Use typeMap (#16)

* Update dependencies

* Use typeMap

Author: BenBaryoPX

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "obfuscation-detector",
-  "version": "2.0.2",
+  "version": "2.0.3",
   "description": "Javascript obfuscation detector",
   "main": "src/index.js",
   "type": "module",
@@ -34,10 +34,10 @@
   },
   "homepage": "https://github.com/PerimeterX/obfuscation-detector#readme",
   "devDependencies": {
-    "eslint": "^9.12.0",
+    "eslint": "^9.14.0",
     "husky": "^9.1.6"
   },
   "dependencies": {
-    "flast": "^2.0.3"
+    "flast": "^2.1.0"
   }
 }

package.json

@@ -29,7 +29,7 @@ function isNodeInScope(targetNode, targetScopeBlock) {
  */
 function detectCaesarPlus(flatTree) {
 	// Verify the main function's name is 3 letters long and has maximum 1 reference;
-	const candidates = flatTree.filter(n =>
+	const candidates = (flatTree[0].typeMap.FunctionExpression || []).filter(n =>
 		n.type === 'FunctionExpression' &&
 		n?.id?.name?.length === 3 &&
 		n?.parentNode?.type === 'CallExpression' && !n.parentNode.arguments.length);

src/detectors/caesarp.js

@@ -8,8 +8,8 @@ const obfuscationName = 'function_to_array_replacements';
  * @param {ASTNode[]} flatTree
  * @return {string} The obfuscation name if detected; empty string otherwise.
  */
-function detectFunctionToArrayReplacemets(flatTree) {
-	return flatTree.some(n =>
+function detectFunctionToArrayReplacements(flatTree) {
+	return (flatTree[0].typeMap.VariableDeclarator || []).some(n =>
 		n.type === 'VariableDeclarator' &&
 		n?.init?.callee?.type?.indexOf('unction') > -1 &&
 		n?.id?.references?.length &&
@@ -18,4 +18,4 @@ function detectFunctionToArrayReplacemets(flatTree) {
 			r.parentKey === 'object'))) ? obfuscationName : '';
 }
 
-export {detectFunctionToArrayReplacemets};
+export {detectFunctionToArrayReplacements};

src/detectors/functionToArrayReplacements.js

@@ -1,7 +1,7 @@
 const obfuscationName = 'obfuscator.io';
 
 function setCookieIndicator(flatTree) {
-	const candidate = flatTree.find(n =>
+	const candidate = (flatTree[0].typeMap.ObjectExpression || []).find(n =>
 		n.type === 'ObjectExpression' &&
 		n.properties.length &&
 		n.properties.some(p =>
@@ -19,7 +19,7 @@ function setCookieIndicator(flatTree) {
 }
 
 function notBooleanTilde(flatTree) {
-	const candidates = flatTree.filter(n =>
+	const candidates = (flatTree[0].typeMap.BlockStatement || []).filter(n =>
 		n.type === 'BlockStatement' &&
 		n.body.length === 2 &&
 		n.body[0].type === 'IfStatement' &&

src/detectors/obfuscator-io.js

@@ -19,7 +19,7 @@ function arrayHasMeaningfulContentLength(targetArray, flatTree) {
  * @return {ASTNode[]} Candidates matching the target profile of an array with more than a few items, all literals.
  */
 function findArrayDeclarationCandidates(flatTree) {
-	return flatTree.filter(n =>
+	return (flatTree[0].typeMap.VariableDeclarator || []).filter(n =>
 		n.type === 'VariableDeclarator' &&
 		n?.init?.type === 'ArrayExpression' &&
 		arrayHasMeaningfulContentLength(n.init.elements, flatTree) &&