Javascript-obfuscator: Issue with two separated obfuscated files on the same page

Created on 22 Jun 2017 · 8Comments · Source: javascript-obfuscator/javascript-obfuscator

Hi,

I think I found an issue. I have two independent javascript files on a page, each one obfuscated by the webpack-obfuscator plugin (i.e: different bundles on different <script> tags). Since they both use the same configuration from webpack.conf.js, they have the same seed config and thus the first variable name that is used on the stringArray variable is the same for both obfuscated files. That is an issue as the variable used by stringArray is a global and gets replaced by the second script.
Then somewhere after loading the scripts, any interaction from the first bundle with the stringArray function will look at the second bundle stringArray variable.

Possible workarounds that I could think:

Have the obfuscator output an immediately invoked function that would scope the variable and not leak them to the global scope.
Use the seed parameter plus an hash of the source code as the real seed used by the obuscator. This is not fail-proof as it still might generate two variables with the same name and mess things.

Thanks!

enhancement

Source