babel does not model.
       if (!hasAnnexBFunctionAlias(path)) {
@@ -169,7 +157,7 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
   })
 
   if (bindingToName.size === 0) {
-    return renameLabels(ast, generator)
+    return renameLabels(ast, generator) || separatedDirectExports
   }
 
   traverse(ast, {
@@ -199,6 +187,43 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
   return true
 }
 
+function separateDirectExports(program: t.Program): boolean {
+  const body: t.Program['body'] = []
+  let changed = false
+
+  for (const statement of program.body) {
+    const declaration = t.isExportNamedDeclaration(statement) ? statement.declaration : null
+    if (
+      !t.isVariableDeclaration(declaration) &&
+      !t.isFunctionDeclaration(declaration) &&
+      !t.isClassDeclaration(declaration)
+    ) {
+      body.push(statement)
+      continue
+    }
+
+    const names = Object.keys(t.getBindingIdentifiers(declaration))
+    if (names.length === 0) {
+      body.push(statement)
+      continue
+    }
+
+    body.push(
+      declaration,
+      t.exportNamedDeclaration(
+        null,
+        names.map((name) => t.exportSpecifier(t.identifier(name), t.identifier(name))),
+      ),
+    )
+    changed = true
+  }
+
+  if (changed) {
+    program.body = body
+  }
+  return changed
+}
+
 function isNonBindingPosition(path: { node: t.Identifier; parent: t.Node }): boolean {
   const node = path.node
   const parent = path.parent

package/src/transforms/reorder-function-declarations.ts

@@ -0,0 +1,80 @@
+import type { NodePath } from '@babel/traverse'
+import type * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { hasAnnexBFunctionAlias } from '../utils/paths'
+import { rewriteStatementLists } from '../utils/statement-lists'
+import type { StatementListContainer } from '../utils/statement-lists'
+
+/**
+ * Moves hoisted function declarations to the end of each program, block, switch
+ * case, or static block. It keeps declaration order, including duplicate names,
+ * and leaves sloppy Annex B block functions in place.
+ *
+ * If moving every declaration would turn a string expression into a directive,
+ * one declaration stays before the string. Direct exports stay in place.
+ * Indirect exports move with their local declaration.
+ *
+ * @example
+ * // ◀️ before
+ * function area(r) {
+ *   return r * r;
+ * }
+ * log(area(2));
+ *
+ * // ▶️ after
+ * log(area(2));
+ * function area(r) {
+ *   return r * r;
+ * }
+ */
+export function reorderFunctionDeclarations(ast: File): boolean {
+  return rewriteStatementLists(ast, (statements, container) =>
+    reorderedStatements(statements, containerAllowsDirective(container)),
+  )
+}
+
+// Only programs and function bodies recognize directives, so only they need the guard.
+function containerAllowsDirective(container: NodePath<StatementListContainer>): boolean {
+  if (container.isProgram()) {
+    return true
+  }
+  return container.isBlockStatement() && container.parentPath.isFunction()
+}
+
+function reorderedStatements(
+  children: NodePath<t.Statement>[],
+  canCreateDirective: boolean,
+): t.Statement[] | null {
+  const rest: t.Statement[] = []
+  const moved: t.Statement[] = []
+  for (const child of children) {
+    if (isMovable(child)) {
+      moved.push(child.node)
+    } else {
+      rest.push(child.node)
+    }
+  }
+
+  if (moved.length === 0) {
+    return null
+  }
+  if (canCreateDirective && createsDirective(rest)) {
+    rest.unshift(moved.shift()!)
+  }
+  const reordered = [...rest, ...moved]
+  return reordered.every((node, index) => node === children[index]?.node) ? null : reordered
+}
+
+function createsDirective(statements: readonly t.Statement[]): boolean {
+  const first = statements[0]
+  return (
+    first !== undefined &&
+    first.type === 'ExpressionStatement' &&
+    first.expression.type === 'StringLiteral'
+  )
+}
+
+function isMovable(child: NodePath<t.Statement>): boolean {
+  return child.isFunctionDeclaration() && child.node.id !== null && !hasAnnexBFunctionAlias(child)
+}

package/src/transforms/specials-to-strings.ts

@@ -4,7 +4,7 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import type { TransformContext } from '../options'
-import { enclosingScopeHasDirectEval, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import type { ChangeState } from '../utils/change-tracking'
 import { mulberry32 } from '../utils/random'
 import { StringGenerator } from '../utils/string-generator'
@@ -69,8 +69,9 @@ const visitor: Visitor<State> = {
     if (path.scope.getBinding(name)) {
       return
     }
-    // Replacements are not write targets. `with` and eval can also shadow globals.
-    if (isWriteTarget(path) || isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+    // A replacement cannot occupy a write target. `with` may also shadow `NaN`,
+    // `Infinity`, or `undefined`.
+    if (isWriteTarget(path) || isInsideWith(path)) {
       return
     }
     const str = t.stringLiteral(state.generator.next())