webfuscator 1.2.0 → 1.3.0

package/src/transforms/update-to-assignment.ts

@@ -2,7 +2,7 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isDirectEvalCall, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -52,10 +52,6 @@ const visitor: Visitor<ChangeState> = {
     if (!isNumericBinding(binding)) {
       return
     }
-    // Direct eval anywhere in the binding's scope can change its type.
-    if (bindingScopeReachesDirectEval(binding!)) {
-      return
-    }
     const compound = operator === '++' ? '+=' : '-='
     path.replaceWith(t.assignmentExpression(compound, argument, t.numericLiteral(1)))
     state.changed = true
@@ -95,18 +91,6 @@ function isNumericBinding(binding: Binding | undefined): boolean {
   return binding.constantViolations.every((violation) => keepsNumeric(violation.node))
 }
 
-// A sibling or nested direct eval can still close over and reassign the binding.
-function bindingScopeReachesDirectEval(binding: Binding): boolean {
-  let found = false
-  t.traverseFast(binding.scope.block, (node) => {
-    if (isDirectEvalCall(node)) {
-      found = true
-    }
-    return found ? t.traverseFast.stop : undefined
-  })
-  return found
-}
-
 function isForInOfLoopVariable(binding: Binding): boolean {
   const declaration = binding.path.parentPath
   if (!declaration || !declaration.isVariableDeclaration()) {

package/src/utils/ast.ts

@@ -62,75 +62,39 @@ export function isProtoKey(key: t.Node): boolean {
   )
 }
 
+// A non-computed key names a property; it is not a runtime value.
+export function isNonComputedKey(path: NodePath): boolean {
+  const parent = path.parent
+  return (
+    'key' in parent && parent.key === path.node && 'computed' in parent && parent.computed === false
+  )
+}
+
 // `with` can shadow names outside Babel's scope table.
 export function isInsideWith(path: NodePath): boolean {
-  if (!programContains(path.scope.getProgramParent().block, programWith, t.isWithStatement)) {
+  if (!programHasWith(path.scope.getProgramParent().block)) {
     return false
   }
   return path.findParent((ancestor) => ancestor.isWithStatement()) !== null
 }
 
-// Direct eval can access local bindings by name. Indirect eval runs globally and
-// does not count.
-export function enclosingScopeHasDirectEval(path: NodePath): boolean {
-  if (!programContains(path.scope.getProgramParent().block, programDirectEval, isDirectEvalCall)) {
-    return false
-  }
-  let current: NodePath | null = path
-  while (current) {
-    if ((current.isFunction() || current.isProgram()) && ownScopeHasDirectEval(current.node)) {
-      return true
-    }
-    current = current.parentPath
-  }
-  return false
-}
-
-// Cache program-wide `eval` and `with` checks to avoid a subtree walk per name.
-// No transform creates either construct, so a negative result stays valid.
-const programDirectEval = new WeakMap<t.Node, boolean>()
+// Cache the program-wide scan because `isInsideWith` runs for many identifiers.
+// Transforms never add `with`, so a cached miss remains valid.
 const programWith = new WeakMap<t.Node, boolean>()
 
-function programContains(
-  programNode: t.Node,
-  cache: WeakMap<t.Node, boolean>,
-  matches: (node: t.Node) => boolean,
-): boolean {
-  const cached = cache.get(programNode)
+function programHasWith(programNode: t.Node): boolean {
+  const cached = programWith.get(programNode)
   if (cached !== undefined) {
     return cached
   }
   let found = false
   t.traverseFast(programNode, (node) => {
-    if (!matches(node)) {
+    if (!t.isWithStatement(node)) {
       return
     }
     found = true
     return t.traverseFast.stop
   })
-  cache.set(programNode, found)
+  programWith.set(programNode, found)
   return found
 }
-
-function ownScopeHasDirectEval(owner: t.Node): boolean {
-  let found = false
-  // This walk stops at the first hit, unlike `walkOwnFunctionScope`.
-  t.traverseFast(owner, (node) => {
-    if (isDirectEvalCall(node)) {
-      found = true
-      return t.traverseFast.stop
-    }
-    return node !== owner && t.isFunction(node) ? t.traverseFast.skip : undefined
-  })
-  return found
-}
-
-export function isDirectEvalCall(node: t.Node): boolean {
-  // `eval?.(...)` is an OptionalCallExpression yet still a direct eval, so both
-  // call node shapes count.
-  return (
-    (t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
-    t.isIdentifier(node.callee) &&
-    node.callee.name === 'eval'
-  )
-}

package/src/utils/literal.ts

@@ -1,5 +1,9 @@
+import generate from '@babel/generator'
 import * as t from '@babel/types'
 
+const MAX_GENERATED_LITERAL_LENGTH = 8192
+const MAX_LITERAL_DEPTH = 32
+const MAX_LITERAL_NODES = 512
 const MAX_STRING_LITERAL_LENGTH = 4096
 
 // RegExp literals allocate mutable objects and are not primitive values.
@@ -45,19 +49,56 @@ function literalShapeKind(node: t.Node): 'bigint' | 'other' | null {
 }
 
 export function valueToLiteral(value: unknown): t.Expression | null {
+  const literal = buildValueLiteral(value, new Set(), { nodesRemaining: MAX_LITERAL_NODES }, 0)
+  if (!literal || generate(literal).code.length > MAX_GENERATED_LITERAL_LENGTH) {
+    return null
+  }
+  return literal
+}
+
+interface LiteralBudget {
+  nodesRemaining: number
+}
+
+function reserveLiteralNodes(budget: LiteralBudget, count: number): boolean {
+  if (budget.nodesRemaining < count) {
+    return false
+  }
+  budget.nodesRemaining -= count
+  return true
+}
+
+function buildValueLiteral(
+  value: unknown,
+  seen: Set<object>,
+  budget: LiteralBudget,
+  depth: number,
+): t.Expression | null {
+  if (depth > MAX_LITERAL_DEPTH) {
+    return null
+  }
   if (typeof value === 'string') {
-    if (value.length > MAX_STRING_LITERAL_LENGTH) {
+    if (value.length > MAX_STRING_LITERAL_LENGTH || !reserveLiteralNodes(budget, 1)) {
       return null
     }
     return t.stringLiteral(value)
   }
   if (typeof value === 'boolean') {
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.booleanLiteral(value)
   }
   if (value === null) {
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.nullLiteral()
   }
   if (value === undefined) {
+    if (!reserveLiteralNodes(budget, 2)) {
+      return null
+    }
     // `void 0` cannot be shadowed like the identifier `undefined`.
     return t.unaryExpression('void', t.numericLiteral(0))
   }
@@ -65,8 +106,14 @@ export function valueToLiteral(value: unknown): t.Expression | null {
     // A UnaryExpression lets the generator parenthesize negative BigInt where
     // precedence requires it.
     if (value < 0n) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.bigIntLiteral(-value))
     }
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.bigIntLiteral(value)
   }
   if (typeof value === 'number') {
@@ -74,17 +121,30 @@ export function valueToLiteral(value: unknown): t.Expression | null {
       return null
     }
     if (Object.is(value, -0)) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.numericLiteral(0))
     }
     if (value < 0) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.numericLiteral(-value))
     }
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.numericLiteral(value)
   }
   if (Array.isArray(value)) {
+    if (seen.has(value) || !arrayHasLiteralShape(value) || !reserveLiteralNodes(budget, 1)) {
+      return null
+    }
+    seen.add(value)
     const elements: t.Expression[] = []
     for (const item of value) {
-      const lit = valueToLiteral(item)
+      const lit = buildValueLiteral(item, seen, budget, depth + 1)
       if (!lit) {
         return null
       }
@@ -94,3 +154,32 @@ export function valueToLiteral(value: unknown): t.Expression | null {
   }
   return null
 }
+
+function arrayHasLiteralShape(value: unknown[]): boolean {
+  if (Object.getPrototypeOf(value) !== Array.prototype || !Object.isExtensible(value)) {
+    return false
+  }
+  const names = Object.getOwnPropertyNames(value)
+  if (names.length !== value.length + 1 || names.at(-1) !== 'length') {
+    return false
+  }
+  for (let index = 0; index < value.length; index++) {
+    if (
+      names[index] !== String(index) ||
+      !isOrdinaryDataProperty(Object.getOwnPropertyDescriptor(value, String(index)))
+    ) {
+      return false
+    }
+  }
+  return Object.getOwnPropertySymbols(value).length === 0
+}
+
+function isOrdinaryDataProperty(descriptor: PropertyDescriptor | undefined): boolean {
+  return (
+    descriptor !== undefined &&
+    'value' in descriptor &&
+    descriptor.configurable === true &&
+    descriptor.enumerable === true &&
+    descriptor.writable === true
+  )
+}

package/src/utils/statement-lists.ts

@@ -0,0 +1,45 @@
+import type { NodePath } from '@babel/traverse'
+import type * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from './change-tracking'
+import type { ChangeState } from './change-tracking'
+
+export type StatementListContainer = t.Program | t.BlockStatement | t.StaticBlock | t.SwitchCase
+
+type Rewrite = (
+  statements: NodePath<t.Statement>[],
+  container: NodePath<StatementListContainer>,
+) => t.Statement[] | null
+
+/** Applies a rewrite to every statement-list container in the AST. */
+export function rewriteStatementLists(ast: File, rewrite: Rewrite): boolean {
+  return traverseForChanges(ast, {
+    Program(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    BlockStatement(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    StaticBlock(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    SwitchCase(path, state) {
+      apply(path, 'consequent', rewrite, state)
+    },
+  })
+}
+
+function apply(
+  container: NodePath<StatementListContainer>,
+  key: 'body' | 'consequent',
+  rewrite: Rewrite,
+  state: ChangeState,
+): void {
+  const statements = container.get(key) as NodePath<t.Statement>[]
+  const replacement = rewrite(statements, container)
+  if (replacement) {
+    container.set(key, replacement)
+    state.changed = true
+  }
+}

package/DISCLOSURE

@@ -1,9 +0,0 @@
-webfuscator transforms and obfuscates JavaScript source code. Its features
-include identifier and property-name mangling, constant folding, dead-code
-removal, and control-flow and literal rewrites.
-
-These capabilities can make JavaScript harder to inspect and may have both
-legitimate and harmful uses. The intended use is transforming software that
-the user owns or is authorized to modify. This package is not intended to
-create, conceal, distribute, or operate malware, or to interfere with systems
-without authorization.

package/README.md

@@ -1,62 +0,0 @@
-`webfuscator` is a Babel-based JavaScript obfuscator. It parses a JavaScript source string, applies configurable transforms, and returns JavaScript source.
-
-[Read the documentation](https://webfuscator.mintlify.app/) for the quickstart, configuration guides, API details, and a reference page for every transform.
-
-## Install
-
-```sh
-npm install --save-dev webfuscator
-```
-
-The package is ESM-only, includes TypeScript declarations, and requires Node.js `^22.18.0 || >=24.11.0`.
-
-## Usage
-
-```js
-import { obfuscate } from 'webfuscator'
-
-const source = `export default function square(value) {
-  return value * value
-}`
-
-const output = obfuscate(source, {
-  minify: true,
-  seed: 0,
-  transforms: {
-    renameIdentifiers: true,
-  },
-})
-```
-
-`obfuscate(code, options?)` is synchronous. It does not execute the input or write files.
-
-Configurable transforms are disabled by default; preparation passes always run.
-
-## Documentation
-
-- [Quickstart](https://webfuscator.mintlify.app/getting-started/quickstart)
-- [JavaScript API](https://webfuscator.mintlify.app/reference/api)
-- [Configure transforms](https://webfuscator.mintlify.app/guides/configure-transforms)
-- [Obfuscator options](https://webfuscator.mintlify.app/reference/options)
-- [Property mangling](https://webfuscator.mintlify.app/reference/property-mangling-options)
-- [String generator modes](https://webfuscator.mintlify.app/reference/string-generator-modes)
-- [Report a bug](https://webfuscator.mintlify.app/troubleshooting/report-a-bug)
-
-## Development
-
-```sh
-pnpm install
-pnpm test
-pnpm check
-pnpm docs:check
-```
-
-Read [AGENTS.md](./AGENTS.md) before changing transforms or analysis code.
-
-## Responsible use
-
-Use `webfuscator` only on software you own or are authorized to modify. Read [DISCLOSURE](./DISCLOSURE) for the project's dual-use policy.
-
-## License
-
-[MIT](./LICENSE)