diff --git a/src/SourceFile.js b/src/SourceFile.js index 5f93cf7..3b6eea2 100644 --- a/src/SourceFile.js +++ b/src/SourceFile.js @@ -30,9 +30,9 @@ export class SourceFile { computedMemberExpr: 0, memberExpr: 0, deepBinaryExpr: 0, - encodedArrayValue: 0, - morseLiteral: 0 + encodedArrayValue: 0 }; + morseLiterals = new Set(); identifiersName = []; constructor(sourceCodeString) { @@ -107,7 +107,7 @@ export class SourceFile { // Searching for morse string like "--.- --.--." if (Utils.isMorse(str)) { - this.counter.morseLiteral++; + this.morseLiterals.add(str); } } diff --git a/src/obfuscators/index.js b/src/obfuscators/index.js index 1293dbd..74d97e3 100644 --- a/src/obfuscators/index.js +++ b/src/obfuscators/index.js @@ -20,7 +20,7 @@ export function isObfuscatedCode(analysis) { else if (jjencode.verify(analysis)) { encoderName = "jjencode"; } - else if (analysis.counter.morseLiteral >= 36) { + else if (analysis.morseLiterals.size >= 36) { encoderName = "morse"; } else { diff --git a/test/obfuscated.spec.js b/test/obfuscated.spec.js index 4df4ead..5b7b186 100644 --- a/test/obfuscated.spec.js +++ b/test/obfuscated.spec.js @@ -36,6 +36,13 @@ test("should not detect 'morse' obfuscation", () => { assert.strictEqual(warnings.length, 0); }); +test("should not detect 'morse' obfuscation for high number of doubles morse symbols", () => { + const morseSymbolDoublesString = `const a = ${"'.' + '..' +".repeat(37)} '.'`; + const { warnings } = runASTAnalysis(morseSymbolDoublesString); + + assert.strictEqual(warnings.length, 0); +}); + test("should detect 'jjencode' obfuscation", () => { const trycatch = readFileSync( new URL("jjencode.js", FIXTURE_URL),