MichaelXF / js-confuser

JS-Confuser is a JavaScript obfuscation tool to make your programs *impossible* to read.
https://js-confuser.com
MIT License
168 stars 28 forks source link

object extraction fails with `const` #106

Open j4k0xb opened 11 months ago

j4k0xb commented 11 months ago

Describe the bug:

object extraction of a const variable errors at runtime

Config and Small code sample

Config:

{
  compact: true,
  identifierGenerator: 'randomized',
  objectExtraction: true,
  target: 'browser',
}

Code:

const obj = {prop: 0};
obj.prop = 1;
console.log(obj.prop);

Expected behavior

The program should output 1

Actual behavior

TypeError: Assignment to constant variable.

obfuscated code:

const obj_prop=0;!(obj_prop=1,console['log'](obj_prop))

Additional context

an easy fix would probably be to convert the declaration to let or var

MichaelXF commented 11 months ago

Great find, will fix this for next release.

j4k0xb commented 9 months ago

just found an edge case: const can only be safely converted to let instead of var because of closures:

for (let i = 0; i < 3; i++) {
  const obj = { prop: i };

  setTimeout(() => {
    console.log(obj.prop); // outputs 0, 1, 2
  }, 100);
}

after obfuscation: 2, 2, 2

MichaelXF commented 9 months ago

I will get to work on this