Skip to content

function_to_array_replacement: False positives on scripts bundled in Vite's lib mode with IIFE format #3

Description

@maddy-upguard

When using WXT and Vite to build a browser extension, WXT uses Vite's library mode to bundle content scripts as IIFEs. See https://wxt.dev/guide/essentials/es-modules#content-scripts for details. This leads to false positives.
The WXT project is planned to move to ESM loading in content scripts in the 1.1 release. Until then, we need a workaround.
One solution to this is to change the function_to_array_replacement detector to have a threshold (2% of AST nodes, in line with other detectors.) E.g.,

function detect(flatTree) {
  return (flatTree[0].typeMap
    .VariableDeclarator || [])
    .some(n =>
      n.init?.callee?.type
       ?.indexOf('unction') > -1 &&
      n.id?.references?.length &&
      functionHasMinimumRequiredRefs(
        n.id.references[0],
        flatTree) &&
      !n.id.references.some(r =>
        !(r.parentNode.type ===
          'MemberExpression' &&
          r.parentKey === 'object'))
    ) ? obfuscationName : '';
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions