ben-sb / javascript-deobfuscator

General purpose JavaScript deobfuscator
https://deobfuscate.io
Apache License 2.0
684 stars 100 forks source link

[Bug] Mishandling of scope #42

Open Semnodime opened 1 year ago

Semnodime commented 1 year ago

In the following example, the declaration of bar via const bar = function(){…} is not incorporated in the deobfuscation result of function body foo:

function foo() {
    const bar = function () {
        for (;;){
            return 0;
        }
    };

    const x = bar();
    return x
}

function bar() {
    return 42;
}

deobfuscation should result in foo returning 0 either directly or indirectly instead.

Semnodime commented 1 year ago

Weirdly enough, it works when the complexity of the refered-to bar function is reduced to a plain return 0 without the for-loop wrapper:

function foo() {
    const bar = function () {
        return 0;
    };

    const x = bar();
    return x
}

function bar() {
    return 42;
}

correctly results in

function foo() {
  const x = 0;
  return x;
}