Obfuscate javascript properties?

Question

I recently tested UglifyJS and YUI Compressor and noticed something strange. Both minifiers do not seem to change the property names of the object, but only the names of the variables and functions.

if I have the following code:

var objName = {first:2, second:4}; alert(objName.first + " " + objName.second); 

first and second names remain unchanged in the shortened version.
Why is this?

Answer 1

This is because he does not know where the object will be used. It can be used externally by other code, and you do not want your other code to change whenever you mess it up.

Change In principle, this is so as to prevent obfuscation from breaking external / internal references to properties that may not be possible to clarify when confused.

Answer 2

Since a new scope is created in the function in javascript, you can have your own code in the immediately called function.

  // scoped (function() { var objName = {first:2, second:4}; alert(objName.first + " " + objName.second); })(); 

Then, using the Google Closure Compiler , if you enable the "Advanced" optimization, he will see that the properties are only used locally and will confuse them.

  // result var a={a:2,b:4};alert(a.a+" "+ab); 

Answer 3

Since JavaScript does not have well-defined scope rules, it is not possible to exclude names in a way that is guaranteed to be correct.

For example, if you had the following function:

 function f() { return { first: 'foo', second: 'bar' }; } 

To trick property names, you will need to nail all the places f is called from. Because functions are first-class in JavaScript, they can be assigned and passed in arbitrarily, making binding impossible where f referenced without actually running the program.

In addition, JavaScript does not have the ability for you to specify what a public API is and what is not. Even if the minimizer can reliably determine where the function is being called from the code that you give it, there would be no way to make the same changes in the code that it did not see.

Answer 4

I assume that since minifiers will violate the properties of the object. Consider this:

 function getProp(ob,name) { return ob[name]; } var objName = {first: 2, second: 4}; var prop = getProp(objName, "second"); 

There is no way for minifier to know the string literal "second" as a property of an object. Minimized code might look like this:

 function a(b,c){return b[c]}var d={p1:2,p2:4};var e=a(d,"second") 

Now broken.

Answer 5

The latest version of the uglify utility (today) has an object property mangling property, see v2.4.19. It also supports reserved files to exclude both object properties and variables that you do not need. Check this.

Answer 6

The only publicly available tool so far is obfuscating property names and function names (afaik) is the Closure extended compiler mode. There are many limitations and limitations, but the end result is usually worth it.

As a side note: The Dojo Toolkit is compatible with some minor changes to the Closure compiler in advanced mode - perhaps the only widespread open JavaScript library that can be completely confusing. Therefore, if you are looking for obfuscation to protect your IP address, you should study Dojo for the task.

http://dojo-toolkit.33424.n3.nabble.com/file/n2636749/Using_the_Dojo_Toolkit_with_the_Closure_Compiler.pdf?by-user=t

• Stephen

Answer 7

How to do something like:

 // scoped (function() { var objName = {first:2, second:4}; var vA = 'first'; var vB = 'second'; alert(objName[vA] + " " + objName[vB]); })(); 

Once the links objName.first and / or objName.second are referenced enough times, this method will start saving characters. I cannot think of any reason that would not work, but I cannot find any minifiers that will do this.