Merge branch 'master' into indexeddb

apps/docs/src/guide/common-errors.md

@@ -8,10 +8,19 @@ If you see errors like
 > - ERR_DLOPEN_FAILED
 > - Segmentation fault
 
-it means that the [isolated-vm](https://github.com/laverdet/isolated-vm) package was built against a different version of Node.js than the one you are using. This can happen if you upgrade Node.js after installing `webcrack`.
+it most likely means that the [isolated-vm](https://github.com/laverdet/isolated-vm) package was built against a different version of Node.js than the one you are using. This can happen if you upgrade Node.js after installing `webcrack`.
 
 To fix this, run `npm rebuild isolated-vm` in your project directory or delete the `node_modules/isolated-vm` directory and run `npm install` again.
 
+> ```sh
+> npm error prebuild-install warn install No prebuilt binaries found (target=22.1.0 runtime=node arch=arm64 libc= platform=darwin)
+> ...
+> npm error ../src/isolate/generic/error.h:84:65: error: value of type 'Local<Value> (Local<String>, Local<Value>)' is not implicitly convertible to 'v8::Local<v8::Value> (*)(v8::Local<v8::String>)'
+> npm error using RuntimeGenericError = detail::RuntimeErrorWithConstructor<v8::Exception::Error>;
+> ```
+
+When there are no prebuilt binaries available (Apple Silicon) and you are using Node.js v22, try switching to Node.js v20 ([see issue](https://github.com/laverdet/isolated-vm/issues/468)).
+
 ## Heap Out Of Memory
 
 > FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory

apps/playground/src/components/MonacoEditor.tsx

@@ -131,6 +131,7 @@ export default function MonacoEditor(props: Props) {
       deobfuscateAction.dispose();
       saveAction.dispose();
       evalAction.dispose();
+      saveAction.dispose();
     });
   });
 

apps/playground/src/monaco/eval-selection.ts

@@ -89,14 +89,11 @@ export function registerEvalSelection(
   ) {
     if (ranges.some((range) => range.isEmpty())) return;
 
-    const expressions = ranges
-      .map((range) => {
-        const value = editor.getModel()!.getValueInRange(range);
-        return `eval(${JSON.stringify(value)})`;
-      })
-      .join(',');
-    // New lines are added so line comments don't mess up the rest of the code
-    const code = `[\n${expressions}\n]`;
+    const expressions = ranges.map((range) => {
+      const value = editor.getModel()!.getValueInRange(range);
+      return `eval(${JSON.stringify(value)})`;
+    });
+    const code = `[${expressions.join(',')}]`;
     const values = (await evalCode(code)) as unknown[];
 
     const edits = ranges.map((range, index) => ({

apps/playground/src/sandbox.ts

@@ -1,6 +1,11 @@
 import Sandybox from 'sandybox';
 
 const sandbox = await Sandybox.create();
+const iframe = document.querySelector<HTMLIFrameElement>('.sandybox');
+iframe?.contentDocument?.head.insertAdjacentHTML(
+  'afterbegin',
+  `<meta http-equiv="Content-Security-Policy" content="default-src 'none';">`,
+);
 const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
 export async function evalCode(code: string) {

packages/webcrack/src/ast-utils/transform.ts

@@ -24,7 +24,6 @@ export function applyTransform<TOptions>(
   ast: Node,
   transform: Transform<TOptions>,
   options?: TOptions,
-  noScopeOverride?: boolean,
 ): TransformState {
   logger(`${transform.name}: started`);
   const state: TransformState = { changes: 0 };
@@ -34,7 +33,7 @@ export function applyTransform<TOptions>(
     const visitor = transform.visitor(
       options,
     ) as TraverseOptions<TransformState>;
-    visitor.noScope = noScopeOverride || !transform.scope;
+    visitor.noScope = !transform.scope;
     traverse(ast, visitor, undefined, state);
   }
 

packages/webcrack/src/deobfuscate/debug-protection.ts

@@ -90,9 +90,9 @@ export default {
 
         const binding = path.scope.getBinding(
           debugProtectionFunctionName.current!,
-        )!;
+        );
 
-        binding.referencePaths.forEach((ref) => {
+        binding?.referencePaths.forEach((ref) => {
           if (intervalCall.match(ref.parent)) {
             findParent(ref, iife)?.remove();
           }

packages/webcrack/src/index.ts

@@ -137,14 +137,14 @@ export async function webcrack(
 
   const stages = [
     () => {
-      return (ast = parse(code, {
+      ast = parse(code, {
         sourceType: 'unambiguous',
         allowReturnOutsideFunction: true,
         plugins: ['jsx'],
-      }));
+      });
     },
     () => {
-      return applyTransforms(
+      applyTransforms(
         ast,
         [blockStatements, sequence, splitVariableDeclarations, varFunctions],
         { name: 'prepare' },
@@ -160,14 +160,13 @@ export async function webcrack(
     // TODO: Also merge unminify visitor (breaks selfDefending/debugProtection atm)
     (options.deobfuscate || options.jsx) &&
       (() => {
-        return applyTransforms(
+        applyTransforms(
           ast,
           [
             // Have to run this after unminify to properly detect it
             options.deobfuscate ? [selfDefending, debugProtection] : [],
             options.jsx ? [jsx, jsxNew] : [],
           ].flat(),
-          { noScope: true },
         );
       }),
     options.deobfuscate && (() => applyTransform(ast, mergeObjectAssignments)),

packages/webcrack/src/unminify/test/invert-boolean-logic.test.ts

@@ -16,17 +16,6 @@ test('not equal', () =>
 test('not strict equal', () =>
   expectJS('!(a !== b);').toMatchInlineSnapshot(`a === b;`));
 
-test('greater than', () =>
-  expectJS('!(a > b);').toMatchInlineSnapshot(`a <= b;`));
-
-test('less than', () => expectJS('!(a < b);').toMatchInlineSnapshot(`a >= b;`));
-
-test('greater than or equal', () =>
-  expectJS('!(a >= b);').toMatchInlineSnapshot(`a < b;`));
-
-test('less than or equal', () =>
-  expectJS('!(a <= b);').toMatchInlineSnapshot(`a > b;`));
-
 test('logical or', () =>
   expectJS('!(a || b || c);').toMatchInlineSnapshot(`!a && !b && !c;`));
 

packages/webcrack/src/unminify/transforms/invert-boolean-logic.ts

@@ -2,15 +2,14 @@ import * as t from '@babel/types';
 import * as m from '@codemod/matchers';
 import type { Transform } from '../../ast-utils';
 
+// >, >=, <, <= are not invertible because NaN <= 0 is false and NaN > 0 is false
+// https://tc39.es/ecma262/multipage/abstract-operations.html#sec-islessthan
+
 const INVERTED_BINARY_OPERATORS = {
   '==': '!=',
   '===': '!==',
   '!=': '==',
   '!==': '===',
-  '>': '<=',
-  '<': '>=',
-  '>=': '<',
-  '<=': '>',
 } as const;
 
 const INVERTED_LOGICAL_OPERATORS = {