Javascript-obfuscator: 0.13.0 plans

[sanex3339]

Main internal feature - block scope analyzer that will prepare block scope data for using in transformers.

Other features:

• internal mangling of variable names instead of using esmangle
• object keys obfuscation https://github.com/javascript-obfuscator/javascript-obfuscator/issues/81#issuecomment-332156650
• ???

[Danoha]

Hi, I'd like to propose a mode in which, by default, no code is obfuscated at all. The only code that would be obfuscated should be between conditional comments.

My usecase is obfuscating only some parts of webpack bundle. I tried the webpack-obfuscator plugin but that obfuscates whole bundle. That is not what I want.

What do you think? In case you do not have time for this, I could try to do it myself.
Thanks.

[slig]

My usecase is obfuscating only some parts of webpack bundle. I tried the webpack-obfuscator plugin but that obfuscates whole bundle. That is not what I want.

What's your specific use case?

Here I configured webpack to make separated bundles for the vendor stuff (jquery, react, lodash, etc) and a bundle with just my code. Then I set the webpack-obfuscator to exclude all the vendor bundles.

That way it only obfuscates the code I want and everything else is kept original.

const OBFUSCATOR_EXCLUDES = ['js/vendors*', 'js/common*', 'js/manifest*', 'js/mainjs*'];


let plugins = [
    // https://github.com/webpack/webpack/tree/master/examples/common-chunk-and-vendor-chunk
    new webpack.optimize.CommonsChunkPlugin({
      names: ['common', 'vendors-react', 'vendors-core'],
      minChunks: 2
    }),
    new webpack.optimize.CommonsChunkPlugin({
      name: 'manifest',
    }),
]


if (PROD) {
  plugins = plugins.concat([
    new JavaScriptObfuscator(OBFUSCATOR_OPTIONS, OBFUSCATOR_EXCLUDES),
  ]);
}

const config = {
  entry: {
    'vendors-core': [
      'jquery',
      'lodash',
      'bootstrap/js/src/util',
      'bootstrap/js/src/collapse',
      'bootstrap/js/src/tab',
      'bootstrap/js/src/modal',
      'jstimezonedetect',
    ],
    'vendors-react': [
      'mobx',
      'mobx-react',
      'react',
      'react-dom',
      'redux',
      'react-redux',
      'reactstrap',
    ],
    maincss: './main.scss',
    mainjs: './jssrc/main/index.js',
    randombundle1: './jssrc/random/index.js',
];

[Danoha]

Hi @slig. Thank you for your input. I managed to split the bundle in chunks and obfuscate only one of them. I think I can live with that.

My initial thought was to obfuscate only parts (ex. one module or even one line) of one bundle, though. That would leave webpack bootstrap and other non-secret modules intact.

With my initial idea I could:

• obfuscate just a few lines between // javascript-obfuscator:enable and // javascript-obfuscator:disable,
• obfuscate whole module with // javascript-obfuscator:enable on the beginning

and everything else would remain as is.

[sanex3339]

I'll think about this. Like new option that will disable obfuscation by default.

Looking for option name.

[sanex3339]

internal mangling of variable names instead of using esmangle

done