MichaelXF / js-confuser

JS-Confuser is a JavaScript obfuscation tool to make your programs *impossible* to read.
https://js-confuser.com
MIT License
242 stars 37 forks source link

object extraction fails with `const` #106

Closed j4k0xb closed 3 months ago

j4k0xb commented 1 year ago

Describe the bug:

object extraction of a const variable errors at runtime

Config and Small code sample

Config:

{
  compact: true,
  identifierGenerator: 'randomized',
  objectExtraction: true,
  target: 'browser',
}

Code:

const obj = {prop: 0};
obj.prop = 1;
console.log(obj.prop);

Expected behavior

The program should output 1

Actual behavior

TypeError: Assignment to constant variable.

obfuscated code:

const obj_prop=0;!(obj_prop=1,console['log'](obj_prop))

Additional context

an easy fix would probably be to convert the declaration to let or var

MichaelXF commented 1 year ago

Great find, will fix this for next release.

j4k0xb commented 1 year ago

just found an edge case: const can only be safely converted to let instead of var because of closures:

for (let i = 0; i < 3; i++) {
  const obj = { prop: i };

  setTimeout(() => {
    console.log(obj.prop); // outputs 0, 1, 2
  }, 100);
}

after obfuscation: 2, 2, 2

MichaelXF commented 1 year ago

I will get to work on this