Obfuscation of variable names with whitespaces

Question

My goal is not to use it in a real website, it's for knowledge and fun.

I want to write something like :

var  =3;
alert( );

(not with the space but with a specific unicode character)

Is it possible? And if not, is there something equivalent?

Basically, no. You may find this question interesting: http://stackoverflow.com/q/7451524/707111 — Ry-, Jun 30 '12 at 15:31
http://www.securelist.com/en/blog/208188101/Dangerous_whitespaces — Bob Davies, Jun 30 '12 at 15:31
@minitech yes but here http://mathiasbynens.be/notes/javascript-identifiers look in the comments. — user1365010, Jun 30 '12 at 15:33
@user1365010: Looking through them. One claimed to be whitespace, but I saw a box... — Ry-, Jun 30 '12 at 15:36
possible duplicate of [Valid Characters for JavaScript Variable Names](http://stackoverflow.com/questions/1661197/valid-characters-for-javascript-variable-names) — Quentin, Jun 30 '12 at 15:37
@user1365010: I still see a box. Anyway, if that answers your question already, why did you ask this question? — Ry-, Jun 30 '12 at 15:39
the basic premise of the question is you dont want variable names that can be deciphered by the user? — Baz1nga, Jun 30 '12 at 16:02

score 4 · Accepted Answer · answered Jun 30 '12 at 15:54

Although you cannot use any of the Unicode whitespace characters as "raw" names, you can do a bit of magic with window and bracket notation.

For example:

window["    "] = 1;
alert(window["    "]);

These are not "named" per se, as you cannot reference them without fiddling with properties of window, since JavaScript ignores spaces, but they will do the trick when it comes to obfuscation.

Of course, this could be extended arbitrarily to any object; window is not a requirement, but it is what came to mind since all global variables are properties of window. To that end, you could have something like:

var vars = {};
vars[" "] = 1;
vars["  "] = 2;
vars["   "] = 3;

alert(vars[" "] + vars["  "] + vars["   "]);

I think this is as close as you'll be able to get to having variables named with whitespaces. They're not true variables in the sense of the var keyword, but they are as close as you're likely to come.

Of course, you can use Unicode whitespace characters as properties too:

var vars = {};
vars[" "] = 1; // uses em quad, U+2001
alert(vars[" "]); // real variable, alerts 1
alert(vars[" "]); // fake variable, alerts undefined

In this case, I use U+2001 as a property. It looks mighty similar to the one after it, which is just a generic space in a string, but they are not the same as the alert suggests.

A potential "issue" with this, in terms of obfuscation, is that the strings are very clearly delimited thanks to proper monospace fonts and syntax highlighting, so I am not sure how useful raw spaces themselves will be. However, if you throw in some of the fancier Unicode spaces, your results may be better.

Obfuscation of variable names with whitespaces

1 Answers1