We will be at OWASP APPSEC EUROPE 2017 - Belfast! Let’s talk!MORE INFO

Help Center

Get to know more about our API, Code Annotations and Code Transformations

Identifiers Renaming

Potency
1 / 3
Resilience
5 / 5
Cost
0 / 5

Tags: rename,identifiers,minification,optimization

Description

Identifiers Renaming replaces identifier names with random generated names
that are shorter and meaningless. The original identifier names hold meaning
which is unnecessary for the JavaScript engine to run the program. Identifier
names inside HTML script tags, HTML event attributes, and eval-like function
arguments are also renamed.

UNSAFE mode

Identifiers Renaming on UNSAFE mode renames both local identifier names and
public identifier names if they are not included in the Exclude List defined
by the user.

1
2
3
4
5
6
var definedVar = 1;
function definedFn (localParam) {
window.alert(localParam);
}
definedFn(definedVar);
notDefinedFn(notDefinedVar);
1
2
3
4
5
6
var d = 1;
function e(a) {
window.alert(a);
}
e(d);
c(b);

Browser and Node.js names aren’t renamed.

Exclude List

The Exclude List is a list of names defined by the user that mustn’t be renamed.
Wildcards are allowed and represent a non-greedy matcher like .?.
For instance, to ignore importantFn, secretVariable and any name that begins
with a single underscore and ends with another single underscore the
Exclude
List* would look like this:

1
importantFn,secretVariable,_*_

SAFEST mode

Identifiers Renaming on SAFEST mode only renames local identifier names.

Here is an example:

1
2
3
4
5
6
var definedVar = 1;
function definedFn (localParam) {
window.alert(localParam);
}
definedFn(definedVar);
notDefinedFn(notDefinedVar);

1
2
3
4
5
6
var definedVar = 1;
function definedFn(a) {
window.alert(a);
}
definedFn(definedVar);
notDefinedFn(notDefinedVar);

So if you want to rename public identifier names like definedVar and definedFn
add them to the Include List.

1
2
3
4
5
6
var d = 1;
function e(a) {
window.alert(a);
}
e(d);
notDefinedFn(notDefinedVar);

Include List

The Include List is a list of names defined by the user that must be forcibly
renamed. Wildcards are allowed and represent a non-greedy matcher like .?.
For instance, to force renaming of importantFn, secretVariable and any name
that begins with a single underscore and ends with another single underscore the
Include List* would look like this:

1
importantFn,secretVariable,_*_

Collisions between Include List and Exclude List

JScrambler follows some rules when name collisions between the Include List and
Exclude List are found.

Here are some collision examples:

  • _draw and _draw
  • _draw and _*
  • _draw and *

Names without wildcards like _draw prevail over names with wildcards like _*:

  • if you add _draw to the Include List and _* to Exclude List ANY
    occurrence of _draw will be renamed;
  • if you add _draw to the Exclude List and _* to Include List NO
    occurrence of _draw will be renamed;
  • also if _draw is added to both lists then NO occurrence of _draw will
    be renamed. Exclude List prevails;

Option Types

Name Required Default Value Description
mode No “SAFEST” There are two modes available: SAFEST mode only renames local identifiers; UNSAFE mode renames local and public identifiers.
includeList No N/A List of names defined by the user that must be forcibly renamed.
excludeList No N/A List of names defined by the user that mustn’t be renamed.
namePrefix No N/A Adds a prefix to all identifier names.

API Parameters

Example:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
"keys": {
"accessKey": "XXXXXX",
"secretKey": "YYYYYY"
},
"applicationId": "ZZZZZZ",
"params": [
{
"name": "identifiersRenaming",
"options": {
"mode": "SAFEST",
"includeList": [
"VALUE1",
"VALUE2"
],
"excludeList": [
"VALUE1",
"VALUE2"
],
"namePrefix": "VALUE"
}
}
]
}