uglify-js - npm Package Compare versions

Comparing version 3.17.2 to 3.17.3

lib/propmangle.js

@@ -127,8 +127,12 @@ /***********************************************************************
     ast.walk(new TreeWalker(function(node) {
-        if (node instanceof AST_ClassProperty) {
-            if (node.start && node.start.quote) add(node.key);
+        if (node instanceof AST_ClassProperty
+            || node instanceof AST_DestructuredKeyVal
+            || node instanceof AST_ObjectProperty) {
+            if (node.key instanceof AST_Node) {
+                addStrings(node.key, add);
+            } else if (node.start && node.start.quote) {
+                add(node.key);
+            }
         } else if (node instanceof AST_Dot) {
             if (node.quoted) add(node.property);
-        } else if (node instanceof AST_ObjectProperty) {
-            if (node.start && node.start.quote) add(node.key);
         } else if (node instanceof AST_Sub) {
@@ -160,2 +164,3 @@ addStrings(node.property, add);
         debug: false,
+        domprops: false,
         keep_quoted: false,
@@ -167,2 +172,5 @@ regex: null,
     var reserved = options.builtins ? new Dictionary() : get_builtins();
+    if (!options.domprops && typeof domprops !== "undefined") domprops.forEach(function(name) {
+        reserved.set(name, true);
+    });
     if (Array.isArray(options.reserved)) options.reserved.forEach(function(name) {
@@ -186,3 +194,3 @@ reserved.set(name, true);
     // note debug is either false (disabled), or a string of the debug suffix to use (enabled).
-    // note debug may be enabled as an empty string, which is falsey. Also treat passing 'true'
+    // note debug may be enabled as an empty string, which is falsy. Also treat passing 'true'
     // the same as passing an empty string.
@@ -198,5 +206,3 @@ var debug = options.debug !== false;
     ast.walk(new TreeWalker(function(node) {
-        if (node instanceof AST_Binary) {
-            if (node.operator == "in") addStrings(node.left, add);
-        } else if (node.TYPE == "Call") {
+        if (node.TYPE == "Call") {
             var exp = node.expression;
@@ -218,10 +224,14 @@ if (exp instanceof AST_Dot) switch (exp.property) {
             }
-        } else if (node instanceof AST_ClassProperty) {
-            if (typeof node.key == "string") add(node.key);
+        } else if (node instanceof AST_ClassProperty
+            || node instanceof AST_DestructuredKeyVal
+            || node instanceof AST_ObjectProperty) {
+            if (node.key instanceof AST_Node) {
+                addStrings(node.key, add);
+            } else {
+                add(node.key);
+            }
         } else if (node instanceof AST_Dot) {
-            add(node.property);
-        } else if (node instanceof AST_ObjectProperty) {
-            if (typeof node.key == "string") add(node.key);
+            if (is_lhs(node, this.parent())) add(node.property);
         } else if (node instanceof AST_Sub) {
-            addStrings(node.property, add);
+            if (is_lhs(node, this.parent())) addStrings(node.property, add);
         }
@@ -251,8 +261,12 @@ }));
             }
-        } else if (node instanceof AST_ClassProperty) {
-            if (typeof node.key == "string") node.key = mangle(node.key);
+        } else if (node instanceof AST_ClassProperty
+            || node instanceof AST_DestructuredKeyVal
+            || node instanceof AST_ObjectProperty) {
+            if (node.key instanceof AST_Node) {
+                mangleStrings(node.key);
+            } else {
+                node.key = mangle(node.key);
+            }
         } else if (node instanceof AST_Dot) {
             node.property = mangle(node.property);
-        } else if (node instanceof AST_ObjectProperty) {
-            if (typeof node.key == "string") node.key = mangle(node.key);
         } else if (node instanceof AST_Sub) {
@@ -313,3 +327,3 @@ if (!options.keep_quoted) mangleStrings(node.property);
         if (node instanceof AST_Sequence) {
-            mangleStrings(node.expressions.tail_node());
+            mangleStrings(node.tail_node());
         } else if (node instanceof AST_String) {
@@ -316,0 +330,0 @@ node.value = mangle(node.value);

package.json

@@ -6,3 +6,3 @@ {
   "license": "BSD-2-Clause",
-  "version": "3.17.2",
+  "version": "3.17.3",
   "engines": {
@@ -9,0 +9,0 @@ "node": ">=0.8.0"

README.md

@@ -649,3 +649,3 @@ UglifyJS 3
 - `html5_comments` (default: `true`) — process HTML comment as workaround for
-  browsers which do not recognise `<script>` tags
+  browsers which do not recognize `<script>` tags
 
@@ -757,3 +757,3 @@ - `module` (default: `false`) — set to `true` if you wish to process input as
 - `negate_iife` (default: `true`) — negate "Immediately-Called Function Expressions"
-  where the return value is discarded, to avoid the parens that the
+  where the return value is discarded, to avoid the parentheses that the
   code generator would insert.
@@ -856,3 +856,3 @@
 
-- `varify` (default: `true`) — convert block-scoped declaractions into `var`
+- `varify` (default: `true`) — convert block-scoped declarations into `var`
   whenever safe to do so
@@ -897,4 +897,4 @@
 
-- `builtins` (default: `false`) — Use `true` to allow the mangling of builtin
-  DOM properties. Not recommended to override this setting.
+- `builtins` (default: `false`) — Use `true` to allow the mangling of built-in
+  properties of JavaScript API. Not recommended to override this setting.
 
@@ -904,2 +904,5 @@ - `debug` (default: `false`) — Mangle names with the original name still present.
 
+- `domprops` (default: `false`) — Use `true` to allow the mangling of properties
+  commonly found in Document Object Model. Not recommended to override this setting.
+
 - `keep_fargs` (default: `false`) — Use `true` to prevent mangling of function
@@ -906,0 +909,0 @@ arguments.

tools/node.js

@@ -18,3 +18,3 @@ var fs = require("fs");
 
-new Function("exports", function() {
+new Function("domprops", "exports", function() {
     var code = exports.FILES.map(function(file) {
@@ -25,3 +25,3 @@ return fs.readFileSync(file, "utf8");
     return code.join("\n\n");
-}())(exports);
+}())(require("./domprops.json"), exports);
 
@@ -28,0 +28,0 @@ function to_comment(value) {

New alerts

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses eval() which is a dangerous function. This prevents the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1280650

increased by0.23%

Lines of code

31982

increased by0.21%

Number of lines in readme file

1479

increased by0.2%

No dependency changes