EvaCallExpressionTransformer.ts 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184
  1. import { inject, injectable, } from 'inversify';
  2. import { ServiceIdentifiers } from '../../container/ServiceIdentifiers';
  3. import * as ESTree from 'estree';
  4. import jsStringEscape from 'js-string-escape';
  5. import { TStatement } from '../../types/node/TStatement';
  6. import { IOptions } from '../../interfaces/options/IOptions';
  7. import { IRandomGenerator } from '../../interfaces/utils/IRandomGenerator';
  8. import { IVisitor } from '../../interfaces/node-transformers/IVisitor';
  9. import { TransformationStage } from '../../enums/node-transformers/TransformationStage';
  10. import { AbstractNodeTransformer } from '../AbstractNodeTransformer';
  11. import { NodeFactory } from '../../node/NodeFactory';
  12. import { NodeGuards } from '../../node/NodeGuards';
  13. import { NodeUtils } from '../../node/NodeUtils';
  14. @injectable()
  15. export class EvalCallExpressionTransformer extends AbstractNodeTransformer {
  16. /**
  17. * @type {Set <FunctionExpression>}
  18. */
  19. private readonly evalRootAstHostNodeSet: Set <ESTree.FunctionExpression> = new Set();
  20. /**
  21. * @param {IRandomGenerator} randomGenerator
  22. * @param {IOptions} options
  23. */
  24. constructor (
  25. @inject(ServiceIdentifiers.IRandomGenerator) randomGenerator: IRandomGenerator,
  26. @inject(ServiceIdentifiers.IOptions) options: IOptions
  27. ) {
  28. super(randomGenerator, options);
  29. }
  30. /**
  31. * @param {Expression | SpreadElement} node
  32. * @returns {string | null}
  33. */
  34. private static extractEvalStringFromCallExpressionArgument (node: ESTree.Expression | ESTree.SpreadElement): string | null {
  35. if (NodeGuards.isLiteralNode(node)) {
  36. return EvalCallExpressionTransformer
  37. .extractEvalStringFromLiteralNode(node);
  38. }
  39. if (NodeGuards.isTemplateLiteralNode(node)) {
  40. return EvalCallExpressionTransformer
  41. .extractEvalStringFromTemplateLiteralNode(node);
  42. }
  43. return null;
  44. }
  45. /**
  46. * @param {Literal} node
  47. * @returns {string | null}
  48. */
  49. private static extractEvalStringFromLiteralNode (node: ESTree.Literal): string | null {
  50. return typeof node.value === 'string' ? node.value : null;
  51. }
  52. /**
  53. * @param {TemplateLiteral} node
  54. * @returns {string | null}
  55. */
  56. private static extractEvalStringFromTemplateLiteralNode (node: ESTree.TemplateLiteral): string | null {
  57. const quasis: ESTree.TemplateElement[] = node.quasis;
  58. const allowedQuasisLength: number = 1;
  59. if (quasis.length !== allowedQuasisLength || node.expressions.length) {
  60. return null;
  61. }
  62. return quasis[0].value.cooked;
  63. }
  64. /**
  65. * @param {TransformationStage} transformationStage
  66. * @returns {IVisitor | null}
  67. */
  68. public getVisitor (transformationStage: TransformationStage): IVisitor | null {
  69. switch (transformationStage) {
  70. case TransformationStage.Preparing:
  71. return {
  72. enter: (node: ESTree.Node, parentNode: ESTree.Node | null) => {
  73. if (
  74. parentNode
  75. && NodeGuards.isCallExpressionNode(node)
  76. && NodeGuards.isIdentifierNode(node.callee)
  77. && node.callee.name === 'eval'
  78. ) {
  79. return this.transformNode(node, parentNode);
  80. }
  81. }
  82. };
  83. case TransformationStage.Finalizing:
  84. if (!this.evalRootAstHostNodeSet.size) {
  85. return null;
  86. }
  87. return {
  88. leave: (node: ESTree.Node, parentNode: ESTree.Node | null) => {
  89. if (parentNode && this.isEvalRootAstHostNode(node)) {
  90. return this.restoreNode(node, parentNode);
  91. }
  92. }
  93. };
  94. default:
  95. return null;
  96. }
  97. }
  98. /**
  99. * @param {CallExpression} callExpressionNode
  100. * @param {Node} parentNode
  101. * @returns {Node}
  102. */
  103. public transformNode (callExpressionNode: ESTree.CallExpression, parentNode: ESTree.Node): ESTree.Node {
  104. const callExpressionFirstArgument: ESTree.Expression | ESTree.SpreadElement = callExpressionNode.arguments[0];
  105. if (!callExpressionFirstArgument) {
  106. return callExpressionNode;
  107. }
  108. const evalString: string | null = EvalCallExpressionTransformer
  109. .extractEvalStringFromCallExpressionArgument(callExpressionFirstArgument);
  110. if (!evalString) {
  111. return callExpressionNode;
  112. }
  113. let ast: TStatement[];
  114. // wrapping into try-catch to prevent parsing of incorrect `eval` string
  115. try {
  116. ast = NodeUtils.convertCodeToStructure(evalString);
  117. } catch {
  118. return callExpressionNode;
  119. }
  120. /**
  121. * we should wrap AST-tree into the parent function expression node (ast root host node).
  122. * This function expression node will help to correctly transform AST-tree.
  123. */
  124. const evalRootAstHostNode: ESTree.FunctionExpression = NodeFactory
  125. .functionExpressionNode([], NodeFactory.blockStatementNode(<any>ast));
  126. /**
  127. * we should store that host node and then extract AST-tree on the `finalizing` stage
  128. */
  129. this.evalRootAstHostNodeSet.add(evalRootAstHostNode);
  130. return evalRootAstHostNode;
  131. }
  132. /**
  133. * @param {FunctionExpression} evalRootAstHostNode
  134. * @param {Node} parentNode
  135. * @returns {Node}
  136. */
  137. public restoreNode (evalRootAstHostNode: ESTree.FunctionExpression, parentNode: ESTree.Node): ESTree.Node {
  138. const targetAst: ESTree.Statement[] = evalRootAstHostNode.body.body;
  139. const obfuscatedCode: string = NodeUtils.convertStructureToCode(targetAst);
  140. return NodeFactory.callExpressionNode(
  141. NodeFactory.identifierNode('eval'),
  142. [
  143. NodeFactory.literalNode(jsStringEscape(obfuscatedCode))
  144. ]
  145. );
  146. }
  147. /**
  148. * @param {Node} node
  149. * @returns {boolean}
  150. */
  151. private isEvalRootAstHostNode (node: ESTree.Node): node is ESTree.FunctionExpression {
  152. return NodeGuards.isFunctionExpressionNode(node) && this.evalRootAstHostNodeSet.has(node);
  153. }
  154. }