webfuscator 1.2.1 → 1.3.1

package/src/transforms/drop-console.ts

@@ -4,7 +4,6 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { isSideEffectFree } from '../analysis/purity'
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -90,8 +89,7 @@ const visitor: Visitor<ChangeState> = {
     if (!t.isIdentifier(object) || object.name !== 'console') {
       return
     }
-    // `with` can supply a different `console` outside Babel's scope table.
-    if (path.scope.getBinding('console') || isInsideWith(path)) {
+    if (path.scope.getBinding('console')) {
       return
     }
     // Removing the call also removes argument and computed-key evaluation.
@@ -108,11 +106,11 @@ function callArgumentsAreInert(
   callee: t.MemberExpression | t.OptionalMemberExpression,
   path: NodePath<t.ExpressionStatement>,
 ): boolean {
-  if (callee.computed && !isSideEffectFree(callee.property, path.scope, path)) {
+  if (callee.computed && !isSideEffectFree(callee.property, path.scope)) {
     return false
   }
   for (const arg of expr.arguments) {
-    if (!t.isExpression(arg) || !isSideEffectFree(arg, path.scope, path)) {
+    if (!t.isExpression(arg) || !isSideEffectFree(arg, path.scope)) {
       return false
     }
   }

package/src/transforms/expand-binary-assignment.ts

@@ -2,7 +2,6 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -58,10 +57,6 @@ function lowerBinaryAssignment(path: NodePath<t.AssignmentExpression>): boolean
   const read = t.cloneNode(left, true)
 
   if (t.isMemberExpression(left) && t.isMemberExpression(read)) {
-    // `with` can turn a bare object name into a getter or shadow a memo temp.
-    if (isInsideWith(path)) {
-      return false
-    }
     const object = left.object
     if (t.isExpression(object)) {
       const memo = path.scope.maybeGenerateMemoised(object)

package/src/transforms/expand-logical-assignment.ts

@@ -2,7 +2,6 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -52,10 +51,6 @@ function lowerLogicalAssignment(path: NodePath<t.AssignmentExpression>): boolean
   const lhs = t.cloneNode(left, true)
 
   if (t.isMemberExpression(left) && t.isMemberExpression(lhs)) {
-    // `with` can turn a bare object name into a getter or shadow a memo temp.
-    if (isInsideWith(path)) {
-      return false
-    }
     const object = left.object
     if (t.isExpression(object)) {
       const memo = path.scope.maybeGenerateMemoised(object)

package/src/transforms/extract-object-properties.ts

@@ -3,7 +3,7 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { initializerReaches } from '../analysis/document-order'
-import { isInsideWith, isProtoKey } from '../utils/ast'
+import { isProtoKey } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 import { isCalleeOrTagOf } from '../utils/paths'
@@ -172,12 +172,7 @@ function performExtraction(
   if (!binding) {
     return false
   }
-  if (!binding.constant) {
-    return false
-  }
-
-  // `with` can shadow a synthesized entry binding.
-  if (isInsideWith(path)) {
+  if (path.node.kind !== 'const' && !binding.constant) {
     return false
   }
 
@@ -196,15 +191,11 @@ function performExtraction(
   const seenMembers = new Set<t.MemberExpression>()
 
   for (const ref of binding.referencePaths) {
-    // Before initialization, a wrapper read throws while a bare binding may not.
-    if (!initializerReaches(path, ref)) {
+    // A pre-initializer `var` wrapper read sees `undefined`, while an extracted
+    // binding read would not perform the member access.
+    if (path.node.kind === 'var' && !initializerReaches(path, ref)) {
       return false
     }
-    // `with` can redirect the rewritten reference.
-    if (isInsideWith(ref)) {
-      return false
-    }
-
     const parent = ref.parentPath
     if (!parent || !parent.isMemberExpression()) {
       return false

package/src/transforms/fold-builtin-methods.ts

@@ -4,7 +4,8 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { evaluateConstant, isOpaque } from '../analysis/constant'
-import { enclosingScopeHasDirectEval, isInDirectivePrologue, isInsideWith } from '../utils/ast'
+import { isSideEffectFree } from '../analysis/purity'
+import { isInDirectivePrologue } from '../utils/ast'
 import type { ChangeState } from '../utils/change-tracking'
 import { valueToLiteral } from '../utils/literal'
 
@@ -104,18 +105,13 @@ function collectPatchedIntrinsics(ast: File): Set<string> {
       markMutationCall(path, poison)
     },
     Identifier(path) {
-      // Global eval and Function can patch any intrinsic outside this scan.
       const name = path.node.name
-      if (name !== 'eval' && name !== 'Function') {
+      if (name !== 'Function') {
         return
       }
       if (!path.isReferencedIdentifier() || path.scope.getBinding(name)) {
         return
       }
-      if (name === 'eval') {
-        poison(INTRINSIC_ROOTS)
-        return
-      }
       const parent = path.parentPath
       if (
         parent &&
@@ -496,7 +492,7 @@ function isReferenceRequiredPosition(path: NodePath<t.MemberExpression>): boolea
 }
 
 // Folding a leading call to a string can create a directive and change strictness.
-function foldsIntoDirective(path: NodePath<t.CallExpression>, replacement: t.Expression): boolean {
+function foldsIntoDirective(path: NodePath, replacement: t.Expression): boolean {
   if (!t.isStringLiteral(replacement)) {
     return false
   }
@@ -506,11 +502,59 @@ function foldsIntoDirective(path: NodePath<t.CallExpression>, replacement: t.Exp
   )
 }
 
-function handleCall(path: NodePath<t.CallExpression>, patchedRoots: Set<string>): void {
-  // `with` and direct eval can shadow names outside Babel's scope table.
-  if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
+function replaceWithPreservedExpression(
+  path: NodePath<t.CallExpression | t.MemberExpression>,
+  expression: t.Expression,
+  result: t.Expression,
+): void {
+  if (!isSideEffectFree(expression, path.scope)) {
+    path.replaceWith(t.sequenceExpression([expression, result]))
     return
   }
+  if (foldsIntoDirective(path, result)) {
+    path.replaceWith(t.sequenceExpression([t.numericLiteral(0), result]))
+    return
+  }
+  path.replaceWith(result)
+}
+
+function foldArrayLiteralLength(
+  path: NodePath<t.MemberExpression>,
+  array: t.ArrayExpression,
+): boolean {
+  if (array.elements.some((element) => t.isSpreadElement(element))) {
+    return false
+  }
+  const effects = array.elements.filter(
+    (element): element is t.Expression =>
+      element !== null && t.isExpression(element) && !isSideEffectFree(element, path.scope),
+  )
+  const length = t.numericLiteral(array.elements.length)
+  path.replaceWith(effects.length === 0 ? length : t.sequenceExpression([...effects, length]))
+  return true
+}
+
+function foldStringIndex(
+  path: NodePath<t.MemberExpression>,
+  receiverNode: t.Expression,
+  propertyName: string,
+): boolean {
+  const index = Number(propertyName)
+  if (!Number.isSafeInteger(index) || index < 0 || String(index) !== propertyName) {
+    return false
+  }
+  const receiver = evaluateConstant(receiverNode, path.scope, path)
+  if (!receiver.known || typeof receiver.value !== 'string') {
+    return false
+  }
+  if (index >= receiver.value.length) {
+    return false
+  }
+  replaceWithPreservedExpression(path, receiverNode, t.stringLiteral(receiver.value[index]!))
+  return true
+}
+
+function handleCall(path: NodePath<t.CallExpression>, patchedRoots: Set<string>): void {
   const callee = path.node.callee
 
   if (t.isIdentifier(callee)) {
@@ -558,11 +602,6 @@ function handleMember(path: NodePath<t.MemberExpression>, patchedRoots: Set<stri
   if (isReferenceRequiredPosition(path)) {
     return
   }
-  // Delay the ancestor walk until cheap shape checks pass.
-  if (isInsideWith(path) || enclosingScopeHasDirectEval(path)) {
-    return
-  }
-
   const obj = path.node.object
 
   if (t.isIdentifier(obj) && !path.scope.getBinding(obj.name) && !patchedRoots.has(obj.name)) {
@@ -589,10 +628,18 @@ function handleMember(path: NodePath<t.MemberExpression>, patchedRoots: Set<stri
   }
 
   if (propName === 'length') {
+    if (t.isArrayExpression(obj) && foldArrayLiteralLength(path, obj)) {
+      return
+    }
     const recv = evaluateConstant(obj, path.scope, path)
     if (recv.known && typeof recv.value === 'string') {
       path.replaceWith(t.numericLiteral(recv.value.length))
     }
+    return
+  }
+
+  if (t.isExpression(obj)) {
+    foldStringIndex(path, obj, propName)
   }
 }
 
@@ -625,7 +672,6 @@ function foldGlobalCall(
     foldNumberCtor(path)
     return
   }
-
   if (GLOBAL_FUNCTIONS.has(name)) {
     if (path.scope.getBinding(name)) {
       return

package/src/transforms/fold-constants.ts

@@ -131,6 +131,9 @@ function tryFoldToLiteral(
   if (!result.known) {
     return false
   }
+  if (typeof result.value === 'number' && !Number.isFinite(result.value)) {
+    return false
+  }
   const lit = valueToLiteral(result.value)
   if (!lit) {
     return false
@@ -187,7 +190,7 @@ function tryReassociateCommutative(path: NodePath<t.BinaryExpression>, op: Commu
   }
   // Grouping constants can move one operand's coercion past another operand's
   // evaluation. Multiple non-constant operands must therefore be pure.
-  if (others.length > 1 && !others.every((leaf) => isPure(leaf, path.scope, path))) {
+  if (others.length > 1 && !others.every((leaf) => isPure(leaf, path.scope))) {
     return false
   }
 
@@ -293,7 +296,7 @@ function tryReassociateSubtract(path: NodePath<t.BinaryExpression>): boolean {
   }
   // Reassociation can move `base` coercion past a subtractee's evaluation.
   // Non-constant subtractees must be pure.
-  if (!otherSubs.every((leaf) => isPure(leaf, path.scope, path))) {
+  if (!otherSubs.every((leaf) => isPure(leaf, path.scope))) {
     return false
   }
   const sum = combineConstants(constSubs, '+')

package/src/transforms/function-declaration-to-expression.ts

@@ -6,14 +6,13 @@ import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Rewrites safe function declarations as `var` initializers. The function value
- * is no longer hoisted, so nothing may observe the binding before assignment.
+ * Rewrites function declarations at script top level or directly inside a
+ * function body as `var` initializers. It leaves a declaration unchanged when
+ * an earlier statement could execute user code before the assignment.
  *
- * Preceding statements must be inert. Name inference and recursive references
- * still use the `var` binding.
+ * Name inference and recursive references still use the `var` binding.
  *
- * Block-level declarations and module top-level declarations stay unchanged due
- * to Annex B aliases and live exports.
+ * Block-level and module top-level declarations stay unchanged.
  *
  * @example
  * // ◀️ before

package/src/transforms/hoist-variables.ts

@@ -0,0 +1,262 @@
+import traverse from '@babel/traverse'
+import type { NodePath } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import type { ChangeState } from '../utils/change-tracking'
+
+/**
+ * Moves `var` declarations to the start of their var scope without moving
+ * initializer evaluation.
+ *
+ * Direct exports stay in place. Static blocks keep separate declarations.
+ *
+ * @example
+ * // ◀️ before
+ * function f() {
+ *   var x = 1;
+ *   if (c) {
+ *     var y = g();
+ *   }
+ *   return x + y;
+ * }
+ *
+ * // ▶️ after
+ * function f() {
+ *   var x, y;
+ *   x = 1;
+ *   if (c) {
+ *     y = g();
+ *   }
+ *   return x + y;
+ * }
+ */
+export function hoistVariables(ast: File): boolean {
+  const state: HoistState = {
+    changed: false,
+    scopes: new Map(),
+  }
+  traverse(ast, {
+    VariableDeclaration(path) {
+      if (path.node.kind !== 'var' || path.parentPath.isExportNamedDeclaration()) {
+        return
+      }
+      const owner = ownerPath(path)
+      if (owner === null) {
+        return
+      }
+
+      const scope = hoistedScope(state.scopes, owner)
+      addNames(scope.names, path.getBindingIdentifiers())
+      if (scope.declaration?.node === path.node) {
+        return
+      }
+
+      demoteDeclaration(path)
+      scope.changed = true
+      state.changed = true
+    },
+  })
+
+  for (const scope of state.scopes.values()) {
+    if (scope.changed) {
+      finishDeclaration(scope)
+    }
+  }
+
+  return state.changed
+}
+
+type OwnerPath = NodePath<t.Function | t.Program | t.StaticBlock>
+
+interface HoistState extends ChangeState {
+  scopes: Map<t.Node, HoistedScope>
+}
+
+interface HoistedScope {
+  changed: boolean
+  declaration: NodePath<t.VariableDeclaration> | null
+  names: Map<string, t.Identifier>
+  owner: OwnerPath
+}
+
+function ownerPath(path: NodePath<t.VariableDeclaration>): OwnerPath | null {
+  let current: NodePath | null = path.parentPath
+  while (current) {
+    if (current.isStaticBlock()) {
+      return current as OwnerPath
+    }
+    if (current.isProgram()) {
+      return current as OwnerPath
+    }
+    if (t.isFunction(current.node) && t.isBlockStatement(current.node.body)) {
+      return current as OwnerPath
+    }
+    current = current.parentPath
+  }
+  return null
+}
+
+function hoistedScope(scopes: Map<t.Node, HoistedScope>, owner: OwnerPath): HoistedScope {
+  const existing = scopes.get(owner.node)
+  if (existing) {
+    return existing
+  }
+
+  const declaration = leadingBareDeclaration(owner)
+  const scope: HoistedScope = {
+    changed: false,
+    declaration,
+    names: new Map(),
+    owner,
+  }
+  if (declaration) {
+    addNames(scope.names, declaration.getBindingIdentifiers())
+  }
+  scopes.set(owner.node, scope)
+  return scope
+}
+
+function leadingBareDeclaration(owner: OwnerPath): NodePath<t.VariableDeclaration> | null {
+  const first = ownerBody(owner)[0]
+  if (!first?.isVariableDeclaration({ kind: 'var' })) {
+    return null
+  }
+  return first.node.declarations.every((declarator) => declarator.init == null) ? first : null
+}
+
+function ownerBody(owner: OwnerPath): NodePath<t.Statement>[] {
+  if (owner.isFunction()) {
+    const body = owner.get('body')
+    return body.isBlockStatement() ? (body.get('body') as NodePath<t.Statement>[]) : []
+  }
+  return owner.get('body') as NodePath<t.Statement>[]
+}
+
+function demoteDeclaration(path: NodePath<t.VariableDeclaration>): void {
+  const parent = path.parentPath
+  if (parent.isForStatement() && path.key === 'init') {
+    demoteForInit(path)
+    return
+  }
+  if ((parent.isForInStatement() || parent.isForOfStatement()) && path.key === 'left') {
+    demoteForX(path, parent)
+    return
+  }
+
+  const assignments = initializerAssignments(path.node).map((expression) =>
+    t.expressionStatement(expression),
+  )
+
+  if (typeof path.listKey === 'string') {
+    if (assignments.length === 0) {
+      path.remove()
+    } else {
+      path.replaceWithMultiple(assignments)
+    }
+    return
+  }
+  if (assignments.length === 0) {
+    path.replaceWith(t.emptyStatement())
+  } else if (assignments.length === 1) {
+    path.replaceWith(assignments[0]!)
+  } else {
+    path.replaceWith(t.blockStatement(assignments))
+  }
+}
+
+function demoteForInit(path: NodePath<t.VariableDeclaration>): void {
+  const assignments = initializerAssignments(path.node)
+  if (assignments.length === 0) {
+    path.remove()
+    return
+  }
+  const replacement = assignments.length === 1 ? assignments[0]! : t.sequenceExpression(assignments)
+  path.replaceWith(replacement)
+}
+
+function demoteForX(
+  path: NodePath<t.VariableDeclaration>,
+  parent: NodePath<t.ForInStatement | t.ForOfStatement>,
+): void {
+  const declarator = path.node.declarations[0]!
+  const target = declarator.id as t.ArrayPattern | t.Identifier | t.ObjectPattern
+  if (declarator.init) {
+    const assignment = initializerAssignment(declarator, target)
+    const right = parent.get('right') as NodePath<t.Expression>
+    right.replaceWith(t.sequenceExpression([assignment, right.node]))
+  }
+  path.replaceWith(t.cloneNode(target))
+}
+
+function initializerAssignments(node: t.VariableDeclaration): t.AssignmentExpression[] {
+  const assignments: t.AssignmentExpression[] = []
+  for (const declarator of node.declarations) {
+    if (declarator.init != null) {
+      const target = declarator.id as t.ArrayPattern | t.Identifier | t.ObjectPattern
+      assignments.push(initializerAssignment(declarator, target))
+    }
+  }
+  return assignments
+}
+
+function initializerAssignment(
+  declarator: t.VariableDeclarator,
+  target: t.ArrayPattern | t.Identifier | t.ObjectPattern,
+): t.AssignmentExpression {
+  return t.assignmentExpression('=', t.cloneNode(target), declarator.init!)
+}
+
+function addNames(
+  names: Map<string, t.Identifier>,
+  identifiers: Record<string, t.Identifier>,
+): void {
+  for (const [name, identifier] of Object.entries(identifiers)) {
+    if (!names.has(name)) {
+      names.set(name, identifier)
+    }
+  }
+}
+
+function finishDeclaration(scope: HoistedScope): void {
+  const existingNames = new Set<string>()
+  if (scope.declaration) {
+    for (const name of Object.keys(scope.declaration.getBindingIdentifiers())) {
+      existingNames.add(name)
+    }
+  }
+  const declarators = [...scope.names]
+    .filter(([name]) => !existingNames.has(name))
+    .map(([, identifier]) => t.variableDeclarator(t.cloneNode(identifier)))
+
+  if (scope.declaration) {
+    if (declarators.length > 0) {
+      scope.declaration.pushContainer('declarations', declarators)
+    }
+    return
+  }
+
+  if (declarators.length === 0) {
+    return
+  }
+
+  const declaration = t.variableDeclaration('var', declarators)
+  insertDeclaration(scope.owner, declaration)
+}
+
+function insertDeclaration(owner: OwnerPath, declaration: t.VariableDeclaration): void {
+  if (owner.isFunction()) {
+    const body = owner.get('body')
+    if (body.isBlockStatement()) {
+      body.unshiftContainer('body', declaration)
+    }
+    return
+  }
+  if (owner.isProgram()) {
+    owner.unshiftContainer('body', declaration)
+    return
+  }
+  if (owner.isStaticBlock()) {
+    owner.unshiftContainer('body', declaration)
+  }
+}