René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Appears to be a scope resolution bug","articleBody":"\u003c!-- Love javascript-obfuscator? Please consider supporting our collective:\n👉  https://opencollective.com/javascript-obfuscator/donate --\u003e\n\n\u003c!--- Provide a general summary of the issue in the Title above --\u003e\n\n## Expected Behavior\n\u003c!--- Tell us what should happen --\u003e\n\nThe obfuscated output should preserve the original binding semantics.\n\nA semantically correct result would be equivalent to:\n\n```js\nimport { i as _imp } from './runtime.js';\n\nfunction factory() {\n  return 'factory-result';\n}\n\nvar P = class _cls {\n  static instance;\n\n  static getInstance() {\n    return _cls.instance ||= new _cls(), _cls.instance;\n  }\n};\n\nvar x = _imp(factory(), 1);\n\nexport { P, x };\n```\n\nor:\n\n```js\nimport { i as _imp } from './runtime.js';\n\nfunction factory() {\n  return 'factory-result';\n}\n\nvar _P = class {\n  static instance;\n\n  static getInstance() {\n    return _P.instance ||= new _P(), _P.instance;\n  }\n};\n\nvar x = _imp(factory(), 1);\n\nexport { _P as P, x };\n```\n\n## Current Behavior\n\u003c!--- Tell us what happens instead of the expected behavior --\u003e\n\nThe obfuscated output rewrites the class self-reference to the imported binding.\n\nIt becomes effectively:\n\n```js\nimport { i as _0x48e620 } from './runtime.js';\n\nfunction factory() {\n    return 'factory-result';\n}\n\nvar P = class e {\n    static ['instance'];\n    static ['getInstance']() {\n        return _0x48e620['instance'] ||= new _0x48e620(), _0x48e620['instance'];\n    }\n};\n\nvar x = _0x48e620(factory(), 0x1);\n\nexport { P, x };\n```\n\nThis is incorrect because `_0x48e620` is the imported binding, not the class.\n\nIf the imported binding is a function or arrow function, runtime execution fails with:\n\n```text\nTypeError: function is not a constructor\n```\n\n## Steps to Reproduce\n\u003c!--- Provide a link to a live example, or an unambiguous set of steps to --\u003e\n\u003c!--- reproduce this bug. Include code to reproduce, if relevant --\u003e\n1. Open https://obfuscator.io/legacy-playground\n2. Paste `runtime.js` and the main module code below into the editor\n3. Use the obfuscator options listed below\n4. Run obfuscation\n5. Inspect the generated `getInstance()` method\n6. Notice that the class self-reference is rewritten to the imported binding\n\n## JavaScript Obfuscator Edition\n- JavaScript Obfuscator Open Source\n- JavaScript Obfuscator Pro via API or [http://obfuscator.io](http://obfuscator.io])\n\n## Your Environment\n\u003c!--- Include as many relevant details about the environment you experienced the bug in --\u003e\n- `javascript-obfuscator`: `4.2.2`\n  - Also reproduced after testing newer versions, including `5.3.0`\n- Node.js: `20.x`\n- OS: macOS\n\n# Stack trace\n\u003c!--- Include stack trace --\u003e\n\n## Minimal working example that will help to reproduce issue\n\u003c!--- Include code --\u003e\n\n```js\n// runtime.js\nexport const i = (value, flag) =\u003e ({ value, flag });\n```\n\n```js\nimport { i as e } from './runtime.js';\n\nfunction factory() {\n  return 'factory-result';\n}\n\nvar P = class e {\n  static instance;\n\n  static getInstance() {\n    return e.instance ||= new e(), e.instance;\n  }\n};\n\nvar x = e(factory(), 1);\n\nexport { P, x };\n```\n","author":{"url":"https://github.com/z0ffy","@type":"Person","name":"z0ffy"},"datePublished":"2026-03-19T16:47:11.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/1386/javascript-obfuscator/issues/1386"}