webfuscator 1.2.0 → 1.3.0

package/src/analysis/inlineability.ts

@@ -3,7 +3,6 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { walkOwnFunctionScope } from '../utils/ast'
 import { hasAnnexBFunctionAlias, referencesOrWritesVariable } from '../utils/paths'
 
 export interface InlineCandidate {
@@ -15,7 +14,10 @@ export interface InlineCandidate {
   declarationPath: NodePath
 }
 
-// Tarjan SCC removal prevents endless expansion of mutually recursive bodies.
+// Inlining splices a deep clone of the callee body, so any call that clone
+// contains expands again. Expansion stops only when the graph below is acyclic,
+// so this pass drops every candidate on a cycle before the inliner reaches a
+// call site.
 export function analyzeInlineability(ast: File): Map<string, InlineCandidate> {
   const rawCandidates: InlineCandidate[] = []
 
@@ -75,34 +77,45 @@ export function analyzeInlineability(ast: File): Map<string, InlineCandidate> {
     candidateByName.set(candidate.name, candidate)
   }
 
-  // Self-reference is already excluded, leaving Tarjan to remove larger cycles.
+  const edges = buildExpansionGraph(candidateByName)
+  for (const scc of tarjanSCC([...candidateByName.keys()], edges)) {
+    // Tarjan reports an acyclic node as a singleton too, so a self-recursive
+    // candidate shows up only as an edge back to itself.
+    if (scc.length === 1 && !edges.get(scc[0]!)!.has(scc[0]!)) {
+      continue
+    }
+    for (const name of scc) {
+      candidateByName.delete(name)
+    }
+  }
+  return candidateByName
+}
+
+// A clone keeps the whole body, so a reference inside a closure, an object
+// method, or a getter is as live in the copy as one at the top level. Walking
+// out to every enclosing candidate, rather than stopping at the innermost, also
+// covers a candidate declared inside another candidate's body.
+function buildExpansionGraph(
+  candidateByName: Map<string, InlineCandidate>,
+): Map<string, Set<string>> {
+  const nameByFnNode = new Map<t.Function, string>()
   const edges = new Map<string, Set<string>>()
-  for (const candidate of rawCandidates) {
-    const callees = new Set<string>()
-    walkOwnFunctionScope(candidate.fnNode.body, (node) => {
-      if (t.isIdentifier(node) && node.name !== candidate.name && candidateByName.has(node.name)) {
-        callees.add(node.name)
-      }
-    })
-    edges.set(candidate.name, callees)
+  for (const [name, candidate] of candidateByName) {
+    nameByFnNode.set(candidate.fnNode, name)
+    edges.set(name, new Set())
   }
 
-  const inCycle = new Set<string>()
-  for (const scc of tarjanSCC(
-    rawCandidates.map((candidate) => candidate.name),
-    edges,
-  )) {
-    if (scc.length > 1) {
-      for (const name of scc) {
-        inCycle.add(name)
+  for (const [name, candidate] of candidateByName) {
+    for (const ref of candidate.binding.referencePaths) {
+      for (let owner = ref.parentPath; owner; owner = owner.parentPath) {
+        const ownerName = owner.isFunction() ? nameByFnNode.get(owner.node) : undefined
+        if (ownerName !== undefined) {
+          edges.get(ownerName)!.add(name)
+        }
       }
     }
   }
-
-  for (const name of inCycle) {
-    candidateByName.delete(name)
-  }
-  return candidateByName
+  return edges
 }
 
 function checkCandidate(
@@ -142,7 +155,7 @@ function checkCandidate(
     return null
   }
 
-  const analysis = analyzeBody(name, fnPath as NodePath<t.Function>)
+  const analysis = analyzeBody(fnPath as NodePath<t.Function>)
   if (analysis.unsafe || analysis.closureCapture) {
     return null
   }
@@ -200,9 +213,8 @@ interface BodyAnalysis {
   closureCapture: boolean
 }
 
-function analyzeBody(name: string, fnPath: NodePath<t.Function>): BodyAnalysis {
+function analyzeBody(fnPath: NodePath<t.Function>): BodyAnalysis {
   const state: AnalyzeBodyState = {
-    candidateName: name,
     outerScope: fnPath.scope,
     innerFnDepth: 0,
     unsafe: false,
@@ -216,7 +228,6 @@ function analyzeBody(name: string, fnPath: NodePath<t.Function>): BodyAnalysis {
 }
 
 interface AnalyzeBodyState {
-  candidateName: string
   outerScope: NodePath<t.Function>['scope']
   innerFnDepth: number
   unsafe: boolean
@@ -268,10 +279,7 @@ const analyzeBodyVisitor: Visitor<AnalyzeBodyState> = {
   },
   Identifier(path, state) {
     const name = path.node.name
-    if (
-      state.innerFnDepth === 0 &&
-      (name === 'arguments' || name === 'eval' || name === state.candidateName)
-    ) {
+    if (state.innerFnDepth === 0 && name === 'arguments') {
       state.unsafe = true
       path.stop()
       return

package/src/index.ts

@@ -1,5 +1,6 @@
 export { obfuscate } from './obfuscator'
 export type {
+  ConcealStringsOptions,
   ManglePropertiesOptions,
   ObfuscatorOptions,
   PackOptions,

package/src/obfuscator.ts

@@ -14,6 +14,7 @@ import { wrapSingleStatements } from './preparation/wrap-single-statements'
 import { argumentsToParameters } from './transforms/arguments-to-parameters'
 import { arrowToFunction } from './transforms/arrow-to-function'
 import { collapseSingleUseTemps } from './transforms/collapse-single-use-temps'
+import { concealStrings } from './transforms/conceal-strings'
 import { constLetToVar } from './transforms/const-let-to-var'
 import { constToLet } from './transforms/const-to-let'
 import { doWhileToWhile } from './transforms/do-while-to-while'
@@ -26,9 +27,11 @@ import { foldBuiltinMethods } from './transforms/fold-builtin-methods'
 import { foldConstants } from './transforms/fold-constants'
 import { forToWhile } from './transforms/for-to-while'
 import { functionDeclarationToExpression } from './transforms/function-declaration-to-expression'
+import { hoistVariables } from './transforms/hoist-variables'
 import { inlineFunctions } from './transforms/inline-functions'
 import { logicalToTernary } from './transforms/logical-to-ternary'
 import { mangleProperties } from './transforms/mangle-properties'
+import { mergeVariableDeclarations } from './transforms/merge-variable-declarations'
 import { nullishCoalescingToTernary } from './transforms/nullish-coalescing-to-ternary'
 import { numbersToStrings } from './transforms/numbers-to-strings'
 import { objectMethodToProperty } from './transforms/object-method-to-property'
@@ -39,6 +42,7 @@ import { removeAnonymousFunctionNames } from './transforms/remove-anonymous-func
 import { removeUnreachableCode } from './transforms/remove-unreachable-code'
 import { removeUnusedCode } from './transforms/remove-unused-code'
 import { renameIdentifiers } from './transforms/rename-identifiers'
+import { reorderFunctionDeclarations } from './transforms/reorder-function-declarations'
 import { specialsToStrings } from './transforms/specials-to-strings'
 import { switchToIf } from './transforms/switch-to-if'
 import { ternaryToIf } from './transforms/ternary-to-if'
@@ -48,8 +52,6 @@ import type { StringGeneratorModeOption } from './utils/string-generator'
 
 const parserOptions: ParserOptions = { sourceType: 'unambiguous' }
 
-const PRESERVED_COMMENT_RE = /^!|@(?:license|preserve)\b|^#\s*source(?:Mapping)?URL=/iu
-
 const DEFAULT_STRING_GENERATOR_MODE: StringGeneratorModeOption = 'mangled'
 const DEFAULT_SEED = 0
 
@@ -76,11 +78,10 @@ const PREPARATION: readonly Phase[] = [
   ['dotToBracket', asBoolean(dotToBracket)],
 ]
 
-// These one-shot passes prepare the fixed point. Lexical declarations become
-// foldable function-scoped bindings, except at script top level where `var`
-// would create a global property. `argumentsToParameters` precedes parameter
-// renaming. Method demotion precedes extraction because any surviving
-// `ObjectMethod` makes extraction refuse the whole literal.
+// `constLetToVar` must precede the fixed point because folds need function-scoped
+// bindings. `argumentsToParameters` must precede parameter renaming.
+// `objectMethodToProperty` must precede extraction because one `ObjectMethod`
+// blocks the whole object literal.
 const PRE_LOOP: readonly ConfigurablePhase[] = [
   ['dropDebugger', dropDebugger],
   ['dropConsole', dropConsole],
@@ -124,15 +125,25 @@ const LOWERING: readonly ConfigurablePhase[] = [
   ['ternaryToIf', ternaryToIf],
 ]
 
-// Yodification and folding need raw numeric literals. Special-value lowering
-// comes next, then number lowering also handles the `1` created for `Infinity`.
+// `packDeclarationsIntoParameters` must precede declaration motion and merging.
+// `reorderFunctionDeclarations` follows `functionDeclarationToExpression`, so it
+// moves only declarations still needed for hoisting. `hoistVariables` must run
+// before `mergeVariableDeclarations`. `numbersToStrings` follows the fixed point,
+// yodification, and `specialsToStrings` because they need or create numbers.
 const POST_PROCESS: readonly ConfigurablePhase[] = [
   ['packDeclarationsIntoParameters', packDeclarationsIntoParameters],
+  ['reorderFunctionDeclarations', reorderFunctionDeclarations],
+  ['hoistVariables', hoistVariables],
+  ['mergeVariableDeclarations', mergeVariableDeclarations],
   ['yodifyConditions', yodifyConditions],
   ['specialsToStrings', specialsToStrings],
   ['numbersToStrings', numbersToStrings],
 ]
 
+// Conceal strings after every string-producing pass, but before renaming so the
+// generated vault bindings use the caller's name generator.
+const PROTECTION: readonly ConfigurablePhase[] = [['concealStrings', concealStrings]]
+
 // Renaming runs last because later transforms depend on recognizable bindings.
 const RENAME: readonly ConfigurablePhase[] = [['renameIdentifiers', renameIdentifiers]]
 
@@ -141,6 +152,19 @@ const RENAME: readonly ConfigurablePhase[] = [['renameIdentifiers', renameIdenti
 // every other rewrite, including renaming.
 const PACK: readonly ConfigurablePhase[] = [['pack', pack]]
 
+// Tests derive their all-transforms setup from this list. The phase tables remain
+// the only source of pipeline order.
+export const CONFIGURABLE_TRANSFORM_NAMES: readonly TransformName[] = [
+  ...BEFORE_PREPARATION,
+  ...PRE_LOOP,
+  ...FIXED_POINT,
+  ...LOWERING,
+  ...POST_PROCESS,
+  ...PROTECTION,
+  ...RENAME,
+  ...PACK,
+].map(([name]) => name)
+
 /** Parses, transforms, and prints JavaScript without mutating external state. */
 export function obfuscate(code: string, options: ObfuscatorOptions = {}): string {
   const log = options.verbose ? makeLogger() : null
@@ -184,6 +208,13 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
+  for (const [name, fn] of PROTECTION) {
+    if (!isEnabled(name, options)) {
+      continue
+    }
+    run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
+  }
+
   for (const [name, fn] of RENAME) {
     if (!isEnabled(name, options)) {
       continue
@@ -201,7 +232,13 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
   return run(
     log,
     'generate',
-    () => generate(ast, { minified: options.minify ?? false, shouldPrintComment }).code,
+    () =>
+      generate(ast, {
+        comments: false,
+        minified: options.minify ?? false,
+        // `comments: false` still allows @license and @preserve.
+        shouldPrintComment: () => false,
+      }).code,
   )
 }
 
@@ -216,6 +253,10 @@ function ctxFor(
   options: ObfuscatorOptions,
   base: TransformContext,
 ): TransformContext {
+  if (name === 'concealStrings') {
+    const entry = options.transforms?.concealStrings
+    return entry && typeof entry === 'object' ? { ...base, concealStrings: entry } : base
+  }
   const entry = options.transforms?.[name]
   let context = base
   if (entry && typeof entry === 'object' && entry.stringGeneratorMode !== undefined) {
@@ -261,10 +302,6 @@ function asBoolean(fn: (ast: File) => unknown): TransformFn {
   }
 }
 
-function shouldPrintComment(value: string): boolean {
-  return PRESERVED_COMMENT_RE.test(value)
-}
-
 type Logger = <T>(name: string, fn: () => T) => T
 
 function run<T>(log: Logger | null, name: string, fn: () => T): T {

package/src/options.ts

@@ -21,6 +21,9 @@ export type TransformName =
   | 'collapseSingleUseTemps'
   | 'arrowToFunction'
   | 'functionDeclarationToExpression'
+  | 'reorderFunctionDeclarations'
+  | 'hoistVariables'
+  | 'mergeVariableDeclarations'
   | 'switchToIf'
   | 'forToWhile'
   | 'doWhileToWhile'
@@ -35,6 +38,7 @@ export type TransformName =
   | 'yodifyConditions'
   | 'specialsToStrings'
   | 'numbersToStrings'
+  | 'concealStrings'
   | 'mangleProperties'
   | 'renameIdentifiers'
   | 'pack'
@@ -61,8 +65,8 @@ export interface ManglePropertiesOptions {
   /** Custom property-name generator. It takes precedence over `stringGeneratorMode`. */
   nameGenerator?: PropertyNameGenerator
   /**
-   * Only names carrying `/*@__MANGLE_PROP__*\/` or `/*#__MANGLE_PROP__*\/` may
-   * be mangled. Default `false`.
+   * Mangle only names with an exact standalone `/*@__MANGLE_PROP__*\/` or
+   * `/*#__MANGLE_PROP__*\/` annotation. Default `false`.
    */
   onlyAnnotated?: boolean
   /** Only names already present in `cache` may be mangled. Default `false`. */
@@ -84,16 +88,36 @@ export interface PackOptions {
    * source is strict. This deliberately changes behavior. Default `false`.
    */
   escapeStrict?: boolean
+  /**
+   * Free names to leave un-routed because they resolve to the real global from
+   * inside a detached Function body. `true` uses the built-in standard-globals
+   * list; an array names your own set. Stripped imports always route regardless,
+   * since a Function body cannot reach them. Default routes every free name.
+   */
+  skipGlobals?: boolean | readonly string[]
   /** Override the default string-generator mode for the names pack creates. */
   stringGeneratorMode?: StringGeneratorModeOption
 }
 
+/** Options for the string vault generated by `concealStrings`. */
+export interface ConcealStringsOptions {
+  /** Cache each decoded string in its vault. Default `true`. */
+  cache?: boolean
+  /** Choose how much of the UTF-16 range pads each pool. Default `'regional'`. */
+  cover?: 'full' | 'regional' | 'used'
+  /** Reuse one vault entry for equal strings. Default `true`. */
+  deduplicate?: boolean
+  /** Use one program vault or a separate vault per function. Default `'program'`. */
+  scope?: 'function' | 'program'
+}
+
 type SimpleTransform = Exclude<
   TransformName,
-  'mangleProperties' | 'pack' | 'renameIdentifiers' | 'specialsToStrings'
+  'concealStrings' | 'mangleProperties' | 'pack' | 'renameIdentifiers' | 'specialsToStrings'
 >
 
 type TransformsMap = Partial<Record<SimpleTransform, boolean>> & {
+  concealStrings?: boolean | ConcealStringsOptions
   mangleProperties?: boolean | ManglePropertiesOptions
   pack?: boolean | PackOptions
   renameIdentifiers?: TransformEntry
@@ -122,6 +146,7 @@ export interface ObfuscatorOptions {
 
 // Resolved per-call defaults handed to every transform.
 export interface TransformContext {
+  concealStrings?: ConcealStringsOptions
   mangleProperties?: ManglePropertiesOptions
   pack?: PackOptions
   seed: number

package/src/preparation/expand-destructuring.ts

@@ -3,7 +3,7 @@ import type { NodePath, Scope } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { enclosingScopeHasDirectEval, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 
 type Kind = t.VariableDeclaration['kind']
 
@@ -18,9 +18,9 @@ type BindingTarget = t.Identifier | t.ObjectPattern | t.ArrayPattern | t.Assignm
  * The source, computed keys, and getters keep their original evaluation counts.
  * Defaults compare against `void 0` because `undefined` can be shadowed.
  *
- * `with` and direct `eval` can expose synthesized names that Babel cannot see, so
- * those scopes are skipped. A `RequireObjectCoercible` guard runs before any
- * computed key, matching ObjectBindingPattern evaluation order.
+ * Patterns inside `with` stay untouched because an object property can capture
+ * a generated temporary. The `RequireObjectCoercible` guard runs before computed
+ * keys to preserve ObjectBindingPattern evaluation order.
  *
  * @example
  * // ◀️ before
@@ -42,8 +42,8 @@ const visitor = {
     if (typeof path.listKey !== 'string') {
       return
     }
-    // Babel cannot prove a generated name hidden from `with` or direct `eval`.
-    if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+    // A `with` property can capture the generated temporary.
+    if (isInsideWith(path)) {
       return
     }
 

package/src/transforms/arrow-to-function.ts

@@ -2,7 +2,7 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { enclosingScopeHasDirectEval, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -65,10 +65,8 @@ const visitor: Visitor<ChangeState> = {
       arrowReferencesSuper(path) ||
       inUnsafeCaptureContext(path) ||
       usesReassignedArguments(path) ||
-      // `with` can shadow capture aliases, and direct eval can inspect the changed
-      // runtime meaning of `this` or `arguments`.
-      isInsideWith(path) ||
-      enclosingScopeHasDirectEval(path)
+      // `with` can capture Babel's `this` or `arguments` alias.
+      isInsideWith(path)
     ) {
       return
     }