一句话：JSNeat 利用信息检索和三类使用上下文，从开源 JS 语料中恢复压缩代码的变量名，准确率显著优于现有方法。
为保护原始源码，部署在 Web 中的 JavaScript 常将变量名替换为短而无意义的名称，导致代码难以理解和分析。本文提出 JSNeat，一种基于信息检索的变量名恢复方法，通过在大型开源 JS 代码库中搜索候选名称来实现数据驱动的恢复。该方法使用三类上下文匹配压缩代码中的变量：变量属性与角色的上下文、变量及其与其他待恢复变量关系的上下文，以及变量所在函数任务的上下文。作者在超过 32.2 万个 JS 文件、100 万个函数、350 万个变量和 17.6 万个唯一变量名的数据集上进行了实验。JSNeat 达到 69.1% 的准确率，相较 JSNice 和 JSNaughty 分别相对提升 66.1% 和 43%，且恢复一个文件或变量的速度分别是 JSNice 的 2 倍和 JSNaughty 的 4 倍。
To avoid the exposure of original source code in a Web application, the variable names in JS code deployed in the wild are often replaced by short, meaningless names, thus making the code extremely difficult to manually understand and analysis. This paper presents JSNeat, an information retrieval (IR)-based approach to recover the variable names in minified JS code. JSNeat follows a data-driven approach to recover names by searching for them in a large corpus of open-source JS code. We use three types of contexts to match a variable in given minified code against the corpus including the context of the properties and roles of the variable, the context of that variable and relations with other variables under recovery, and the context of the task of the function to which the variable contributes. We performed several empirical experiments to evaluate JSNeat on the dataset of more than 322K JS files with 1M functions, and 3.5M variables with 176K unique variable names. We found that JSNeat achieves a high accuracy of 69.1%, which is the relative improvements of 66.1% and 43% over two state-of-the-art approaches JSNice and JSNaughty, respectively. The time to recover for a file or a variable with JSNeat is twice as fast as with JSNice and 4x as fast as with JNaughty, respectively.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{TranTNNN19,
title = {Recovering Variable Names for Minified Code with Usage Contexts},
author = {Hieu Tran and Ngoc Tran and Son Nguyen and Hoan Nguyen and Tien N. Nguyen},
booktitle = {ICSE},
year = {2019},
doi = {10.1109/icse.2019.00119}
}