MichaelXF / js-confuser

JS-Confuser is a JavaScript obfuscation tool to make your programs *impossible* to read.
https://js-confuser.com
MIT License
241 stars 36 forks source link

Delete operation fails #155

Open anywhichway opened 5 days ago

anywhichway commented 5 days ago

Describe the bug:

Deleting a property does not succeed in removing a property

Config and Small code sample

Config:

{
        target: 'browser',
        calculator: false,
        compact: true,
        hexadecimalNumbers: true,
        controlFlowFlattening: 0.05,
        deadCode: 0.01,
        dispatcher: 0.1,
        duplicateLiteralsRemoval: true,
        identifierGenerator: "randomized",
        minify: true,
        movedDeclarations: true,
        objectExtraction: true,
        opaquePredicates: 0.1,
        renameVariables: false,
        renameGlobals: false,
        stringConcealing: true,
        globalConcealing: false
    }

Code:

this code

 const users = session.users,
                user = session.user,
                invitations = user.invitations,
                dimensions = user.dimensions,
                partners = user.partners,
                id = form.id;
            delete partners[name];
            delete invitations[id];
            delete users[id];
            .... other code

is transformed to

const users = session[__p_7425670131__JS_PREDICT__(0x121)]
              , user = session.user
              , invitations = user.invitations
              , dimensions = user.dimensions
              , partners = user.partners
              , id = form.id;
            __p_4869811828(delete (delete partners[name],
            invitations[id]), delete users[id], ... other code)

Expected behavior

the property name bound to 'id' should be deleted from invitations

Actual behavior

the property is not deleted

Additional context

I believe the transformation __p_4869811828(delete (delete partners[name], invitations[id]), delete users[id], ... other code) is incorrect and should be __p_4869811828(delete partners[name], delete invitations[id], delete users[id], ... other code)

This code works when transformed:

const users = session.users,
                user = session.user,
                invitations = user.invitations,
                dimensions = user.dimensions,
                partners = user.partners,
                id = form.id;
            delete partners[name];
            [invitations,users].forEach(obj => delete obj[id]);
MichaelXF commented 4 days ago

Great find, this is Control Flow Flattening's expression transformation causing this issue.

Simply disabling controlFlowFlattening will prevent the error.

Alternatively you could try 2.0.0-alpha.3 as it's fixed (Demo)

1.7.3 Source Code Causing Error: https://github.com/MichaelXF/js-confuser/blob/79efb6fa94192025810937b9f5c7461ba568aaf6/src/transforms/controlFlowFlattening/expressionObfuscation.ts#L60

anywhichway commented 4 days ago

Thanks for quick response. Will go with turning of flattening for now. Going to production with our app tonight or tomorrow. Will look at alpha as time allows.


From: Michael Brasington @.> Sent: Tuesday, November 19, 2024 12:03:26 PM To: MichaelXF/js-confuser @.> Cc: Simon Y. Blackwell @.>; Author @.> Subject: Re: [MichaelXF/js-confuser] Delete operation fails (Issue #155)

Great find, this is Control Flow Flattening's expression transformation causing this issue.

Simply disabling controlFlowFlattening will prevent the error.

Alternatively you could try 2.0.0-alpha.3https://www.npmjs.com/package/js-confuser/v/2.0.0-alpha.3 as it's fixed (Demohttps://new--confuser.netlify.app/editor?code=var+a+%3D+%7B%0A++key1%3A+true%2C%0A++key2%3A+true%2C%0A++key3%3A+true%2C%0A++last%3A+true%2C%0A%7D%3B%0A%0Adelete+a%5B%27key1%27%5D%3B%0Adelete+a%5B%27key2%27%5D%3B%0Adelete+a%5B%27key3%27%5D%3B%0A%0Alet+b%3B%0A%0Aconsole.log%28a%29%3B%0A&config=%2F%2F+This+file+is+evaluated+as+JavaScript.+You+can+use+JavaScript+here.%0A%2F%2F+Learn+more%3A+https%3A%2F%2Fjs-confuser.com%2Fdocs%2Fgetting-started%2Fplayground%23jsconfuser-ts%0A%0Amodule.exports+%3D+%7B%0A++target%3A+%27browser%27%2C%0A++preset%3A+%27high%27%2C%0A%7D%3B%0A)

1.7.3 Source Code Causing Error: https://github.com/MichaelXF/js-confuser/blob/79efb6fa94192025810937b9f5c7461ba568aaf6/src/transforms/controlFlowFlattening/expressionObfuscation.ts#L60

— Reply to this email directly, view it on GitHubhttps://github.com/MichaelXF/js-confuser/issues/155#issuecomment-2486638744, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABF2US24BLSS3OCMB64MZ6T2BOKQ5AVCNFSM6AAAAABSCGVZSOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIOBWGYZTQNZUGQ. You are receiving this because you authored the thread.Message ID: @.***>