webfuscator 1.2.1 → 1.3.0

package/src/transforms/remove-unused-code.ts

@@ -1,10 +1,9 @@
 import traverse from '@babel/traverse'
-import type { NodePath, Scope, Visitor } from '@babel/traverse'
+import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { isSideEffectFree } from '../analysis/purity'
-import { isDirectEvalCall } from '../utils/ast'
 import type { ChangeState } from '../utils/change-tracking'
 import { hasAnnexBFunctionAlias } from '../utils/paths'
 
@@ -28,10 +27,7 @@ export function removeUnusedCode(ast: File): boolean {
   // then maintain counts during removal.
   crawlProgramScope(ast)
   let anyChanged = false
-  const state: SweepState = {
-    changed: true,
-    evalReachableScopes: collectEvalReachableScopes(ast),
-  }
+  const state: ChangeState = { changed: true }
   while (state.changed) {
     state.changed = false
     traverse(ast, sweepVisitor, undefined, state)
@@ -51,49 +47,19 @@ function crawlProgramScope(ast: File): void {
   })
 }
 
-// Direct eval can read otherwise unreferenced bindings in its scope ancestry.
-// Sweep state keeps this set local to one pass.
-interface SweepState extends ChangeState {
-  evalReachableScopes: Set<t.Node>
-}
-
-function collectEvalReachableScopes(ast: File): Set<t.Node> {
-  const reachable = new Set<t.Node>()
-  traverse(ast, {
-    CallExpression(path) {
-      if (!isDirectEvalCall(path.node)) {
-        return
-      }
-      let scope: Scope | undefined = path.scope
-      while (scope) {
-        reachable.add(scope.block)
-        scope = scope.parent
-      }
-    },
-  })
-  return reachable
-}
-
-function bindingReachableByEval(
-  binding: { scope: Scope },
-  evalReachableScopes: Set<t.Node>,
-): boolean {
-  return evalReachableScopes.has(binding.scope.block)
-}
-
-const sweepVisitor: Visitor<SweepState> = {
+const sweepVisitor: Visitor<ChangeState> = {
   VariableDeclarator(path, state) {
-    if (tryRemoveDeclarator(path, state.evalReachableScopes)) {
+    if (tryRemoveDeclarator(path)) {
       state.changed = true
     }
   },
   FunctionDeclaration(path, state) {
-    if (tryRemoveFunctionDecl(path, state.evalReachableScopes)) {
+    if (tryRemoveFunctionDecl(path)) {
       state.changed = true
     }
   },
   ClassDeclaration(path, state) {
-    if (tryRemoveClassDecl(path, state.evalReachableScopes)) {
+    if (tryRemoveClassDecl(path)) {
       state.changed = true
     }
   },
@@ -126,10 +92,7 @@ function dereferenceSubtree(rootPath: NodePath): void {
   rootPath.traverse(dereferenceVisitor)
 }
 
-function tryRemoveDeclarator(
-  path: NodePath<t.VariableDeclarator>,
-  evalReachableScopes: Set<t.Node>,
-): boolean {
+function tryRemoveDeclarator(path: NodePath<t.VariableDeclarator>): boolean {
   const declaration = path.parentPath
   if (!declaration || !declaration.isVariableDeclaration()) {
     return false
@@ -170,10 +133,6 @@ function tryRemoveDeclarator(
   if (binding.constantViolations.length > 0) {
     return false
   }
-  if (bindingReachableByEval(binding, evalReachableScopes)) {
-    return false
-  }
-
   if (path.node.init) {
     dereferenceSubtree(path.get('init') as NodePath)
   }
@@ -185,10 +144,7 @@ function tryRemoveDeclarator(
   return true
 }
 
-function tryRemoveFunctionDecl(
-  path: NodePath<t.FunctionDeclaration>,
-  evalReachableScopes: Set<t.Node>,
-): boolean {
+function tryRemoveFunctionDecl(path: NodePath<t.FunctionDeclaration>): boolean {
   if (isExported(path)) {
     return false
   }
@@ -211,20 +167,13 @@ function tryRemoveFunctionDecl(
   if (binding.constantViolations.length > 0) {
     return false
   }
-  if (bindingReachableByEval(binding, evalReachableScopes)) {
-    return false
-  }
-
   dereferenceSubtree(path.get('body') as NodePath)
   path.scope.removeBinding(id.name)
   path.remove()
   return true
 }
 
-function tryRemoveClassDecl(
-  path: NodePath<t.ClassDeclaration>,
-  evalReachableScopes: Set<t.Node>,
-): boolean {
+function tryRemoveClassDecl(path: NodePath<t.ClassDeclaration>): boolean {
   if (isExported(path)) {
     return false
   }
@@ -265,10 +214,6 @@ function tryRemoveClassDecl(
   if (binding.constantViolations.length > 0) {
     return false
   }
-  if (bindingReachableByEval(binding, evalReachableScopes)) {
-    return false
-  }
-
   dereferenceSubtree(path.get('body') as NodePath)
   if (path.node.superClass) {
     dereferenceSubtree(path.get('superClass') as NodePath)

package/src/transforms/rename-identifiers.ts

@@ -4,7 +4,7 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import type { TransformContext } from '../options'
-import { isDirectEvalCall, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import { hasAnnexBFunctionAlias, referencesOrWritesVariable } from '../utils/paths'
 import { mulberry32 } from '../utils/random'
 import { StringGenerator } from '../utils/string-generator'
@@ -31,6 +31,7 @@ import { StringGenerator } from '../utils/string-generator'
  */
 export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
   const generator = new StringGenerator(ctx.stringGeneratorMode, mulberry32(ctx.seed))
+  const separatedDirectExports = separateDirectExports(ast.program)
 
   let programScope: Scope | undefined
   traverse(ast, {
@@ -40,14 +41,14 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
     },
   })
   if (!programScope) {
-    return false
+    return separatedDirectExports
   }
   programScope.crawl()
 
   const liveAncestors = new Map<Scope, Set<Binding>>()
   // Reserve unbound names so generated bindings cannot capture them.
   const freeNames = new Set<string>()
-  // `with` and direct eval pin bindings to their source names.
+  // A reference inside `with` pins its binding to the source name.
   const unrenamable = new Set<Binding>()
   // Reserve pinned source names globally, including before their binding is seen.
   const pinnedNames = new Set<string>()
@@ -82,19 +83,6 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
         scope = scope.parent
       }
     },
-    CallExpression(path) {
-      // Direct eval can read every visible binding by its source name.
-      if (!isDirectEvalCall(path.node)) {
-        return
-      }
-      let scope: Scope | undefined = path.scope
-      while (scope) {
-        for (const name of Object.keys(scope.bindings)) {
-          pin(scope.bindings[name]!, name)
-        }
-        scope = scope.parent
-      }
-    },
     FunctionDeclaration(path) {
       // ECMA-262 B.3.3 gives sloppy block functions an alias Babel does not model.
       if (!hasAnnexBFunctionAlias(path)) {
@@ -169,7 +157,7 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
   })
 
   if (bindingToName.size === 0) {
-    return renameLabels(ast, generator)
+    return renameLabels(ast, generator) || separatedDirectExports
   }
 
   traverse(ast, {
@@ -199,6 +187,43 @@ export function renameIdentifiers(ast: File, ctx: TransformContext): boolean {
   return true
 }
 
+function separateDirectExports(program: t.Program): boolean {
+  const body: t.Program['body'] = []
+  let changed = false
+
+  for (const statement of program.body) {
+    const declaration = t.isExportNamedDeclaration(statement) ? statement.declaration : null
+    if (
+      !t.isVariableDeclaration(declaration) &&
+      !t.isFunctionDeclaration(declaration) &&
+      !t.isClassDeclaration(declaration)
+    ) {
+      body.push(statement)
+      continue
+    }
+
+    const names = Object.keys(t.getBindingIdentifiers(declaration))
+    if (names.length === 0) {
+      body.push(statement)
+      continue
+    }
+
+    body.push(
+      declaration,
+      t.exportNamedDeclaration(
+        null,
+        names.map((name) => t.exportSpecifier(t.identifier(name), t.identifier(name))),
+      ),
+    )
+    changed = true
+  }
+
+  if (changed) {
+    program.body = body
+  }
+  return changed
+}
+
 function isNonBindingPosition(path: { node: t.Identifier; parent: t.Node }): boolean {
   const node = path.node
   const parent = path.parent

package/src/transforms/reorder-function-declarations.ts

@@ -0,0 +1,80 @@
+import type { NodePath } from '@babel/traverse'
+import type * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { hasAnnexBFunctionAlias } from '../utils/paths'
+import { rewriteStatementLists } from '../utils/statement-lists'
+import type { StatementListContainer } from '../utils/statement-lists'
+
+/**
+ * Moves hoisted function declarations to the end of each program, block, switch
+ * case, or static block. It keeps declaration order, including duplicate names,
+ * and leaves sloppy Annex B block functions in place.
+ *
+ * If moving every declaration would turn a string expression into a directive,
+ * one declaration stays before the string. Direct exports stay in place.
+ * Indirect exports move with their local declaration.
+ *
+ * @example
+ * // ◀️ before
+ * function area(r) {
+ *   return r * r;
+ * }
+ * log(area(2));
+ *
+ * // ▶️ after
+ * log(area(2));
+ * function area(r) {
+ *   return r * r;
+ * }
+ */
+export function reorderFunctionDeclarations(ast: File): boolean {
+  return rewriteStatementLists(ast, (statements, container) =>
+    reorderedStatements(statements, containerAllowsDirective(container)),
+  )
+}
+
+// Only programs and function bodies recognize directives, so only they need the guard.
+function containerAllowsDirective(container: NodePath<StatementListContainer>): boolean {
+  if (container.isProgram()) {
+    return true
+  }
+  return container.isBlockStatement() && container.parentPath.isFunction()
+}
+
+function reorderedStatements(
+  children: NodePath<t.Statement>[],
+  canCreateDirective: boolean,
+): t.Statement[] | null {
+  const rest: t.Statement[] = []
+  const moved: t.Statement[] = []
+  for (const child of children) {
+    if (isMovable(child)) {
+      moved.push(child.node)
+    } else {
+      rest.push(child.node)
+    }
+  }
+
+  if (moved.length === 0) {
+    return null
+  }
+  if (canCreateDirective && createsDirective(rest)) {
+    rest.unshift(moved.shift()!)
+  }
+  const reordered = [...rest, ...moved]
+  return reordered.every((node, index) => node === children[index]?.node) ? null : reordered
+}
+
+function createsDirective(statements: readonly t.Statement[]): boolean {
+  const first = statements[0]
+  return (
+    first !== undefined &&
+    first.type === 'ExpressionStatement' &&
+    first.expression.type === 'StringLiteral'
+  )
+}
+
+function isMovable(child: NodePath<t.Statement>): boolean {
+  return child.isFunctionDeclaration() && child.node.id !== null && !hasAnnexBFunctionAlias(child)
+}

package/src/transforms/specials-to-strings.ts

@@ -4,7 +4,7 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import type { TransformContext } from '../options'
-import { enclosingScopeHasDirectEval, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import type { ChangeState } from '../utils/change-tracking'
 import { mulberry32 } from '../utils/random'
 import { StringGenerator } from '../utils/string-generator'
@@ -69,8 +69,9 @@ const visitor: Visitor<State> = {
     if (path.scope.getBinding(name)) {
       return
     }
-    // Replacements are not write targets. `with` and eval can also shadow globals.
-    if (isWriteTarget(path) || isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+    // A replacement cannot occupy a write target. `with` may also shadow `NaN`,
+    // `Infinity`, or `undefined`.
+    if (isWriteTarget(path) || isInsideWith(path)) {
       return
     }
     const str = t.stringLiteral(state.generator.next())

package/src/transforms/update-to-assignment.ts

@@ -2,7 +2,7 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isDirectEvalCall, isInsideWith } from '../utils/ast'
+import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -52,10 +52,6 @@ const visitor: Visitor<ChangeState> = {
     if (!isNumericBinding(binding)) {
       return
     }
-    // Direct eval anywhere in the binding's scope can change its type.
-    if (bindingScopeReachesDirectEval(binding!)) {
-      return
-    }
     const compound = operator === '++' ? '+=' : '-='
     path.replaceWith(t.assignmentExpression(compound, argument, t.numericLiteral(1)))
     state.changed = true
@@ -95,18 +91,6 @@ function isNumericBinding(binding: Binding | undefined): boolean {
   return binding.constantViolations.every((violation) => keepsNumeric(violation.node))
 }
 
-// A sibling or nested direct eval can still close over and reassign the binding.
-function bindingScopeReachesDirectEval(binding: Binding): boolean {
-  let found = false
-  t.traverseFast(binding.scope.block, (node) => {
-    if (isDirectEvalCall(node)) {
-      found = true
-    }
-    return found ? t.traverseFast.stop : undefined
-  })
-  return found
-}
-
 function isForInOfLoopVariable(binding: Binding): boolean {
   const declaration = binding.path.parentPath
   if (!declaration || !declaration.isVariableDeclaration()) {

package/src/utils/ast.ts

@@ -62,75 +62,39 @@ export function isProtoKey(key: t.Node): boolean {
   )
 }
 
+// A non-computed key names a property; it is not a runtime value.
+export function isNonComputedKey(path: NodePath): boolean {
+  const parent = path.parent
+  return (
+    'key' in parent && parent.key === path.node && 'computed' in parent && parent.computed === false
+  )
+}
+
 // `with` can shadow names outside Babel's scope table.
 export function isInsideWith(path: NodePath): boolean {
-  if (!programContains(path.scope.getProgramParent().block, programWith, t.isWithStatement)) {
+  if (!programHasWith(path.scope.getProgramParent().block)) {
     return false
   }
   return path.findParent((ancestor) => ancestor.isWithStatement()) !== null
 }
 
-// Direct eval can access local bindings by name. Indirect eval runs globally and
-// does not count.
-export function enclosingScopeHasDirectEval(path: NodePath): boolean {
-  if (!programContains(path.scope.getProgramParent().block, programDirectEval, isDirectEvalCall)) {
-    return false
-  }
-  let current: NodePath | null = path
-  while (current) {
-    if ((current.isFunction() || current.isProgram()) && ownScopeHasDirectEval(current.node)) {
-      return true
-    }
-    current = current.parentPath
-  }
-  return false
-}
-
-// Cache program-wide `eval` and `with` checks to avoid a subtree walk per name.
-// No transform creates either construct, so a negative result stays valid.
-const programDirectEval = new WeakMap<t.Node, boolean>()
+// Cache the program-wide scan because `isInsideWith` runs for many identifiers.
+// Transforms never add `with`, so a cached miss remains valid.
 const programWith = new WeakMap<t.Node, boolean>()
 
-function programContains(
-  programNode: t.Node,
-  cache: WeakMap<t.Node, boolean>,
-  matches: (node: t.Node) => boolean,
-): boolean {
-  const cached = cache.get(programNode)
+function programHasWith(programNode: t.Node): boolean {
+  const cached = programWith.get(programNode)
   if (cached !== undefined) {
     return cached
   }
   let found = false
   t.traverseFast(programNode, (node) => {
-    if (!matches(node)) {
+    if (!t.isWithStatement(node)) {
       return
     }
     found = true
     return t.traverseFast.stop
   })
-  cache.set(programNode, found)
+  programWith.set(programNode, found)
   return found
 }
-
-function ownScopeHasDirectEval(owner: t.Node): boolean {
-  let found = false
-  // This walk stops at the first hit, unlike `walkOwnFunctionScope`.
-  t.traverseFast(owner, (node) => {
-    if (isDirectEvalCall(node)) {
-      found = true
-      return t.traverseFast.stop
-    }
-    return node !== owner && t.isFunction(node) ? t.traverseFast.skip : undefined
-  })
-  return found
-}
-
-export function isDirectEvalCall(node: t.Node): boolean {
-  // `eval?.(...)` is an OptionalCallExpression yet still a direct eval, so both
-  // call node shapes count.
-  return (
-    (t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
-    t.isIdentifier(node.callee) &&
-    node.callee.name === 'eval'
-  )
-}

package/src/utils/literal.ts

@@ -1,5 +1,9 @@
+import generate from '@babel/generator'
 import * as t from '@babel/types'
 
+const MAX_GENERATED_LITERAL_LENGTH = 8192
+const MAX_LITERAL_DEPTH = 32
+const MAX_LITERAL_NODES = 512
 const MAX_STRING_LITERAL_LENGTH = 4096
 
 // RegExp literals allocate mutable objects and are not primitive values.
@@ -45,19 +49,56 @@ function literalShapeKind(node: t.Node): 'bigint' | 'other' | null {
 }
 
 export function valueToLiteral(value: unknown): t.Expression | null {
+  const literal = buildValueLiteral(value, new Set(), { nodesRemaining: MAX_LITERAL_NODES }, 0)
+  if (!literal || generate(literal).code.length > MAX_GENERATED_LITERAL_LENGTH) {
+    return null
+  }
+  return literal
+}
+
+interface LiteralBudget {
+  nodesRemaining: number
+}
+
+function reserveLiteralNodes(budget: LiteralBudget, count: number): boolean {
+  if (budget.nodesRemaining < count) {
+    return false
+  }
+  budget.nodesRemaining -= count
+  return true
+}
+
+function buildValueLiteral(
+  value: unknown,
+  seen: Set<object>,
+  budget: LiteralBudget,
+  depth: number,
+): t.Expression | null {
+  if (depth > MAX_LITERAL_DEPTH) {
+    return null
+  }
   if (typeof value === 'string') {
-    if (value.length > MAX_STRING_LITERAL_LENGTH) {
+    if (value.length > MAX_STRING_LITERAL_LENGTH || !reserveLiteralNodes(budget, 1)) {
       return null
     }
     return t.stringLiteral(value)
   }
   if (typeof value === 'boolean') {
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.booleanLiteral(value)
   }
   if (value === null) {
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.nullLiteral()
   }
   if (value === undefined) {
+    if (!reserveLiteralNodes(budget, 2)) {
+      return null
+    }
     // `void 0` cannot be shadowed like the identifier `undefined`.
     return t.unaryExpression('void', t.numericLiteral(0))
   }
@@ -65,8 +106,14 @@ export function valueToLiteral(value: unknown): t.Expression | null {
     // A UnaryExpression lets the generator parenthesize negative BigInt where
     // precedence requires it.
     if (value < 0n) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.bigIntLiteral(-value))
     }
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.bigIntLiteral(value)
   }
   if (typeof value === 'number') {
@@ -74,17 +121,30 @@ export function valueToLiteral(value: unknown): t.Expression | null {
       return null
     }
     if (Object.is(value, -0)) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.numericLiteral(0))
     }
     if (value < 0) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.numericLiteral(-value))
     }
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.numericLiteral(value)
   }
   if (Array.isArray(value)) {
+    if (seen.has(value) || !arrayHasLiteralShape(value) || !reserveLiteralNodes(budget, 1)) {
+      return null
+    }
+    seen.add(value)
     const elements: t.Expression[] = []
     for (const item of value) {
-      const lit = valueToLiteral(item)
+      const lit = buildValueLiteral(item, seen, budget, depth + 1)
       if (!lit) {
         return null
       }
@@ -94,3 +154,32 @@ export function valueToLiteral(value: unknown): t.Expression | null {
   }
   return null
 }
+
+function arrayHasLiteralShape(value: unknown[]): boolean {
+  if (Object.getPrototypeOf(value) !== Array.prototype || !Object.isExtensible(value)) {
+    return false
+  }
+  const names = Object.getOwnPropertyNames(value)
+  if (names.length !== value.length + 1 || names.at(-1) !== 'length') {
+    return false
+  }
+  for (let index = 0; index < value.length; index++) {
+    if (
+      names[index] !== String(index) ||
+      !isOrdinaryDataProperty(Object.getOwnPropertyDescriptor(value, String(index)))
+    ) {
+      return false
+    }
+  }
+  return Object.getOwnPropertySymbols(value).length === 0
+}
+
+function isOrdinaryDataProperty(descriptor: PropertyDescriptor | undefined): boolean {
+  return (
+    descriptor !== undefined &&
+    'value' in descriptor &&
+    descriptor.configurable === true &&
+    descriptor.enumerable === true &&
+    descriptor.writable === true
+  )
+}

package/src/utils/statement-lists.ts

@@ -0,0 +1,45 @@
+import type { NodePath } from '@babel/traverse'
+import type * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from './change-tracking'
+import type { ChangeState } from './change-tracking'
+
+export type StatementListContainer = t.Program | t.BlockStatement | t.StaticBlock | t.SwitchCase
+
+type Rewrite = (
+  statements: NodePath<t.Statement>[],
+  container: NodePath<StatementListContainer>,
+) => t.Statement[] | null
+
+/** Applies a rewrite to every statement-list container in the AST. */
+export function rewriteStatementLists(ast: File, rewrite: Rewrite): boolean {
+  return traverseForChanges(ast, {
+    Program(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    BlockStatement(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    StaticBlock(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    SwitchCase(path, state) {
+      apply(path, 'consequent', rewrite, state)
+    },
+  })
+}
+
+function apply(
+  container: NodePath<StatementListContainer>,
+  key: 'body' | 'consequent',
+  rewrite: Rewrite,
+  state: ChangeState,
+): void {
+  const statements = container.get(key) as NodePath<t.Statement>[]
+  const replacement = rewrite(statements, container)
+  if (replacement) {
+    container.set(key, replacement)
+    state.changed = true
+  }
+}

package/DISCLOSURE

@@ -1,9 +0,0 @@
-webfuscator transforms and obfuscates JavaScript source code. Its features
-include identifier and property-name mangling, constant folding, dead-code
-removal, and control-flow and literal rewrites.
-
-These capabilities can make JavaScript harder to inspect and may have both
-legitimate and harmful uses. The intended use is transforming software that
-the user owns or is authorized to modify. This package is not intended to
-create, conceal, distribute, or operate malware, or to interfere with systems
-without authorization.