webfuscator 1.3.0 → 1.3.1

package/src/analysis/inlineability.ts

@@ -3,7 +3,7 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { hasAnnexBFunctionAlias, referencesOrWritesVariable } from '../utils/paths'
+import { referencesOrWritesVariable } from '../utils/paths'
 
 export interface InlineCandidate {
   name: string
@@ -30,10 +30,6 @@ export function analyzeInlineability(ast: File): Map<string, InlineCandidate> {
       if (!path.node.id) {
         return
       }
-      // Babel misses the sloppy Annex B `var` alias of a block-level function.
-      if (hasAnnexBFunctionAlias(path)) {
-        return
-      }
       const binding = path.scope.getBinding(path.node.id.name)
       if (!binding) {
         return
@@ -131,9 +127,9 @@ function checkCandidate(
   if (!t.isBlockStatement(fnNode.body)) {
     return null
   }
-  // Writes live in `constantViolations`, not `referencePaths`. Any write can
-  // make a call resolve to a different function.
-  if (binding.constantViolations.length > 0) {
+  // Writes to mutable bindings live in `constantViolations`, not
+  // `referencePaths`, and can make a call resolve to a different function.
+  if (binding.kind !== 'const' && binding.constantViolations.length > 0) {
     return null
   }
   // Splicing loses a named function expression's inner binding.
@@ -273,10 +269,6 @@ const analyzeBodyVisitor: Visitor<AnalyzeBodyState> = {
       path.stop()
     }
   },
-  WithStatement(path, state) {
-    state.unsafe = true
-    path.stop()
-  },
   Identifier(path, state) {
     const name = path.node.name
     if (state.innerFnDepth === 0 && name === 'arguments') {

package/src/analysis/purity.ts

@@ -1,18 +1,11 @@
-import type { Binding, NodePath, Scope } from '@babel/traverse'
+import type { Scope } from '@babel/traverse'
 import * as t from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
 import { isPrimitiveLiteral } from '../utils/literal'
-import {
-  declarationReaches,
-  initializerReaches,
-  readCrossesFunctionBoundary,
-} from './document-order'
 
 // Purity also requires deterministic repetition and no throw. Identifier reads
-// need scope and reference paths to prove resolution, initialization, and the
-// absence of `with` interception.
-export function isPure(node: t.Node, scope?: Scope, referencePath?: NodePath): boolean {
+// need scope to prove resolution.
+export function isPure(node: t.Node, scope?: Scope): boolean {
   if (
     t.isNumericLiteral(node) ||
     t.isStringLiteral(node) ||
@@ -25,7 +18,7 @@ export function isPure(node: t.Node, scope?: Scope, referencePath?: NodePath): b
     return true
   }
   if (t.isIdentifier(node)) {
-    return identifierReadIsSafe(node, scope, referencePath)
+    return identifierReadIsSafe(node, scope)
   }
   if (t.isTemplateLiteral(node)) {
     // ToString can call object code or throw on Symbol.
@@ -39,7 +32,7 @@ export function isPure(node: t.Node, scope?: Scope, referencePath?: NodePath): b
   if (t.isUnaryExpression(node)) {
     // Numeric unary operators invoke ToPrimitive. `delete` and `throw` act.
     if (node.operator === '!' || node.operator === 'typeof' || node.operator === 'void') {
-      return isPure(node.argument, scope, referencePath)
+      return isPure(node.argument, scope)
     }
     return false
   }
@@ -47,7 +40,7 @@ export function isPure(node: t.Node, scope?: Scope, referencePath?: NodePath): b
     if (!t.isExpression(node.left)) {
       return false
     }
-    if (!isPure(node.left, scope, referencePath) || !isPure(node.right, scope, referencePath)) {
+    if (!isPure(node.left, scope) || !isPure(node.right, scope)) {
       return false
     }
     // Only strict equality avoids coercion. Other operators need safe literals.
@@ -57,18 +50,16 @@ export function isPure(node: t.Node, scope?: Scope, referencePath?: NodePath): b
     return coercesWithoutEffect(node.left, node.right, node.operator)
   }
   if (t.isLogicalExpression(node)) {
-    return isPure(node.left, scope, referencePath) && isPure(node.right, scope, referencePath)
+    return isPure(node.left, scope) && isPure(node.right, scope)
   }
   if (t.isConditionalExpression(node)) {
     return (
-      isPure(node.test, scope, referencePath) &&
-      isPure(node.consequent, scope, referencePath) &&
-      isPure(node.alternate, scope, referencePath)
+      isPure(node.test, scope) && isPure(node.consequent, scope) && isPure(node.alternate, scope)
     )
   }
   if (t.isSequenceExpression(node)) {
     for (const expr of node.expressions) {
-      if (!isPure(expr, scope, referencePath)) {
+      if (!isPure(expr, scope)) {
         return false
       }
     }
@@ -77,8 +68,9 @@ export function isPure(node: t.Node, scope?: Scope, referencePath?: NodePath): b
   return false
 }
 
-// A droppable identifier read must resolve after binding initialization.
-export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: NodePath): boolean {
+// A droppable identifier read must resolve to a local binding or immutable
+// global `undefined`.
+export function isSideEffectFree(node: t.Node, scope?: Scope): boolean {
   if (
     t.isNumericLiteral(node) ||
     t.isStringLiteral(node) ||
@@ -99,7 +91,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
     return true
   }
   if (t.isIdentifier(node)) {
-    return identifierReadIsSafe(node, scope, referencePath)
+    return identifierReadIsSafe(node, scope)
   }
   if (t.isFunctionExpression(node) || t.isArrowFunctionExpression(node)) {
     return true
@@ -107,7 +99,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
   if (t.isClassExpression(node)) {
     // `extends` and computed keys run during class definition.
     if (node.superClass) {
-      if (!isSideEffectFree(node.superClass, scope, referencePath)) {
+      if (!isSideEffectFree(node.superClass, scope)) {
         return false
       }
       // ClassDefinitionEvaluation accepts only `null` or a constructor.
@@ -127,7 +119,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
         'computed' in member &&
         member.computed &&
         'key' in member &&
-        !isSideEffectFree(member.key, scope, referencePath)
+        !isSideEffectFree(member.key, scope)
       ) {
         return false
       }
@@ -142,7 +134,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
       if (t.isSpreadElement(element)) {
         return false
       }
-      if (!isSideEffectFree(element, scope, referencePath)) {
+      if (!isSideEffectFree(element, scope)) {
         return false
       }
     }
@@ -154,7 +146,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
         return false
       }
       if (t.isObjectMethod(prop)) {
-        if (prop.computed && !isSideEffectFree(prop.key, scope, referencePath)) {
+        if (prop.computed && !isSideEffectFree(prop.key, scope)) {
           return false
         }
         continue
@@ -162,13 +154,13 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
       if (!t.isObjectProperty(prop)) {
         return false
       }
-      if (prop.computed && !isSideEffectFree(prop.key, scope, referencePath)) {
+      if (prop.computed && !isSideEffectFree(prop.key, scope)) {
         return false
       }
       if (!t.isExpression(prop.value)) {
         return false
       }
-      if (!isSideEffectFree(prop.value, scope, referencePath)) {
+      if (!isSideEffectFree(prop.value, scope)) {
         return false
       }
     }
@@ -179,7 +171,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
       return false
     }
     if (node.operator === '!' || node.operator === 'typeof' || node.operator === 'void') {
-      return isSideEffectFree(node.argument, scope, referencePath)
+      return isSideEffectFree(node.argument, scope)
     }
     return false
   }
@@ -187,10 +179,7 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
     if (!t.isExpression(node.left)) {
       return false
     }
-    if (
-      !isSideEffectFree(node.left, scope, referencePath) ||
-      !isSideEffectFree(node.right, scope, referencePath)
-    ) {
+    if (!isSideEffectFree(node.left, scope) || !isSideEffectFree(node.right, scope)) {
       return false
     }
     // Coercing operators need compatible literals that cannot throw.
@@ -200,21 +189,18 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
     return coercesWithoutEffect(node.left, node.right, node.operator)
   }
   if (t.isLogicalExpression(node)) {
-    return (
-      isSideEffectFree(node.left, scope, referencePath) &&
-      isSideEffectFree(node.right, scope, referencePath)
-    )
+    return isSideEffectFree(node.left, scope) && isSideEffectFree(node.right, scope)
   }
   if (t.isConditionalExpression(node)) {
     return (
-      isSideEffectFree(node.test, scope, referencePath) &&
-      isSideEffectFree(node.consequent, scope, referencePath) &&
-      isSideEffectFree(node.alternate, scope, referencePath)
+      isSideEffectFree(node.test, scope) &&
+      isSideEffectFree(node.consequent, scope) &&
+      isSideEffectFree(node.alternate, scope)
     )
   }
   if (t.isSequenceExpression(node)) {
     for (const expr of node.expressions) {
-      if (!isSideEffectFree(expr, scope, referencePath)) {
+      if (!isSideEffectFree(expr, scope)) {
         return false
       }
     }
@@ -223,43 +209,13 @@ export function isSideEffectFree(node: t.Node, scope?: Scope, referencePath?: No
   return false
 }
 
-// A safe read needs a resolved, initialized binding outside `with`. Unbound
-// `undefined` is safe because the global property is immutable.
-function identifierReadIsSafe(
-  node: t.Identifier,
-  scope: Scope | undefined,
-  referencePath: NodePath | undefined,
-): boolean {
-  // A `with` property can shadow any name, including `undefined`.
-  if (referencePath && isInsideWith(referencePath)) {
-    return false
-  }
+// Unbound `undefined` is safe because the global property is immutable.
+function identifierReadIsSafe(node: t.Identifier, scope: Scope | undefined): boolean {
   const isUndefinedName = node.name === 'undefined'
   if (!scope) {
     return isUndefinedName
   }
-  const binding = scope.getBinding(node.name)
-  if (!binding) {
-    return isUndefinedName
-  }
-  if (t.isFunctionDeclaration(binding.path.node) || binding.kind === 'module') {
-    return true
-  }
-  if (binding.kind === 'param') {
-    // Earlier parameter defaults can read later parameters in TDZ.
-    if (!referencePath || !readIsInOwnParamList(binding, referencePath)) {
-      return true
-    }
-    return declarationReaches(binding.path, referencePath)
-  }
-  // Lexical reads need an unconditionally reached declaration in the same call.
-  if (isLexicalBinding(binding)) {
-    if (referencePath && readCrossesFunctionBoundary(binding, referencePath)) {
-      return false
-    }
-    return initializerReaches(binding.path, referencePath)
-  }
-  return declarationReaches(binding.path, referencePath)
+  return scope.getBinding(node.name) !== undefined || isUndefinedName
 }
 
 // Only `null` and plain function expressions are known-valid superclass values.
@@ -294,22 +250,3 @@ function coercesWithoutEffect(left: t.Node, right: t.Node, operator: string): bo
   }
   return leftKind !== 'bigint' || !THROWING_BIGINT_OPERATORS.has(operator)
 }
-
-function isLexicalBinding(binding: Binding): boolean {
-  return (
-    binding.kind === 'let' || binding.kind === 'const' || t.isClassDeclaration(binding.path.node)
-  )
-}
-
-function readIsInOwnParamList(binding: Binding, referencePath: NodePath): boolean {
-  const owner = binding.scope.block
-  let current: NodePath | null = referencePath
-  while (current) {
-    const parent: NodePath | null = current.parentPath
-    if (parent && parent.node === owner && current.listKey === 'params') {
-      return true
-    }
-    current = parent
-  }
-  return false
-}

package/src/preparation/expand-destructuring.ts

@@ -3,8 +3,6 @@ import type { NodePath, Scope } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
-
 type Kind = t.VariableDeclaration['kind']
 
 // Babel 8 omits `AssignmentPattern` from `LVal`, so list these targets directly.
@@ -18,9 +16,8 @@ type BindingTarget = t.Identifier | t.ObjectPattern | t.ArrayPattern | t.Assignm
  * The source, computed keys, and getters keep their original evaluation counts.
  * Defaults compare against `void 0` because `undefined` can be shadowed.
  *
- * Patterns inside `with` stay untouched because an object property can capture
- * a generated temporary. The `RequireObjectCoercible` guard runs before computed
- * keys to preserve ObjectBindingPattern evaluation order.
+ * The `RequireObjectCoercible` guard runs before computed keys to preserve
+ * ObjectBindingPattern evaluation order.
  *
  * @example
  * // ◀️ before
@@ -42,11 +39,6 @@ const visitor = {
     if (typeof path.listKey !== 'string') {
       return
     }
-    // A `with` property can capture the generated temporary.
-    if (isInsideWith(path)) {
-      return
-    }
-
     const kind = path.node.kind
     const replacement: t.Statement[] = []
     let changed = false

package/src/transforms/arguments-to-parameters.ts

@@ -8,10 +8,11 @@ import type { ChangeState } from '../utils/change-tracking'
 import { isInStrictContext } from '../utils/paths'
 
 /**
- * Replaces `arguments[i]` reads with their mapped parameter in sloppy functions
- * with simple parameter lists. Writes, deletion, reassigned parameters, and any
- * escape of the arguments object make the mapping unsafe. Missing parameters
- * are never added because that would change `fn.length`.
+ * Replaces numeric `arguments[i]` reads with the corresponding parameter in
+ * sloppy functions with simple parameter lists. It leaves a read unchanged when
+ * that index is written or its parameter is reassigned. Reassigning, deleting,
+ * or passing around `arguments` disables the rewrite. Missing parameters are
+ * never added because that would change `fn.length`.
  *
  * @example
  * // ◀️ before

package/src/transforms/arrow-to-function.ts

@@ -2,14 +2,14 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Lowers arrows with Babel's capture-aware `arrowFunctionToExpression`. Arrows
- * that reach `super` stay intact. Values that escape visible call positions also
- * stay intact because only the arrow rejects construction with `new`.
+ * Converts arrows with Babel's capture-aware `arrowFunctionToExpression`.
+ * Arrows that use `super` stay unchanged. An arrow also stays unchanged unless
+ * every use is an immediate call or a discarded expression, because a normal
+ * function can be constructed with `new` and has a `prototype`.
  *
  * @example
  * // ◀️ before
@@ -64,9 +64,7 @@ const visitor: Visitor<ChangeState> = {
       !valueStaysInView(path) ||
       arrowReferencesSuper(path) ||
       inUnsafeCaptureContext(path) ||
-      usesReassignedArguments(path) ||
-      // `with` can capture Babel's `this` or `arguments` alias.
-      isInsideWith(path)
+      usesReassignedArguments(path)
     ) {
       return
     }
@@ -140,7 +138,7 @@ function valueStaysInView(valuePath: NodePath): boolean {
     return false
   }
   const binding = valuePath.scope.getBinding(parent.node.id.name)
-  if (!binding || !binding.constant) {
+  if (!binding || (binding.kind !== 'const' && !binding.constant)) {
     return false
   }
   return binding.referencePaths.every(

package/src/transforms/collapse-single-use-temps.ts

@@ -10,14 +10,14 @@ import {
   readCrossesFunctionBoundary,
 } from '../analysis/document-order'
 import { isPure } from '../analysis/purity'
-import { isInsideWith } from '../utils/ast'
 import { reorderableToStatement } from '../utils/evaluation-order'
 import { valueToLiteral } from '../utils/literal'
 import { isCalleeOrTagOf } from '../utils/paths'
 
 /**
  * Drops single-use temporaries through substitution, direct branch writes, or
- * constant replacement. Sweeps continue until no shape exposes another.
+ * constant replacement. It repeats these rewrites so one removal can expose
+ * another.
  *
  * @example
  * // ◀️ before
@@ -94,21 +94,9 @@ function resolveSingleUseBinding(path: NodePath<t.VariableDeclarator>): Binding
   if (binding.references === 0) {
     return null
   }
-  // `with` can redirect the temporary or its consumer outside Babel's scope table.
-  if (bindingTouchesWith(binding)) {
-    return null
-  }
   return binding
 }
 
-function bindingTouchesWith(binding: Binding): boolean {
-  return (
-    isInsideWith(binding.path) ||
-    binding.referencePaths.some((ref) => isInsideWith(ref)) ||
-    binding.constantViolations.some((violation) => isInsideWith(violation))
-  )
-}
-
 function findProgramScope(ast: File): Scope | undefined {
   let result: Scope | undefined
   traverse(ast, {
@@ -145,7 +133,7 @@ function trySubstituteSingleUse(
   let removeWriteStmt: boolean
 
   if (init) {
-    if (binding.constantViolations.length > 0) {
+    if (binding.kind !== 'const' && binding.constantViolations.length > 0) {
       return false
     }
     writeStmt = declStmt
@@ -333,8 +321,9 @@ function tryRenameWritesToReader(
       return false
     }
 
-    // Redirecting into a later lexical binding could write it in TDZ.
-    if (!declarationReaches(yBinding.path, violation)) {
+    // A later `var` initializer can overwrite a redirected write. Writes before
+    // lexical initialization are intentionally ignored.
+    if (yBinding.kind === 'var' && !declarationReaches(yBinding.path, violation)) {
       return false
     }
   }
@@ -662,7 +651,7 @@ function spanStatementIsInert(path: NodePath, tempBinding: Binding): boolean {
   }
   if (t.isIfStatement(node)) {
     const test = path.get('test') as NodePath
-    if (!isPure(test.node, test.scope, test)) {
+    if (!isPure(test.node, test.scope)) {
       return false
     }
     if (!spanStatementIsInert(path.get('consequent') as NodePath, tempBinding)) {
@@ -675,9 +664,9 @@ function spanStatementIsInert(path: NodePath, tempBinding: Binding): boolean {
     const expr = path.get('expression') as NodePath
     if (isTempWrite(expr.node, tempBinding)) {
       const rhs = expr.get('right') as NodePath
-      return isPure(rhs.node, rhs.scope, rhs)
+      return isPure(rhs.node, rhs.scope)
     }
-    return isPure(expr.node, expr.scope, expr)
+    return isPure(expr.node, expr.scope)
   }
   return false
 }
@@ -723,7 +712,7 @@ function tryPropagateConstant(
   let writeSourcePath: NodePath
 
   if (init) {
-    if (binding.constantViolations.length > 0) {
+    if (binding.kind !== 'const' && binding.constantViolations.length > 0) {
       return false
     }
     if (!isUnconditionallyExecuted(declStmt, declaratorPath.scope)) {
@@ -890,10 +879,10 @@ function isStatementMovementSafe(path: NodePath): boolean {
   if (t.isEmptyStatement(node)) {
     return true
   }
-  // Crossing a declaration can change name resolution or TDZ.
+  // Only inert expression statements are safe to cross.
   if (t.isExpressionStatement(node)) {
     const expr = path.get('expression') as NodePath
-    return isPure(expr.node, expr.scope, expr)
+    return isPure(expr.node, expr.scope)
   }
   return false
 }

package/src/transforms/conceal-strings.ts

@@ -20,8 +20,7 @@ const RECORD_WIDTH = 4
  * `scope: 'program'` creates one vault. `scope: 'function'` creates a vault per
  * function but repeats the program-wide pool in each one. Parameter defaults and
  * computed keys use the enclosing vault because they run before the function
- * body. Code inside `with` gets a lexical vault so the object cannot capture
- * decoder references.
+ * body.
  *
  * Directives, module specifiers, import attributes, and non-computed keys are not
  * runtime expressions, so they stay unchanged.
@@ -91,7 +90,7 @@ interface ResolvedOptions {
   scope: 'function' | 'program'
 }
 
-type VaultOwner = t.Program | t.Function | t.BlockStatement
+type VaultOwner = t.Program | t.Function
 type VaultOwnerPath = NodePath<VaultOwner>
 
 interface Occurrence {
@@ -208,10 +207,6 @@ function findVaultOwner(
     if (current.isFunction() && child.key === 'body' && scope === 'function') {
       return current as VaultOwnerPath
     }
-    if (current.isWithStatement() && child.key === 'body') {
-      const body = current.get('body')
-      return body.isBlockStatement() ? (body as VaultOwnerPath) : null
-    }
     if (current.isProgram()) {
       return current
     }
@@ -375,7 +370,7 @@ function maskPosition(position: number, key: number, step: number, indexMask: nu
 }
 
 function statementBody(owner: VaultOwnerPath): NodePath<t.Program | t.BlockStatement> {
-  if (owner.isProgram() || owner.isBlockStatement()) {
+  if (owner.isProgram()) {
     return owner
   }
   const body = owner.get('body') as NodePath