webfuscator 1.2.1 → 1.3.0

package/src/transforms/fold-builtin-methods.ts

@@ -4,7 +4,8 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { evaluateConstant, isOpaque } from '../analysis/constant'
-import { enclosingScopeHasDirectEval, isInDirectivePrologue, isInsideWith } from '../utils/ast'
+import { isSideEffectFree } from '../analysis/purity'
+import { isInDirectivePrologue, isInsideWith } from '../utils/ast'
 import type { ChangeState } from '../utils/change-tracking'
 import { valueToLiteral } from '../utils/literal'
 
@@ -104,18 +105,13 @@ function collectPatchedIntrinsics(ast: File): Set<string> {
       markMutationCall(path, poison)
     },
     Identifier(path) {
-      // Global eval and Function can patch any intrinsic outside this scan.
       const name = path.node.name
-      if (name !== 'eval' && name !== 'Function') {
+      if (name !== 'Function') {
         return
       }
       if (!path.isReferencedIdentifier() || path.scope.getBinding(name)) {
         return
       }
-      if (name === 'eval') {
-        poison(INTRINSIC_ROOTS)
-        return
-      }
       const parent = path.parentPath
       if (
         parent &&
@@ -496,7 +492,7 @@ function isReferenceRequiredPosition(path: NodePath<t.MemberExpression>): boolea
 }
 
 // Folding a leading call to a string can create a directive and change strictness.
-function foldsIntoDirective(path: NodePath<t.CallExpression>, replacement: t.Expression): boolean {
+function foldsIntoDirective(path: NodePath, replacement: t.Expression): boolean {
   if (!t.isStringLiteral(replacement)) {
     return false
   }
@@ -506,9 +502,61 @@ function foldsIntoDirective(path: NodePath<t.CallExpression>, replacement: t.Exp
   )
 }
 
+function replaceWithPreservedExpression(
+  path: NodePath<t.CallExpression | t.MemberExpression>,
+  expression: t.Expression,
+  result: t.Expression,
+): void {
+  if (!isSideEffectFree(expression, path.scope, path)) {
+    path.replaceWith(t.sequenceExpression([expression, result]))
+    return
+  }
+  if (foldsIntoDirective(path, result)) {
+    path.replaceWith(t.sequenceExpression([t.numericLiteral(0), result]))
+    return
+  }
+  path.replaceWith(result)
+}
+
+function foldArrayLiteralLength(
+  path: NodePath<t.MemberExpression>,
+  array: t.ArrayExpression,
+): boolean {
+  if (array.elements.some((element) => t.isSpreadElement(element))) {
+    return false
+  }
+  const effects = array.elements.filter(
+    (element): element is t.Expression =>
+      element !== null && t.isExpression(element) && !isSideEffectFree(element, path.scope, path),
+  )
+  const length = t.numericLiteral(array.elements.length)
+  path.replaceWith(effects.length === 0 ? length : t.sequenceExpression([...effects, length]))
+  return true
+}
+
+function foldStringIndex(
+  path: NodePath<t.MemberExpression>,
+  receiverNode: t.Expression,
+  propertyName: string,
+): boolean {
+  const index = Number(propertyName)
+  if (!Number.isSafeInteger(index) || index < 0 || String(index) !== propertyName) {
+    return false
+  }
+  const receiver = evaluateConstant(receiverNode, path.scope, path)
+  if (!receiver.known || typeof receiver.value !== 'string') {
+    return false
+  }
+  if (index >= receiver.value.length) {
+    return false
+  }
+  replaceWithPreservedExpression(path, receiverNode, t.stringLiteral(receiver.value[index]!))
+  return true
+}
+
 function handleCall(path: NodePath<t.CallExpression>, patchedRoots: Set<string>): void {
-  // `with` and direct eval can shadow names outside Babel's scope table.
-  if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+  // `with` can replace an intrinsic that Babel treats as an unbound global.
+  if (isInsideWith(path)) {
     return
   }
   const callee = path.node.callee
@@ -559,7 +607,7 @@ function handleMember(path: NodePath<t.MemberExpression>, patchedRoots: Set<stri
     return
   }
   // Delay the ancestor walk until cheap shape checks pass.
-  if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+  if (isInsideWith(path)) {
     return
   }
 
@@ -589,10 +637,18 @@ function handleMember(path: NodePath<t.MemberExpression>, patchedRoots: Set<stri
   }
 
   if (propName === 'length') {
+    if (t.isArrayExpression(obj) && foldArrayLiteralLength(path, obj)) {
+      return
+    }
     const recv = evaluateConstant(obj, path.scope, path)
     if (recv.known && typeof recv.value === 'string') {
       path.replaceWith(t.numericLiteral(recv.value.length))
     }
+    return
+  }
+
+  if (t.isExpression(obj)) {
+    foldStringIndex(path, obj, propName)
   }
 }
 
@@ -625,7 +681,6 @@ function foldGlobalCall(
     foldNumberCtor(path)
     return
   }
-
   if (GLOBAL_FUNCTIONS.has(name)) {
     if (path.scope.getBinding(name)) {
       return

package/src/transforms/fold-constants.ts

@@ -131,6 +131,9 @@ function tryFoldToLiteral(
   if (!result.known) {
     return false
   }
+  if (typeof result.value === 'number' && !Number.isFinite(result.value)) {
+    return false
+  }
   const lit = valueToLiteral(result.value)
   if (!lit) {
     return false

package/src/transforms/hoist-variables.ts

@@ -0,0 +1,272 @@
+import traverse from '@babel/traverse'
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import type { ChangeState } from '../utils/change-tracking'
+
+/**
+ * Moves `var` declarations to the start of their var scope without moving
+ * initializer evaluation.
+ *
+ * Direct exports and declarations inside `with` stay in place. Static blocks
+ * keep separate declarations.
+ *
+ * @example
+ * // ◀️ before
+ * function f() {
+ *   var x = 1;
+ *   if (c) {
+ *     var y = g();
+ *   }
+ *   return x + y;
+ * }
+ *
+ * // ▶️ after
+ * function f() {
+ *   var x, y;
+ *   x = 1;
+ *   if (c) {
+ *     y = g();
+ *   }
+ *   return x + y;
+ * }
+ */
+export function hoistVariables(ast: File): boolean {
+  const state: HoistState = {
+    changed: false,
+    scopes: new Map(),
+  }
+  traverse(ast, {
+    VariableDeclaration(path) {
+      if (path.node.kind !== 'var' || path.parentPath.isExportNamedDeclaration()) {
+        return
+      }
+      const owner = ownerPath(path)
+      if (owner === null || isInsideOwnerWith(path, owner)) {
+        return
+      }
+
+      const scope = hoistedScope(state.scopes, owner)
+      addNames(scope.names, path.getBindingIdentifiers())
+      if (scope.declaration?.node === path.node) {
+        return
+      }
+
+      demoteDeclaration(path)
+      scope.changed = true
+      state.changed = true
+    },
+  })
+
+  for (const scope of state.scopes.values()) {
+    if (scope.changed) {
+      finishDeclaration(scope)
+    }
+  }
+
+  return state.changed
+}
+
+type OwnerPath = NodePath<t.Function | t.Program | t.StaticBlock>
+
+interface HoistState extends ChangeState {
+  scopes: Map<t.Node, HoistedScope>
+}
+
+interface HoistedScope {
+  changed: boolean
+  declaration: NodePath<t.VariableDeclaration> | null
+  names: Map<string, t.Identifier>
+  owner: OwnerPath
+}
+
+function ownerPath(path: NodePath<t.VariableDeclaration>): OwnerPath | null {
+  let current: NodePath | null = path.parentPath
+  while (current) {
+    if (current.isStaticBlock()) {
+      return current as OwnerPath
+    }
+    if (current.isProgram()) {
+      return current as OwnerPath
+    }
+    if (t.isFunction(current.node) && t.isBlockStatement(current.node.body)) {
+      return current as OwnerPath
+    }
+    current = current.parentPath
+  }
+  return null
+}
+
+function isInsideOwnerWith(path: NodePath, owner: OwnerPath): boolean {
+  for (let current = path.parentPath; current && current !== owner; current = current.parentPath) {
+    if (current.isWithStatement()) {
+      return true
+    }
+  }
+  return false
+}
+
+function hoistedScope(scopes: Map<t.Node, HoistedScope>, owner: OwnerPath): HoistedScope {
+  const existing = scopes.get(owner.node)
+  if (existing) {
+    return existing
+  }
+
+  const declaration = leadingBareDeclaration(owner)
+  const scope: HoistedScope = {
+    changed: false,
+    declaration,
+    names: new Map(),
+    owner,
+  }
+  if (declaration) {
+    addNames(scope.names, declaration.getBindingIdentifiers())
+  }
+  scopes.set(owner.node, scope)
+  return scope
+}
+
+function leadingBareDeclaration(owner: OwnerPath): NodePath<t.VariableDeclaration> | null {
+  const first = ownerBody(owner)[0]
+  if (!first?.isVariableDeclaration({ kind: 'var' })) {
+    return null
+  }
+  return first.node.declarations.every((declarator) => declarator.init == null) ? first : null
+}
+
+function ownerBody(owner: OwnerPath): NodePath<t.Statement>[] {
+  if (owner.isFunction()) {
+    const body = owner.get('body')
+    return body.isBlockStatement() ? (body.get('body') as NodePath<t.Statement>[]) : []
+  }
+  return owner.get('body') as NodePath<t.Statement>[]
+}
+
+function demoteDeclaration(path: NodePath<t.VariableDeclaration>): void {
+  const parent = path.parentPath
+  if (parent.isForStatement() && path.key === 'init') {
+    demoteForInit(path)
+    return
+  }
+  if ((parent.isForInStatement() || parent.isForOfStatement()) && path.key === 'left') {
+    demoteForX(path, parent)
+    return
+  }
+
+  const assignments = initializerAssignments(path.node).map((expression) =>
+    t.expressionStatement(expression),
+  )
+
+  if (typeof path.listKey === 'string') {
+    if (assignments.length === 0) {
+      path.remove()
+    } else {
+      path.replaceWithMultiple(assignments)
+    }
+    return
+  }
+  if (assignments.length === 0) {
+    path.replaceWith(t.emptyStatement())
+  } else if (assignments.length === 1) {
+    path.replaceWith(assignments[0]!)
+  } else {
+    path.replaceWith(t.blockStatement(assignments))
+  }
+}
+
+function demoteForInit(path: NodePath<t.VariableDeclaration>): void {
+  const assignments = initializerAssignments(path.node)
+  if (assignments.length === 0) {
+    path.remove()
+    return
+  }
+  const replacement = assignments.length === 1 ? assignments[0]! : t.sequenceExpression(assignments)
+  path.replaceWith(replacement)
+}
+
+function demoteForX(
+  path: NodePath<t.VariableDeclaration>,
+  parent: NodePath<t.ForInStatement | t.ForOfStatement>,
+): void {
+  const declarator = path.node.declarations[0]!
+  const target = declarator.id as t.ArrayPattern | t.Identifier | t.ObjectPattern
+  if (declarator.init) {
+    const assignment = initializerAssignment(declarator, target)
+    const right = parent.get('right') as NodePath<t.Expression>
+    right.replaceWith(t.sequenceExpression([assignment, right.node]))
+  }
+  path.replaceWith(t.cloneNode(target))
+}
+
+function initializerAssignments(node: t.VariableDeclaration): t.AssignmentExpression[] {
+  const assignments: t.AssignmentExpression[] = []
+  for (const declarator of node.declarations) {
+    if (declarator.init != null) {
+      const target = declarator.id as t.ArrayPattern | t.Identifier | t.ObjectPattern
+      assignments.push(initializerAssignment(declarator, target))
+    }
+  }
+  return assignments
+}
+
+function initializerAssignment(
+  declarator: t.VariableDeclarator,
+  target: t.ArrayPattern | t.Identifier | t.ObjectPattern,
+): t.AssignmentExpression {
+  return t.assignmentExpression('=', t.cloneNode(target), declarator.init!)
+}
+
+function addNames(
+  names: Map<string, t.Identifier>,
+  identifiers: Record<string, t.Identifier>,
+): void {
+  for (const [name, identifier] of Object.entries(identifiers)) {
+    if (!names.has(name)) {
+      names.set(name, identifier)
+    }
+  }
+}
+
+function finishDeclaration(scope: HoistedScope): void {
+  const existingNames = new Set<string>()
+  if (scope.declaration) {
+    for (const name of Object.keys(scope.declaration.getBindingIdentifiers())) {
+      existingNames.add(name)
+    }
+  }
+  const declarators = [...scope.names]
+    .filter(([name]) => !existingNames.has(name))
+    .map(([, identifier]) => t.variableDeclarator(t.cloneNode(identifier)))
+
+  if (scope.declaration) {
+    if (declarators.length > 0) {
+      scope.declaration.pushContainer('declarations', declarators)
+    }
+    return
+  }
+
+  if (declarators.length === 0) {
+    return
+  }
+
+  const declaration = t.variableDeclaration('var', declarators)
+  insertDeclaration(scope.owner, declaration)
+}
+
+function insertDeclaration(owner: OwnerPath, declaration: t.VariableDeclaration): void {
+  if (owner.isFunction()) {
+    const body = owner.get('body')
+    if (body.isBlockStatement()) {
+      body.unshiftContainer('body', declaration)
+    }
+    return
+  }
+  if (owner.isProgram()) {
+    owner.unshiftContainer('body', declaration)
+    return
+  }
+  if (owner.isStaticBlock()) {
+    owner.unshiftContainer('body', declaration)
+  }
+}

package/src/transforms/inline-functions.ts

@@ -6,7 +6,7 @@ import type { File } from '@babel/types'
 import { analyzeInlineability } from '../analysis/inlineability'
 import type { InlineCandidate } from '../analysis/inlineability'
 import { isPure } from '../analysis/purity'
-import { enclosingScopeHasDirectEval, isInsideWith, walkOwnFunctionScope } from '../utils/ast'
+import { isInsideWith, walkOwnFunctionScope } from '../utils/ast'
 import { reorderableToStatement } from '../utils/evaluation-order'
 import { generateLoopLabel } from '../utils/loop-lowering'
 import { hasAnnexBFunctionAlias, isInStrictContext } from '../utils/paths'
@@ -135,9 +135,8 @@ function isSafeAtCallSite(
   callPath: NodePath<t.CallExpression>,
   candidates: Map<string, InlineCandidate>,
 ): boolean {
-  // `with`, direct eval, and Annex B aliases can redirect free names outside
-  // Babel's scope table.
-  if (isInsideWith(callPath) || enclosingScopeHasDirectEval(callPath)) {
+  // `with` and Annex B aliases can resolve a free name outside Babel's scope table.
+  if (isInsideWith(callPath)) {
     return false
   }
   if (annexBHoistShadowsFreeVar(callPath, freeVars)) {

package/src/transforms/mangle-properties.ts

@@ -507,7 +507,7 @@ function rewriteKeyedProperty(path: NodePath<KeyedProperty>, state: PropertyMang
   if (mangled === name) {
     return
   }
-  node.key = t.inheritsComments(t.stringLiteral(mangled), node.key)
+  node.key = t.stringLiteral(mangled)
   node.computed = false
   if (t.isObjectProperty(node)) {
     node.shorthand = false
@@ -532,7 +532,7 @@ function rewriteMember(path: NodePath<Member>, state: PropertyManglerState): voi
   }
   // Babel narrows members by `computed`, so both fields need widening.
   const computed = node as Member & { computed: boolean; property: t.Expression }
-  computed.property = t.inheritsComments(t.stringLiteral(mangled), node.property)
+  computed.property = t.stringLiteral(mangled)
   computed.computed = true
   state.changed = true
 }
@@ -586,7 +586,7 @@ function rewriteTerminalNames(
       node.value = mangled
       return node
     }
-    return t.inheritsComments(t.stringLiteral(mangled), node)
+    return t.stringLiteral(mangled)
   }
   if (t.isSequenceExpression(node)) {
     const last = node.expressions.length - 1
@@ -684,10 +684,10 @@ function isTransparentAnnotationParent(path: NodePath, child: t.Node): boolean {
 
 function hasAnnotation(node: t.Node, annotation: string): boolean {
   return (
-    node.leadingComments?.some(
-      (comment) =>
-        comment.value.includes(`@${annotation}`) || comment.value.includes(`#${annotation}`),
-    ) ?? false
+    node.leadingComments?.some((comment) => {
+      const value = comment.value.trim()
+      return value === `@${annotation}` || value === `#${annotation}`
+    }) ?? false
   )
 }
 

package/src/transforms/merge-variable-declarations.ts

@@ -0,0 +1,91 @@
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { rewriteStatementLists } from '../utils/statement-lists'
+
+/**
+ * Merges adjacent variable declarations when their kinds and export wrappers
+ * match. It runs in programs, blocks, switch cases, and static blocks, and
+ * removes unlabeled empty statements between compatible declarations.
+ *
+ * @example
+ * // ◀️ before
+ * let a = 1;
+ * let b = 2;
+ *
+ * // ▶️ after
+ * let a = 1,
+ *   b = 2;
+ */
+export function mergeVariableDeclarations(ast: File): boolean {
+  return rewriteStatementLists(ast, (statements) =>
+    mergeAdjacent(statements.map((path) => path.node)),
+  )
+}
+
+type StatementLike = t.Program['body'][number]
+
+interface MergeableDeclaration {
+  declaration: t.VariableDeclaration
+  exported: boolean
+}
+
+function mergeAdjacent(list: readonly StatementLike[]): StatementLike[] | null {
+  const out: StatementLike[] = []
+  let pendingEmpty: t.EmptyStatement[] = []
+  let merged = false
+
+  for (const statement of list) {
+    if (t.isEmptyStatement(statement) && mergeableDeclaration(out.at(-1)) !== null) {
+      pendingEmpty.push(statement)
+      continue
+    }
+
+    const previous = mergeableDeclaration(out.at(-1))
+    const current = mergeableDeclaration(statement)
+    if (previous && current && canMerge(previous, current)) {
+      out[out.length - 1] = mergePair(previous, current)
+      pendingEmpty = []
+      merged = true
+      continue
+    }
+
+    out.push(...pendingEmpty, statement)
+    pendingEmpty = []
+  }
+
+  out.push(...pendingEmpty)
+  return merged ? out : null
+}
+
+function mergeableDeclaration(statement: StatementLike | undefined): MergeableDeclaration | null {
+  if (statement === undefined) {
+    return null
+  }
+  if (t.isVariableDeclaration(statement)) {
+    return { declaration: statement, exported: false }
+  }
+  if (t.isExportNamedDeclaration(statement) && t.isVariableDeclaration(statement.declaration)) {
+    return { declaration: statement.declaration, exported: true }
+  }
+  return null
+}
+
+function canMerge(previous: MergeableDeclaration, current: MergeableDeclaration): boolean {
+  return (
+    previous.exported === current.exported && previous.declaration.kind === current.declaration.kind
+  )
+}
+
+function mergePair(previous: MergeableDeclaration, current: MergeableDeclaration): StatementLike {
+  const declaration = t.variableDeclaration(previous.declaration.kind, [
+    ...previous.declaration.declarations,
+    ...current.declaration.declarations,
+  ])
+
+  if (!previous.exported) {
+    return declaration
+  }
+
+  return t.exportNamedDeclaration(declaration)
+}

package/src/transforms/numbers-to-strings.ts

@@ -1,7 +1,8 @@
-import type { NodePath, Visitor } from '@babel/traverse'
+import type { Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
+import { isNonComputedKey } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -48,14 +49,3 @@ const visitor: Visitor<ChangeState> = {
     state.changed = true
   },
 }
-
-function isNonComputedKey(path: NodePath<t.NumericLiteral>): boolean {
-  const parentPath = path.parentPath
-  if (!parentPath) {
-    return false
-  }
-  const parent = parentPath.node
-  return (
-    'key' in parent && parent.key === path.node && 'computed' in parent && parent.computed === false
-  )
-}

package/src/transforms/pack-declarations-into-parameters.ts

@@ -2,7 +2,7 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { enclosingScopeHasDirectEval, hasDuplicateParamNames } from '../utils/ast'
+import { hasDuplicateParamNames } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 import { isLiteralShaped } from '../utils/literal'
@@ -75,10 +75,6 @@ function packLeadingIntoParams(path: NodePath<t.Function>): boolean {
   if (referencesArguments(path)) {
     return false
   }
-  // Direct eval can inspect the newly unmapped `arguments` by name.
-  if (enclosingScopeHasDirectEval(path)) {
-    return false
-  }
   // A caller with extra arguments could fill the new parameter slot.
   if (!allCallSitesRespectArity(path, params.length)) {
     return false

package/src/transforms/pack.ts

@@ -114,13 +114,11 @@ const STANDARD_GLOBALS: readonly string[] = [
  * bundler-injected binding, or a live import, none reachable from the body and
  * none distinguishable from a global at build time, so free names are routed
  * through a parameter object whose accessors run in the original top-level scope
- * and resolve each name there. Import declarations return above the call. `eval`
- * is left un-routed so a direct eval still reads the body scope. Names inside a
- * `with` stay un-routed too, since they may resolve against the with object at
- * runtime. Export statements cannot live inside a Function body, so pack throws
- * on them. It packs everything else as written. Code that needs `import.meta`,
- * top-level await, dynamic `import()`, or a top-level `arguments` will not run
- * once moved into a Function body.
+ * and resolve each name there. Imports remain above the call. Names inside
+ * `with` stay bare so the object still controls lookup. A Function body cannot
+ * contain exports, so pack throws when it finds one. Code that needs
+ * `import.meta`, top-level await, dynamic `import()`, or top-level `arguments`
+ * will not run after the move.
  *
  * @example
  * // ◀️ before
@@ -230,10 +228,9 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
 
   const isRoutable = (path: NodePath<t.Identifier>): boolean => {
     const name = path.node.name
-    // The wrapper parameter stays as written. `arguments` and `eval` are never
-    // routed: `arguments` binds to its own function's object, and leaving `eval`
-    // bare keeps a direct eval reading the body scope rather than the global one.
-    if (name === objectName || name === 'arguments' || name === 'eval') {
+    // Keep the wrapper parameter and `arguments` bare. The latter must bind to
+    // the wrapper function's own arguments object.
+    if (name === objectName || name === 'arguments') {
       return false
     }
     // Inside `with`, a free name may resolve to a property of the with object at
@@ -298,18 +295,13 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
   }
   programPath.traverse(routingVisitor)
 
-  // The script completion value is its trailing expression; returning it keeps
-  // `eval` of the packed output producing the same value.
   const body = programNode.body
-  const lastStatement = body.at(-1)
-  if (lastStatement && t.isExpressionStatement(lastStatement)) {
-    body[body.length - 1] = t.returnStatement(lastStatement.expression)
-  }
-
   const innerDirectives = bodyStrict ? [t.directive(t.directiveLiteral('use strict'))] : []
   const innerCode = generate(t.program(body, innerDirectives, 'script'), {
     minified: true,
     comments: false,
+    // `comments: false` still allows @license and @preserve.
+    shouldPrintComment: () => false,
   }).code
 
   const objectExpression = buildAccessorObject({