webfuscator 1.2.1 → 1.3.1

package/src/obfuscator.ts

@@ -14,6 +14,7 @@ import { wrapSingleStatements } from './preparation/wrap-single-statements'
 import { argumentsToParameters } from './transforms/arguments-to-parameters'
 import { arrowToFunction } from './transforms/arrow-to-function'
 import { collapseSingleUseTemps } from './transforms/collapse-single-use-temps'
+import { concealStrings } from './transforms/conceal-strings'
 import { constLetToVar } from './transforms/const-let-to-var'
 import { constToLet } from './transforms/const-to-let'
 import { doWhileToWhile } from './transforms/do-while-to-while'
@@ -26,9 +27,11 @@ import { foldBuiltinMethods } from './transforms/fold-builtin-methods'
 import { foldConstants } from './transforms/fold-constants'
 import { forToWhile } from './transforms/for-to-while'
 import { functionDeclarationToExpression } from './transforms/function-declaration-to-expression'
+import { hoistVariables } from './transforms/hoist-variables'
 import { inlineFunctions } from './transforms/inline-functions'
 import { logicalToTernary } from './transforms/logical-to-ternary'
 import { mangleProperties } from './transforms/mangle-properties'
+import { mergeVariableDeclarations } from './transforms/merge-variable-declarations'
 import { nullishCoalescingToTernary } from './transforms/nullish-coalescing-to-ternary'
 import { numbersToStrings } from './transforms/numbers-to-strings'
 import { objectMethodToProperty } from './transforms/object-method-to-property'
@@ -39,6 +42,7 @@ import { removeAnonymousFunctionNames } from './transforms/remove-anonymous-func
 import { removeUnreachableCode } from './transforms/remove-unreachable-code'
 import { removeUnusedCode } from './transforms/remove-unused-code'
 import { renameIdentifiers } from './transforms/rename-identifiers'
+import { reorderFunctionDeclarations } from './transforms/reorder-function-declarations'
 import { specialsToStrings } from './transforms/specials-to-strings'
 import { switchToIf } from './transforms/switch-to-if'
 import { ternaryToIf } from './transforms/ternary-to-if'
@@ -48,8 +52,6 @@ import type { StringGeneratorModeOption } from './utils/string-generator'
 
 const parserOptions: ParserOptions = { sourceType: 'unambiguous' }
 
-const PRESERVED_COMMENT_RE = /^!|@(?:license|preserve)\b|^#\s*source(?:Mapping)?URL=/iu
-
 const DEFAULT_STRING_GENERATOR_MODE: StringGeneratorModeOption = 'mangled'
 const DEFAULT_SEED = 0
 
@@ -76,11 +78,10 @@ const PREPARATION: readonly Phase[] = [
   ['dotToBracket', asBoolean(dotToBracket)],
 ]
 
-// These one-shot passes prepare the fixed point. Lexical declarations become
-// foldable function-scoped bindings, except at script top level where `var`
-// would create a global property. `argumentsToParameters` precedes parameter
-// renaming. Method demotion precedes extraction because any surviving
-// `ObjectMethod` makes extraction refuse the whole literal.
+// `constLetToVar` must precede the fixed point because folds need function-scoped
+// bindings. `argumentsToParameters` must precede parameter renaming.
+// `objectMethodToProperty` must precede extraction because one `ObjectMethod`
+// blocks the whole object literal.
 const PRE_LOOP: readonly ConfigurablePhase[] = [
   ['dropDebugger', dropDebugger],
   ['dropConsole', dropConsole],
@@ -124,15 +125,25 @@ const LOWERING: readonly ConfigurablePhase[] = [
   ['ternaryToIf', ternaryToIf],
 ]
 
-// Yodification and folding need raw numeric literals. Special-value lowering
-// comes next, then number lowering also handles the `1` created for `Infinity`.
+// `packDeclarationsIntoParameters` must precede declaration motion and merging.
+// `reorderFunctionDeclarations` follows `functionDeclarationToExpression`, so it
+// moves only declarations still needed for hoisting. `hoistVariables` must run
+// before `mergeVariableDeclarations`. `numbersToStrings` follows the fixed point,
+// yodification, and `specialsToStrings` because they need or create numbers.
 const POST_PROCESS: readonly ConfigurablePhase[] = [
   ['packDeclarationsIntoParameters', packDeclarationsIntoParameters],
+  ['reorderFunctionDeclarations', reorderFunctionDeclarations],
+  ['hoistVariables', hoistVariables],
+  ['mergeVariableDeclarations', mergeVariableDeclarations],
   ['yodifyConditions', yodifyConditions],
   ['specialsToStrings', specialsToStrings],
   ['numbersToStrings', numbersToStrings],
 ]
 
+// Conceal strings after every string-producing pass, but before renaming so the
+// generated vault bindings use the caller's name generator.
+const PROTECTION: readonly ConfigurablePhase[] = [['concealStrings', concealStrings]]
+
 // Renaming runs last because later transforms depend on recognizable bindings.
 const RENAME: readonly ConfigurablePhase[] = [['renameIdentifiers', renameIdentifiers]]
 
@@ -141,6 +152,19 @@ const RENAME: readonly ConfigurablePhase[] = [['renameIdentifiers', renameIdenti
 // every other rewrite, including renaming.
 const PACK: readonly ConfigurablePhase[] = [['pack', pack]]
 
+// Tests derive their all-transforms setup from this list. The phase tables remain
+// the only source of pipeline order.
+export const CONFIGURABLE_TRANSFORM_NAMES: readonly TransformName[] = [
+  ...BEFORE_PREPARATION,
+  ...PRE_LOOP,
+  ...FIXED_POINT,
+  ...LOWERING,
+  ...POST_PROCESS,
+  ...PROTECTION,
+  ...RENAME,
+  ...PACK,
+].map(([name]) => name)
+
 /** Parses, transforms, and prints JavaScript without mutating external state. */
 export function obfuscate(code: string, options: ObfuscatorOptions = {}): string {
   const log = options.verbose ? makeLogger() : null
@@ -184,6 +208,13 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
+  for (const [name, fn] of PROTECTION) {
+    if (!isEnabled(name, options)) {
+      continue
+    }
+    run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
+  }
+
   for (const [name, fn] of RENAME) {
     if (!isEnabled(name, options)) {
       continue
@@ -201,7 +232,13 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
   return run(
     log,
     'generate',
-    () => generate(ast, { minified: options.minify ?? false, shouldPrintComment }).code,
+    () =>
+      generate(ast, {
+        comments: false,
+        minified: options.minify ?? false,
+        // `comments: false` still allows @license and @preserve.
+        shouldPrintComment: () => false,
+      }).code,
   )
 }
 
@@ -216,6 +253,10 @@ function ctxFor(
   options: ObfuscatorOptions,
   base: TransformContext,
 ): TransformContext {
+  if (name === 'concealStrings') {
+    const entry = options.transforms?.concealStrings
+    return entry && typeof entry === 'object' ? { ...base, concealStrings: entry } : base
+  }
   const entry = options.transforms?.[name]
   let context = base
   if (entry && typeof entry === 'object' && entry.stringGeneratorMode !== undefined) {
@@ -261,10 +302,6 @@ function asBoolean(fn: (ast: File) => unknown): TransformFn {
   }
 }
 
-function shouldPrintComment(value: string): boolean {
-  return PRESERVED_COMMENT_RE.test(value)
-}
-
 type Logger = <T>(name: string, fn: () => T) => T
 
 function run<T>(log: Logger | null, name: string, fn: () => T): T {

package/src/options.ts

@@ -21,6 +21,9 @@ export type TransformName =
   | 'collapseSingleUseTemps'
   | 'arrowToFunction'
   | 'functionDeclarationToExpression'
+  | 'reorderFunctionDeclarations'
+  | 'hoistVariables'
+  | 'mergeVariableDeclarations'
   | 'switchToIf'
   | 'forToWhile'
   | 'doWhileToWhile'
@@ -35,6 +38,7 @@ export type TransformName =
   | 'yodifyConditions'
   | 'specialsToStrings'
   | 'numbersToStrings'
+  | 'concealStrings'
   | 'mangleProperties'
   | 'renameIdentifiers'
   | 'pack'
@@ -61,8 +65,8 @@ export interface ManglePropertiesOptions {
   /** Custom property-name generator. It takes precedence over `stringGeneratorMode`. */
   nameGenerator?: PropertyNameGenerator
   /**
-   * Only names carrying `/*@__MANGLE_PROP__*\/` or `/*#__MANGLE_PROP__*\/` may
-   * be mangled. Default `false`.
+   * Mangle only names with an exact standalone `/*@__MANGLE_PROP__*\/` or
+   * `/*#__MANGLE_PROP__*\/` annotation. Default `false`.
    */
   onlyAnnotated?: boolean
   /** Only names already present in `cache` may be mangled. Default `false`. */
@@ -95,12 +99,25 @@ export interface PackOptions {
   stringGeneratorMode?: StringGeneratorModeOption
 }
 
+/** Options for the string vault generated by `concealStrings`. */
+export interface ConcealStringsOptions {
+  /** Cache each decoded string in its vault. Default `true`. */
+  cache?: boolean
+  /** Choose how much of the UTF-16 range pads each pool. Default `'regional'`. */
+  cover?: 'full' | 'regional' | 'used'
+  /** Reuse one vault entry for equal strings. Default `true`. */
+  deduplicate?: boolean
+  /** Use one program vault or a separate vault per function. Default `'program'`. */
+  scope?: 'function' | 'program'
+}
+
 type SimpleTransform = Exclude<
   TransformName,
-  'mangleProperties' | 'pack' | 'renameIdentifiers' | 'specialsToStrings'
+  'concealStrings' | 'mangleProperties' | 'pack' | 'renameIdentifiers' | 'specialsToStrings'
 >
 
 type TransformsMap = Partial<Record<SimpleTransform, boolean>> & {
+  concealStrings?: boolean | ConcealStringsOptions
   mangleProperties?: boolean | ManglePropertiesOptions
   pack?: boolean | PackOptions
   renameIdentifiers?: TransformEntry
@@ -129,6 +146,7 @@ export interface ObfuscatorOptions {
 
 // Resolved per-call defaults handed to every transform.
 export interface TransformContext {
+  concealStrings?: ConcealStringsOptions
   mangleProperties?: ManglePropertiesOptions
   pack?: PackOptions
   seed: number

package/src/preparation/expand-destructuring.ts

@@ -3,8 +3,6 @@ import type { NodePath, Scope } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { enclosingScopeHasDirectEval, isInsideWith } from '../utils/ast'
-
 type Kind = t.VariableDeclaration['kind']
 
 // Babel 8 omits `AssignmentPattern` from `LVal`, so list these targets directly.
@@ -18,9 +16,8 @@ type BindingTarget = t.Identifier | t.ObjectPattern | t.ArrayPattern | t.Assignm
  * The source, computed keys, and getters keep their original evaluation counts.
  * Defaults compare against `void 0` because `undefined` can be shadowed.
  *
- * `with` and direct `eval` can expose synthesized names that Babel cannot see, so
- * those scopes are skipped. A `RequireObjectCoercible` guard runs before any
- * computed key, matching ObjectBindingPattern evaluation order.
+ * The `RequireObjectCoercible` guard runs before computed keys to preserve
+ * ObjectBindingPattern evaluation order.
  *
  * @example
  * // ◀️ before
@@ -42,11 +39,6 @@ const visitor = {
     if (typeof path.listKey !== 'string') {
       return
     }
-    // Babel cannot prove a generated name hidden from `with` or direct `eval`.
-    if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
-      return
-    }
-
     const kind = path.node.kind
     const replacement: t.Statement[] = []
     let changed = false

package/src/transforms/arguments-to-parameters.ts

@@ -8,10 +8,11 @@ import type { ChangeState } from '../utils/change-tracking'
 import { isInStrictContext } from '../utils/paths'
 
 /**
- * Replaces `arguments[i]` reads with their mapped parameter in sloppy functions
- * with simple parameter lists. Writes, deletion, reassigned parameters, and any
- * escape of the arguments object make the mapping unsafe. Missing parameters
- * are never added because that would change `fn.length`.
+ * Replaces numeric `arguments[i]` reads with the corresponding parameter in
+ * sloppy functions with simple parameter lists. It leaves a read unchanged when
+ * that index is written or its parameter is reassigned. Reassigning, deleting,
+ * or passing around `arguments` disables the rewrite. Missing parameters are
+ * never added because that would change `fn.length`.
  *
  * @example
  * // ◀️ before

package/src/transforms/arrow-to-function.ts

@@ -2,14 +2,14 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { enclosingScopeHasDirectEval, isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Lowers arrows with Babel's capture-aware `arrowFunctionToExpression`. Arrows
- * that reach `super` stay intact. Values that escape visible call positions also
- * stay intact because only the arrow rejects construction with `new`.
+ * Converts arrows with Babel's capture-aware `arrowFunctionToExpression`.
+ * Arrows that use `super` stay unchanged. An arrow also stays unchanged unless
+ * every use is an immediate call or a discarded expression, because a normal
+ * function can be constructed with `new` and has a `prototype`.
  *
  * @example
  * // ◀️ before
@@ -64,11 +64,7 @@ const visitor: Visitor<ChangeState> = {
       !valueStaysInView(path) ||
       arrowReferencesSuper(path) ||
       inUnsafeCaptureContext(path) ||
-      usesReassignedArguments(path) ||
-      // `with` can shadow capture aliases, and direct eval can inspect the changed
-      // runtime meaning of `this` or `arguments`.
-      isInsideWith(path) ||
-      enclosingScopeHasDirectEval(path)
+      usesReassignedArguments(path)
     ) {
       return
     }
@@ -142,7 +138,7 @@ function valueStaysInView(valuePath: NodePath): boolean {
     return false
   }
   const binding = valuePath.scope.getBinding(parent.node.id.name)
-  if (!binding || !binding.constant) {
+  if (!binding || (binding.kind !== 'const' && !binding.constant)) {
     return false
   }
   return binding.referencePaths.every(

package/src/transforms/collapse-single-use-temps.ts

@@ -10,14 +10,14 @@ import {
   readCrossesFunctionBoundary,
 } from '../analysis/document-order'
 import { isPure } from '../analysis/purity'
-import { isInsideWith } from '../utils/ast'
 import { reorderableToStatement } from '../utils/evaluation-order'
 import { valueToLiteral } from '../utils/literal'
 import { isCalleeOrTagOf } from '../utils/paths'
 
 /**
  * Drops single-use temporaries through substitution, direct branch writes, or
- * constant replacement. Sweeps continue until no shape exposes another.
+ * constant replacement. It repeats these rewrites so one removal can expose
+ * another.
  *
  * @example
  * // ◀️ before
@@ -94,21 +94,9 @@ function resolveSingleUseBinding(path: NodePath<t.VariableDeclarator>): Binding
   if (binding.references === 0) {
     return null
   }
-  // `with` can redirect the temporary or its consumer outside Babel's scope table.
-  if (bindingTouchesWith(binding)) {
-    return null
-  }
   return binding
 }
 
-function bindingTouchesWith(binding: Binding): boolean {
-  return (
-    isInsideWith(binding.path) ||
-    binding.referencePaths.some((ref) => isInsideWith(ref)) ||
-    binding.constantViolations.some((violation) => isInsideWith(violation))
-  )
-}
-
 function findProgramScope(ast: File): Scope | undefined {
   let result: Scope | undefined
   traverse(ast, {
@@ -145,7 +133,7 @@ function trySubstituteSingleUse(
   let removeWriteStmt: boolean
 
   if (init) {
-    if (binding.constantViolations.length > 0) {
+    if (binding.kind !== 'const' && binding.constantViolations.length > 0) {
       return false
     }
     writeStmt = declStmt
@@ -333,8 +321,9 @@ function tryRenameWritesToReader(
       return false
     }
 
-    // Redirecting into a later lexical binding could write it in TDZ.
-    if (!declarationReaches(yBinding.path, violation)) {
+    // A later `var` initializer can overwrite a redirected write. Writes before
+    // lexical initialization are intentionally ignored.
+    if (yBinding.kind === 'var' && !declarationReaches(yBinding.path, violation)) {
       return false
     }
   }
@@ -662,7 +651,7 @@ function spanStatementIsInert(path: NodePath, tempBinding: Binding): boolean {
   }
   if (t.isIfStatement(node)) {
     const test = path.get('test') as NodePath
-    if (!isPure(test.node, test.scope, test)) {
+    if (!isPure(test.node, test.scope)) {
       return false
     }
     if (!spanStatementIsInert(path.get('consequent') as NodePath, tempBinding)) {
@@ -675,9 +664,9 @@ function spanStatementIsInert(path: NodePath, tempBinding: Binding): boolean {
     const expr = path.get('expression') as NodePath
     if (isTempWrite(expr.node, tempBinding)) {
       const rhs = expr.get('right') as NodePath
-      return isPure(rhs.node, rhs.scope, rhs)
+      return isPure(rhs.node, rhs.scope)
     }
-    return isPure(expr.node, expr.scope, expr)
+    return isPure(expr.node, expr.scope)
   }
   return false
 }
@@ -723,7 +712,7 @@ function tryPropagateConstant(
   let writeSourcePath: NodePath
 
   if (init) {
-    if (binding.constantViolations.length > 0) {
+    if (binding.kind !== 'const' && binding.constantViolations.length > 0) {
       return false
     }
     if (!isUnconditionallyExecuted(declStmt, declaratorPath.scope)) {
@@ -890,10 +879,10 @@ function isStatementMovementSafe(path: NodePath): boolean {
   if (t.isEmptyStatement(node)) {
     return true
   }
-  // Crossing a declaration can change name resolution or TDZ.
+  // Only inert expression statements are safe to cross.
   if (t.isExpressionStatement(node)) {
     const expr = path.get('expression') as NodePath
-    return isPure(expr.node, expr.scope, expr)
+    return isPure(expr.node, expr.scope)
   }
   return false
 }