webfuscator 1.2.1 → 1.3.1

package/src/transforms/update-to-assignment.ts

@@ -2,7 +2,6 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isDirectEvalCall, isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -44,18 +43,10 @@ const visitor: Visitor<ChangeState> = {
     if (!prefix && !valueIsDiscarded(path)) {
       return
     }
-    // `with` can retarget the name and defeat the numeric proof.
-    if (isInsideWith(path)) {
-      return
-    }
     const binding = path.scope.getBinding(argument.name)
     if (!isNumericBinding(binding)) {
       return
     }
-    // Direct eval anywhere in the binding's scope can change its type.
-    if (bindingScopeReachesDirectEval(binding!)) {
-      return
-    }
     const compound = operator === '++' ? '+=' : '-='
     path.replaceWith(t.assignmentExpression(compound, argument, t.numericLiteral(1)))
     state.changed = true
@@ -79,34 +70,25 @@ function valueIsDiscarded(path: NodePath<t.UpdateExpression>): boolean {
   return false
 }
 
-// The initializer and every mutation must keep the binding numeric.
+// Mutable bindings must stay numeric. A const write cannot change its value.
 function isNumericBinding(binding: Binding | undefined): boolean {
-  if (!binding || (binding.kind !== 'var' && binding.kind !== 'let')) {
+  if (!binding || (binding.kind !== 'var' && binding.kind !== 'let' && binding.kind !== 'const')) {
     return false
   }
   const declarator = binding.path.node
   if (!t.isVariableDeclarator(declarator) || !t.isNumericLiteral(declarator.init)) {
     return false
   }
-  // Babel misses the string writes from an Annex B `for-in` initializer.
+  // Babel does not record each value assigned by a `for-in` or `for-of` head.
   if (isForInOfLoopVariable(binding)) {
     return false
   }
+  if (binding.kind === 'const') {
+    return true
+  }
   return binding.constantViolations.every((violation) => keepsNumeric(violation.node))
 }
 
-// A sibling or nested direct eval can still close over and reassign the binding.
-function bindingScopeReachesDirectEval(binding: Binding): boolean {
-  let found = false
-  t.traverseFast(binding.scope.block, (node) => {
-    if (isDirectEvalCall(node)) {
-      found = true
-    }
-    return found ? t.traverseFast.stop : undefined
-  })
-  return found
-}
-
 function isForInOfLoopVariable(binding: Binding): boolean {
   const declaration = binding.path.parentPath
   if (!declaration || !declaration.isVariableDeclaration()) {

package/src/transforms/yodify-conditions.ts

@@ -7,10 +7,9 @@ import type { ChangeState } from '../utils/change-tracking'
 import { isLiteralShaped } from '../utils/literal'
 
 /**
- * Moves a safe literal-shaped right operand to the left of a comparison.
- * Relational operators are flipped after swapping.
- *
- * Unary operations over literals also count when their coercion cannot act.
+ * Moves a right operand made from literals and unary operators to the left of a
+ * comparison when swapping does not change coercion order. Relational operators
+ * are flipped after swapping.
  *
  * @example
  * // ◀️ before

package/src/utils/ast.ts

@@ -62,75 +62,10 @@ export function isProtoKey(key: t.Node): boolean {
   )
 }
 
-// `with` can shadow names outside Babel's scope table.
-export function isInsideWith(path: NodePath): boolean {
-  if (!programContains(path.scope.getProgramParent().block, programWith, t.isWithStatement)) {
-    return false
-  }
-  return path.findParent((ancestor) => ancestor.isWithStatement()) !== null
-}
-
-// Direct eval can access local bindings by name. Indirect eval runs globally and
-// does not count.
-export function enclosingScopeHasDirectEval(path: NodePath): boolean {
-  if (!programContains(path.scope.getProgramParent().block, programDirectEval, isDirectEvalCall)) {
-    return false
-  }
-  let current: NodePath | null = path
-  while (current) {
-    if ((current.isFunction() || current.isProgram()) && ownScopeHasDirectEval(current.node)) {
-      return true
-    }
-    current = current.parentPath
-  }
-  return false
-}
-
-// Cache program-wide `eval` and `with` checks to avoid a subtree walk per name.
-// No transform creates either construct, so a negative result stays valid.
-const programDirectEval = new WeakMap<t.Node, boolean>()
-const programWith = new WeakMap<t.Node, boolean>()
-
-function programContains(
-  programNode: t.Node,
-  cache: WeakMap<t.Node, boolean>,
-  matches: (node: t.Node) => boolean,
-): boolean {
-  const cached = cache.get(programNode)
-  if (cached !== undefined) {
-    return cached
-  }
-  let found = false
-  t.traverseFast(programNode, (node) => {
-    if (!matches(node)) {
-      return
-    }
-    found = true
-    return t.traverseFast.stop
-  })
-  cache.set(programNode, found)
-  return found
-}
-
-function ownScopeHasDirectEval(owner: t.Node): boolean {
-  let found = false
-  // This walk stops at the first hit, unlike `walkOwnFunctionScope`.
-  t.traverseFast(owner, (node) => {
-    if (isDirectEvalCall(node)) {
-      found = true
-      return t.traverseFast.stop
-    }
-    return node !== owner && t.isFunction(node) ? t.traverseFast.skip : undefined
-  })
-  return found
-}
-
-export function isDirectEvalCall(node: t.Node): boolean {
-  // `eval?.(...)` is an OptionalCallExpression yet still a direct eval, so both
-  // call node shapes count.
+// A non-computed key names a property; it is not a runtime value.
+export function isNonComputedKey(path: NodePath): boolean {
+  const parent = path.parent
   return (
-    (t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
-    t.isIdentifier(node.callee) &&
-    node.callee.name === 'eval'
+    'key' in parent && parent.key === path.node && 'computed' in parent && parent.computed === false
   )
 }

package/src/utils/evaluation-order.ts

@@ -133,7 +133,7 @@ function precedingSiblings<T extends NodePath>(
 }
 
 function isPurePath(path: NodePath): boolean {
-  return isPure(path.node, path.scope, path)
+  return isPure(path.node, path.scope)
 }
 
 function impure(paths: (NodePath | null | undefined)[]): boolean {

package/src/utils/literal.ts

@@ -1,5 +1,9 @@
+import generate from '@babel/generator'
 import * as t from '@babel/types'
 
+const MAX_GENERATED_LITERAL_LENGTH = 8192
+const MAX_LITERAL_DEPTH = 32
+const MAX_LITERAL_NODES = 512
 const MAX_STRING_LITERAL_LENGTH = 4096
 
 // RegExp literals allocate mutable objects and are not primitive values.
@@ -45,19 +49,56 @@ function literalShapeKind(node: t.Node): 'bigint' | 'other' | null {
 }
 
 export function valueToLiteral(value: unknown): t.Expression | null {
+  const literal = buildValueLiteral(value, new Set(), { nodesRemaining: MAX_LITERAL_NODES }, 0)
+  if (!literal || generate(literal).code.length > MAX_GENERATED_LITERAL_LENGTH) {
+    return null
+  }
+  return literal
+}
+
+interface LiteralBudget {
+  nodesRemaining: number
+}
+
+function reserveLiteralNodes(budget: LiteralBudget, count: number): boolean {
+  if (budget.nodesRemaining < count) {
+    return false
+  }
+  budget.nodesRemaining -= count
+  return true
+}
+
+function buildValueLiteral(
+  value: unknown,
+  seen: Set<object>,
+  budget: LiteralBudget,
+  depth: number,
+): t.Expression | null {
+  if (depth > MAX_LITERAL_DEPTH) {
+    return null
+  }
   if (typeof value === 'string') {
-    if (value.length > MAX_STRING_LITERAL_LENGTH) {
+    if (value.length > MAX_STRING_LITERAL_LENGTH || !reserveLiteralNodes(budget, 1)) {
       return null
     }
     return t.stringLiteral(value)
   }
   if (typeof value === 'boolean') {
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.booleanLiteral(value)
   }
   if (value === null) {
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.nullLiteral()
   }
   if (value === undefined) {
+    if (!reserveLiteralNodes(budget, 2)) {
+      return null
+    }
     // `void 0` cannot be shadowed like the identifier `undefined`.
     return t.unaryExpression('void', t.numericLiteral(0))
   }
@@ -65,8 +106,14 @@ export function valueToLiteral(value: unknown): t.Expression | null {
     // A UnaryExpression lets the generator parenthesize negative BigInt where
     // precedence requires it.
     if (value < 0n) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.bigIntLiteral(-value))
     }
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.bigIntLiteral(value)
   }
   if (typeof value === 'number') {
@@ -74,17 +121,30 @@ export function valueToLiteral(value: unknown): t.Expression | null {
       return null
     }
     if (Object.is(value, -0)) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.numericLiteral(0))
     }
     if (value < 0) {
+      if (!reserveLiteralNodes(budget, 2)) {
+        return null
+      }
       return t.unaryExpression('-', t.numericLiteral(-value))
     }
+    if (!reserveLiteralNodes(budget, 1)) {
+      return null
+    }
     return t.numericLiteral(value)
   }
   if (Array.isArray(value)) {
+    if (seen.has(value) || !arrayHasLiteralShape(value) || !reserveLiteralNodes(budget, 1)) {
+      return null
+    }
+    seen.add(value)
     const elements: t.Expression[] = []
     for (const item of value) {
-      const lit = valueToLiteral(item)
+      const lit = buildValueLiteral(item, seen, budget, depth + 1)
       if (!lit) {
         return null
       }
@@ -94,3 +154,32 @@ export function valueToLiteral(value: unknown): t.Expression | null {
   }
   return null
 }
+
+function arrayHasLiteralShape(value: unknown[]): boolean {
+  if (Object.getPrototypeOf(value) !== Array.prototype || !Object.isExtensible(value)) {
+    return false
+  }
+  const names = Object.getOwnPropertyNames(value)
+  if (names.length !== value.length + 1 || names.at(-1) !== 'length') {
+    return false
+  }
+  for (let index = 0; index < value.length; index++) {
+    if (
+      names[index] !== String(index) ||
+      !isOrdinaryDataProperty(Object.getOwnPropertyDescriptor(value, String(index)))
+    ) {
+      return false
+    }
+  }
+  return Object.getOwnPropertySymbols(value).length === 0
+}
+
+function isOrdinaryDataProperty(descriptor: PropertyDescriptor | undefined): boolean {
+  return (
+    descriptor !== undefined &&
+    'value' in descriptor &&
+    descriptor.configurable === true &&
+    descriptor.enumerable === true &&
+    descriptor.writable === true
+  )
+}

package/src/utils/logical-lowering.ts

@@ -9,7 +9,7 @@ import { isStandaloneDeclaration } from './paths'
 //   x = L;
 //   if (<fallbackTest(x)>) x = R;
 //
-// `fallbackTest` selects `!x`, `x`, or `x == null`. The parent must accept a
+// `fallbackTest` selects the short-circuit condition. The parent must accept a
 // multi-statement replacement.
 export function lowerLogicalWriteStatement(
   path: NodePath<t.LogicalExpression>,
@@ -29,21 +29,20 @@ export function lowerLogicalWriteStatement(
     const declStmt = parent.parentPath
     if (
       !declStmt?.isVariableDeclaration() ||
-      // The split would emit illegal `const x;` and then write it.
-      declStmt.node.kind === 'const' ||
       declStmt.node.declarations.length !== 1 ||
       !isStandaloneDeclaration(declStmt)
     ) {
       return false
     }
     const target = parent.node.id
-    // The split writes `x` before evaluating the right side. Refuse any right
-    // side that could observe the new value or the ended TDZ.
-    if (rightCanObserveTarget(node.right, target.name)) {
+    // A `var` initializer can observe its previous value while evaluating the
+    // right side. Reads before lexical initialization are intentionally ignored.
+    if (declStmt.node.kind === 'var' && rightCanObserveTarget(node.right, target.name)) {
       return false
     }
+    const declarationKind = declStmt.node.kind === 'const' ? 'let' : declStmt.node.kind
     declStmt.replaceWithMultiple([
-      t.variableDeclaration(declStmt.node.kind, [
+      t.variableDeclaration(declarationKind, [
         t.variableDeclarator(t.cloneNode(target), node.left),
       ]),
       guardedReassignment(target, fallbackTest, node.right),
@@ -68,10 +67,7 @@ export function lowerLogicalWriteStatement(
       return false
     }
     // Writing first would change `x = 0 || x` before the right side reads `x`.
-    if (
-      !isSideEffectFree(node.right, path.scope, path) ||
-      referencesName(node.right, target.name)
-    ) {
+    if (!isSideEffectFree(node.right, path.scope) || referencesName(node.right, target.name)) {
       return false
     }
     exprStmt.replaceWithMultiple([

package/src/utils/nullish.ts

@@ -0,0 +1,23 @@
+import * as t from '@babel/types'
+
+export function buildNullishCheck(
+  firstRead: t.Expression,
+  secondRead: t.Expression,
+): t.ConditionalExpression {
+  return t.conditionalExpression(
+    t.binaryExpression('===', firstRead, t.nullLiteral()),
+    t.booleanLiteral(true),
+    t.binaryExpression('===', secondRead, t.unaryExpression('void', t.numericLiteral(0))),
+  )
+}
+
+export function buildNonNullishCheck(
+  firstRead: t.Expression,
+  secondRead: t.Expression,
+): t.ConditionalExpression {
+  return t.conditionalExpression(
+    t.binaryExpression('!==', firstRead, t.nullLiteral()),
+    t.binaryExpression('!==', secondRead, t.unaryExpression('void', t.numericLiteral(0))),
+    t.booleanLiteral(false),
+  )
+}

package/src/utils/paths.ts

@@ -69,35 +69,3 @@ export function isInStrictContext(path: NodePath): boolean {
 function hasUseStrictDirective(directives: readonly t.Directive[]): boolean {
   return directives.some((directive) => directive.value.value === 'use strict')
 }
-
-// ECMA-262 B.3.3 gives sloppy block-level functions a `var` alias that Babel
-// omits from the enclosing scope. Renaming, moving, or removing one can expose it.
-export function hasAnnexBFunctionAlias(path: NodePath): boolean {
-  if (!path.isFunctionDeclaration()) {
-    return false
-  }
-  const parent = path.parentPath
-  if (!parent || parent.isProgram()) {
-    return false
-  }
-  if (
-    parent.isBlockStatement() &&
-    parent.key === 'body' &&
-    parent.parentPath != null &&
-    parent.parentPath.isFunction()
-  ) {
-    return false
-  }
-  return !isInStrictContext(parent)
-}
-
-// A later write to `const` must keep throwing after transformation.
-export function hasConstantViolation(path: NodePath<t.VariableDeclaration>): boolean {
-  for (const name of Object.keys(path.getBindingIdentifiers())) {
-    const binding = path.scope.getBinding(name)
-    if (binding && binding.constantViolations.length > 0) {
-      return true
-    }
-  }
-  return false
-}

package/src/utils/statement-lists.ts

@@ -0,0 +1,45 @@
+import type { NodePath } from '@babel/traverse'
+import type * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { traverseForChanges } from './change-tracking'
+import type { ChangeState } from './change-tracking'
+
+export type StatementListContainer = t.Program | t.BlockStatement | t.StaticBlock | t.SwitchCase
+
+type Rewrite = (
+  statements: NodePath<t.Statement>[],
+  container: NodePath<StatementListContainer>,
+) => t.Statement[] | null
+
+/** Applies a rewrite to every statement-list container in the AST. */
+export function rewriteStatementLists(ast: File, rewrite: Rewrite): boolean {
+  return traverseForChanges(ast, {
+    Program(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    BlockStatement(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    StaticBlock(path, state) {
+      apply(path, 'body', rewrite, state)
+    },
+    SwitchCase(path, state) {
+      apply(path, 'consequent', rewrite, state)
+    },
+  })
+}
+
+function apply(
+  container: NodePath<StatementListContainer>,
+  key: 'body' | 'consequent',
+  rewrite: Rewrite,
+  state: ChangeState,
+): void {
+  const statements = container.get(key) as NodePath<t.Statement>[]
+  const replacement = rewrite(statements, container)
+  if (replacement) {
+    container.set(key, replacement)
+    state.changed = true
+  }
+}