Ver código fonte

Fix of rc4 encoded values collision

sanex3339 5 anos atrás
pai
commit
740b84d598

+ 4 - 0
CHANGELOG.md

@@ -1,5 +1,9 @@
 Change Log
 
+v0.24.4
+---
+* Fixed rc4 encoded value collision: https://github.com/javascript-obfuscator/javascript-obfuscator/issues/538
+
 v0.24.3
 ---
 * Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/535

Diferenças do arquivo suprimidas por serem muito extensas
+ 0 - 0
dist/index.browser.js


Diferenças do arquivo suprimidas por serem muito extensas
+ 0 - 0
dist/index.cli.js


Diferenças do arquivo suprimidas por serem muito extensas
+ 0 - 0
dist/index.js


+ 1 - 1
package.json

@@ -1,6 +1,6 @@
 {
   "name": "javascript-obfuscator",
-  "version": "0.24.3",
+  "version": "0.24.4",
   "description": "JavaScript obfuscator",
   "keywords": [
     "obfuscator",

+ 35 - 0
src/storages/string-array/StringArrayStorage.ts

@@ -71,6 +71,11 @@ export class StringArrayStorage extends MapStorage <string, IStringArrayStorageI
      */
     private readonly rc4Keys: string[];
 
+    /**
+     * @type {Map<string, string[]>}
+     */
+    private readonly rc4EncodedValuesSourcesCache: Map<string, string[]> = new Map();
+
     /**
      * @type {number}
      */
@@ -256,10 +261,40 @@ export class StringArrayStorage extends MapStorage <string, IStringArrayStorageI
      */
     private getEncodedValue (value: string): IEncodedValue {
         switch (this.options.stringArrayEncoding) {
+            /**
+             * For rc4 there is a possible collision between encoded values that were received from
+             * different source values with different keys
+             *
+             * For example:
+             * source value | key  | encoded value
+             * _15          | CRDL | w74TGA==
+             * _12          | q9mB | w74TGA==
+             *
+             * Issue: https://github.com/javascript-obfuscator/javascript-obfuscator/issues/538
+             *
+             * As a fix that keeps key size of 4 character, the simple brute-force solution is using:
+             * if collision will happen, just try to encode value again
+             */
             case StringArrayEncoding.Rc4: {
                 const decodeKey: string = this.randomGenerator.getRandomGenerator().pickone(this.rc4Keys);
                 const encodedValue: string = this.cryptUtils.btoa(this.cryptUtils.rc4(value, decodeKey));
 
+                const encodedValueSources: string[] = this.rc4EncodedValuesSourcesCache.get(encodedValue) ?? [];
+                let encodedValueSourcesLength: number = encodedValueSources.length;
+
+                const shouldAddValueToSourcesCache: boolean = !encodedValueSourcesLength || !encodedValueSources.includes(value);
+
+                if (shouldAddValueToSourcesCache) {
+                    encodedValueSources.push(value);
+                    encodedValueSourcesLength++;
+                }
+
+                this.rc4EncodedValuesSourcesCache.set(encodedValue, encodedValueSources);
+
+                if (encodedValueSourcesLength > 1) {
+                    return this.getEncodedValue(value);
+                }
+
                 return { encodedValue, decodeKey };
             }
 

Alguns arquivos não foram mostrados porque muitos arquivos mudaram nesse diff