[GH-ISSUE #8] Unsafe identifier renames

kerem commented

2026-03-03 13:52:06 +03:00

Owner

Originally created by @j4k0xb on GitHub (Dec 12, 2023).
Original GitHub issue: https://github.com/jehna/humanify/issues/8

Minifiers only rename variable/function/parameter bindings and not any other identifier like properties because it's almost impossible to guarantee the program still works then.

Example input file:

class A {
  get() {
    return document.querySelector("#foo");
  }
}

humanify output:

class MyClass {
  getElementById() {
    return dom.findElement("#foo");
  }
}

I think thats the only change necessary but it needs some testing:
github.com/jehna/humanify@4dfe05e20f/src/openai/rename-variables-and-functions.ts (L16)

- Identifier: (path) => { 
+ BindingIdentifier: (path) => {

Or how about renaming all variables to something unique so it doesn't mix up minified ones and then supplying a list of binding names it is allowed to change in the prompt?

Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed.
Maybe use babel's scope-aware rename that also handles these conflicts (have to find a way of getting rid of the _ prefix): https://astexplorer.net/#/gist/7283141e13dab314521744603a95e9b7/05b11370db8d5ef257550b2916b87d6e72e4eb1d

Originally created by @j4k0xb on GitHub (Dec 12, 2023). Original GitHub issue: https://github.com/jehna/humanify/issues/8 Minifiers only rename variable/function/parameter bindings and not any other identifier like properties because it's almost impossible to guarantee the program still works then. Example input file: ```js class A { get() { return document.querySelector("#foo"); } } ``` humanify output: ```js class MyClass { getElementById() { return dom.findElement("#foo"); } } ``` I think thats the only change necessary but it needs some testing: https://github.com/jehna/humanify/blob/4dfe05e20f530a8919e6d1e9f89564be5bb874e0/src/openai/rename-variables-and-functions.ts#L16 ```diff - Identifier: (path) => { + BindingIdentifier: (path) => { ``` Or how about renaming all variables to something unique so it doesn't mix up minified ones and then supplying a list of binding names it is allowed to change in the prompt? Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed. Maybe use babel's scope-aware rename that also handles these conflicts (have to find a way of getting rid of the `_` prefix): https://astexplorer.net/#/gist/7283141e13dab314521744603a95e9b7/05b11370db8d5ef257550b2916b87d6e72e4eb1d

kerem closed this issue

2026-03-03 13:52:06 +03:00

kerem commented

2026-03-03 13:52:07 +03:00

Author

Owner

@0xdevalias commented on GitHub (Dec 12, 2023):

Or how about renaming all variables to something unique so it doesn't mix up minified ones and then supplying a list of binding names it is allowed to change in the prompt?

I've laid out some of my thoughts on this concept in general, in the following issues/comments:

https://github.com/j4k0xb/webcrack/issues/21#issuecomment-1807290502 (and my later comments)
https://github.com/pionxzh/wakaru/issues/34#issuecomment-1807393509 (and my later comments)

Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed.

Off the top of my head, if it's not easily solved via tweaking the prompt, you could potentially have it do a 'refinement/feedback round' where you provide feedback to the LLM + get it to correct the issues (which could be repeated up to X times) eg.

The following variables were already defined in the scope, so we can't use the names you chose. Please choose a new name for them so that they don't clash:

X

Y

Z

@0xdevalias commented on GitHub (Dec 12, 2023): > Or how about renaming all variables to something unique so it doesn't mix up minified ones and then supplying a list of binding names it is allowed to change in the prompt? I've laid out some of my thoughts on this concept in general, in the following issues/comments: - https://github.com/j4k0xb/webcrack/issues/21#issuecomment-1807290502 (and my later comments) - https://github.com/pionxzh/wakaru/issues/34#issuecomment-1807393509 (and my later comments) > Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed. Off the top of my head, if it's not easily solved via tweaking the prompt, you could potentially have it do a 'refinement/feedback round' where you provide feedback to the LLM + get it to correct the issues (which could be repeated up to X times) eg. > The following variables were already defined in the scope, so we can't use the names you chose. Please choose a new name for them so that they don't clash: > > - X > - Y > - Z

kerem commented

2026-03-03 13:52:07 +03:00

Author

Owner

@j4k0xb commented on GitHub (Feb 28, 2024):

copilot now has a similar feature: https://code.visualstudio.com/updates/v1_87#_rename-suggestions
worth looking into how they've done it

@j4k0xb commented on GitHub (Feb 28, 2024): copilot now has a similar feature: https://code.visualstudio.com/updates/v1_87#_rename-suggestions worth looking into how they've done it

kerem commented

2026-03-03 13:52:07 +03:00

Author

Owner

@0xdevalias commented on GitHub (Feb 29, 2024):

Release detailed here:

https://github.com/microsoft/vscode/releases/tag/1.87.0
- https://github.com/microsoft/vscode/compare/1.87.0...1.86.2

Couldn't see any overly relevant commits in that range, but did find the following searching the issue manually:

Which lead me to this label:

https://github.com/microsoft/vscode/issues?q=is%3Aopen+label%3Arename+sort%3Aupdated-desc

And these issues, which sound like there are 'rename providers' used by the feature:

More docs about rename providers here:

https://code.visualstudio.com/docs/editor/editingevolved#_rename-symbol
https://code.visualstudio.com/api/references/vscode-api#:~:text=registerRenameProvider(
https://code.visualstudio.com/api/references/vscode-api#RenameProvider
- RenameProvider
  The rename provider interface defines the contract between extensions and the rename-feature.
- prepareRename
  Optional function for resolving and validating a position before running rename. The result can be a range or a range and a placeholder text. The placeholder text should be the identifier of the symbol which is being renamed - when omitted the text in the returned range is used.
- provideRenameEdits
  Provide an edit that describes changes that have to be made to one or many resources to rename a symbol to a different name.
https://code.visualstudio.com/api/language-extensions/programmatic-language-features
- https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#textDocument_prepareRename
  - Prepare Rename Request (↩️)
    The prepare rename request is sent from the client to the server to setup and test the validity of a rename operation at a given location.
- https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#textDocument_rename
- Rename Request
  The rename request is sent from the client to the server to ask the server to compute a workspace change so that the client can perform a workspace-wide rename of a symbol.
https://vshaxe.github.io/vscode-extern/vscode/RenameProvider.html
https://github.com/vshaxe/vscode-extern/blob/master/src/vscode/RenameProvider.hx

Based on the above, and the release notes explicitly mentioning copilot, I suspect the implementation will be in the Copilot extension itself (which isn't open-source):

https://marketplace.visualstudio.com/items?itemName=GitHub.copilot
Downloading that gives GitHub.copilot-1.168.741.vsix, which seems to just be a .zip file:

⇒ file GitHub.copilot-1.168.741.vsix

GitHub.copilot-1.168.741.vsix: Zip archive data, at least v2.0 to extract, compression method=deflate

Though unzipping that and searching for provideRename didn't seem to turn up anything useful unfortunately; so not sure if that means it's not implemented in the copilot extension, it doesn't use VSCode's 'rename provider' API, or I just wasn't looking right.

@0xdevalias commented on GitHub (Feb 29, 2024): Release detailed here: - https://github.com/microsoft/vscode/releases/tag/1.87.0 - https://github.com/microsoft/vscode/compare/1.87.0...1.86.2 Couldn't see any overly relevant commits in that range, but did find the following searching the issue manually: - https://github.com/microsoft/vscode/issues/206335 - https://github.com/microsoft/vscode/issues/206498 Which lead me to this label: - https://github.com/microsoft/vscode/issues?q=is%3Aopen+label%3Arename+sort%3Aupdated-desc And these issues, which sound like there are 'rename providers' used by the feature: - https://github.com/microsoft/vscode/issues/115354 - https://github.com/microsoft/vscode/issues/183075 More docs about rename providers here: - https://code.visualstudio.com/docs/editor/editingevolved#_rename-symbol - https://code.visualstudio.com/api/references/vscode-api#:~:text=registerRenameProvider( - https://code.visualstudio.com/api/references/vscode-api#RenameProvider - > RenameProvider > The rename provider interface defines the contract between extensions and the rename-feature. - > `prepareRename` > Optional function for resolving and validating a position before running rename. The result can be a range or a range and a placeholder text. The placeholder text should be the identifier of the symbol which is being renamed - when omitted the text in the returned range is used. - > `provideRenameEdits` > Provide an edit that describes changes that have to be made to one or many resources to rename a symbol to a different name. - https://code.visualstudio.com/api/language-extensions/programmatic-language-features - https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#textDocument_prepareRename - > Prepare Rename Request (:leftwards_arrow_with_hook:) > The prepare rename request is sent from the client to the server to setup and test the validity of a rename operation at a given location. - https://microsoft.github.io/language-server-protocol/specifications/lsp/3.17/specification/#textDocument_rename - > Rename Request > The rename request is sent from the client to the server to ask the server to compute a workspace change so that the client can perform a workspace-wide rename of a symbol. - https://vshaxe.github.io/vscode-extern/vscode/RenameProvider.html - https://github.com/vshaxe/vscode-extern/blob/master/src/vscode/RenameProvider.hx Based on the above, and the release notes explicitly mentioning copilot, I suspect the implementation will be in the Copilot extension itself (which isn't open-source): - https://marketplace.visualstudio.com/items?itemName=GitHub.copilot Downloading that gives `GitHub.copilot-1.168.741.vsix`, which seems to just be a `.zip` file: ```bash ⇒ file GitHub.copilot-1.168.741.vsix GitHub.copilot-1.168.741.vsix: Zip archive data, at least v2.0 to extract, compression method=deflate ``` Though unzipping that and searching for `provideRename` didn't seem to turn up anything useful unfortunately; so not sure if that means it's not implemented in the copilot extension, it doesn't use VSCode's 'rename provider' API, or I just wasn't looking right.

kerem commented

2026-03-03 13:52:07 +03:00

Author

Owner

@isidorn commented on GitHub (Mar 4, 2024):

Hi VS Code PM here,

A team member pointed me to this issue because it links to one of our VS Code issues.

I wanted to share that reverse engineering GitHub copilot is violating the general terms of the use agreement https://github.com/customer-terms/general-terms

Feel free to reach out to me if I can help with the general terms clarification inikolic@microsoft.com

Thank you
Isidor

@isidorn commented on GitHub (Mar 4, 2024): Hi VS Code PM here, A team member pointed me to this issue because it links to one of our VS Code issues. I wanted to share that reverse engineering GitHub copilot is violating the general terms of the use agreement https://github.com/customer-terms/general-terms Feel free to reach out to me if I can help with the general terms clarification inikolic@microsoft.com Thank you Isidor

kerem commented

2026-03-03 13:52:07 +03:00

Author

Owner

@0xdevalias commented on GitHub (Mar 5, 2024):

@isidorn It's less about "reverse engineering GitHub copilot" and more about "trying to figure out where the 'rename suggestions' change mentioned in the VSCode release notes was actually implemented; and what mechanism 'integrates' it into VSCode'".

The above is assumptions + an attempt to figure that out; but if you're able to point me to the actual issue/commit on the VSCode side (assuming it was implemented there), or confirm whether it's implemented on the closed source GitHub Copilot extension side of things (if it was implemented there), that would be really helpful.

If it was implemented on the GitHub Copilot extension side of things, then confirming whether the VSCode extension 'rename provider' is the right part of the VSCode extension API to look at to implement a similar feature would be awesome.

@0xdevalias commented on GitHub (Mar 5, 2024): @isidorn It's less about "reverse engineering GitHub copilot" and more about "trying to figure out where the 'rename suggestions' change mentioned in the VSCode release notes was actually implemented; and what mechanism 'integrates' it into VSCode'". The above is assumptions + an attempt to figure that out; but if you're able to point me to the actual issue/commit on the VSCode side (assuming it was implemented there), or confirm whether it's implemented on the closed source GitHub Copilot extension side of things (if it was implemented there), that would be really helpful. If it was implemented on the GitHub Copilot extension side of things, then confirming whether the VSCode extension 'rename provider' is the right part of the VSCode extension API to look at to implement a similar feature would be awesome.

kerem commented

2026-03-03 13:52:07 +03:00

Author

Owner

@ulugbekna commented on GitHub (Mar 5, 2024):

Thank you for taking interest in this API. The rename suggestions feature is powered by a proposed API defined here. Extensions provide the suggestions, while the vscode shows them in the rename widget.

@ulugbekna commented on GitHub (Mar 5, 2024): Thank you for taking interest in this API. The rename suggestions feature is powered by a [proposed API](https://code.visualstudio.com/api/advanced-topics/using-proposed-api) defined [here](https://github.com/microsoft/vscode/blob/8aca9a53311890fa54f0459c6ef2e8994d4d8ae4/src/vscode-dts/vscode.proposed.newSymbolNamesProvider.d.ts). Extensions provide the suggestions, while the vscode shows them in the rename widget.

kerem commented

2026-03-03 13:52:08 +03:00

Author

Owner

@0xdevalias commented on GitHub (Mar 6, 2024):

@ulugbekna Awesome; thanks for pointing that out! Shall have a closer read :)

Edit: See also:

https://github.com/search?q=repo%3Amicrosoft%2Fvscode%20NewSymbolNamesProvider&type=code

@0xdevalias commented on GitHub (Mar 6, 2024): @ulugbekna Awesome; thanks for pointing that out! Shall have a closer read :) **Edit:** See also: - https://github.com/search?q=repo%3Amicrosoft%2Fvscode%20NewSymbolNamesProvider&type=code

kerem commented

2026-03-03 13:52:08 +03:00

Author

Owner

@sagarika-fynd commented on GitHub (Mar 29, 2024):

I renamed all variables to unique names, and then ran the unminify code, most of the stuff was unminified, but i still had some random code, which wasnts, so i added a check to only rename variables which are in the pattern of my naming convention, and instructed the same to GPT, had to run this a few times, but it made sure sancity of previous naming convention was maintained

@sagarika-fynd commented on GitHub (Mar 29, 2024): I renamed all variables to unique names, and then ran the unminify code, most of the stuff was unminified, but i still had some random code, which wasnts, so i added a check to only rename variables which are in the pattern of my naming convention, and instructed the same to GPT, had to run this a few times, but it made sure sancity of previous naming convention was maintained

kerem commented

2026-03-03 13:52:08 +03:00

Author

Owner

@0xdevalias commented on GitHub (Aug 29, 2024):

Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed.

See also:

Semi-related:

#97

@0xdevalias commented on GitHub (Aug 29, 2024): > Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed. See also: - https://github.com/jehna/humanify/issues/20 - https://github.com/jehna/humanify/issues/67 --- Semi-related: - #97

kerem commented

2026-03-03 13:52:08 +03:00

Author

Owner

@0xdevalias commented on GitHub (Sep 29, 2024):

Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed.

Off the top of my head, if it's not easily solved via tweaking the prompt, you could potentially have it do a 'refinement/feedback round' where you provide feedback to the LLM + get it to correct the issues (which could be repeated up to X times) eg.

The following variables were already defined in the scope, so we can't use the names you chose. Please choose a new name for them so that they don't clash:

X

Y

Z

Just made a similar suggestion for this pattern while debugging another issue, referencing it here for continuity:

The proper fix would be to use toIdentifier from @babel/types

@j4k0xb @jehna From a 2sec search I couldn't find rendered docs, but here's the relevant source for each:

isValidIdentifier: github.com/babel/babel@a2025d7d69/packages/babel-types/src/validators/isValidIdentifier.ts (L7-L25)

toIdentifier: github.com/babel/babel@a2025d7d69/packages/babel-types/src/converters/toIdentifier.ts (L4-L26)

toIdentifier definitely seems like a more robust approach than the current 'prefix with _' approach for sure.

Though I wonder if a 'proper fix' should also involve tweaking how we prompt for/filter the suggestions coming back from the LLM itself as well. Like instead of just forcing an invalid suggestion to be valid (with toIdentifier), we could detect that it's invalid (with isValidIdentifier) and then provide that feedback to the LLM, asking it to give a new suggestion; probably with some max retry limit; after which we could fall back to using the invalid suggestion run through toIdentifier, or log a warning and leave it un-renamed or similar.

Originally posted by @0xdevalias in https://github.com/jehna/humanify/issues/117#issuecomment-2381046017

@0xdevalias commented on GitHub (Sep 29, 2024): > > Also it can happen that a variable gets renamed but another one with the same name already exists in the scope, or the code gets split up in such a way that not all references are renamed. > > Off the top of my head, if it's not easily solved via tweaking the prompt, you could potentially have it do a 'refinement/feedback round' where you provide feedback to the LLM + get it to correct the issues (which could be repeated up to X times) eg. > > > The following variables were already defined in the scope, so we can't use the names you chose. Please choose a new name for them so that they don't clash: > > > > - X > > - Y > > - Z Just made a similar suggestion for this pattern while debugging another issue, referencing it here for continuity: > > The proper fix would be to use `toIdentifier` from `@babel/types` > > @j4k0xb @jehna From a 2sec search I couldn't find rendered docs, but here's the relevant source for each: > > - `isValidIdentifier`: https://github.com/babel/babel/blob/a2025d7d695b0f3b0506f66225d6b15bcfa1cf6a/packages/babel-types/src/validators/isValidIdentifier.ts#L7-L25 > - `toIdentifier`: https://github.com/babel/babel/blob/a2025d7d695b0f3b0506f66225d6b15bcfa1cf6a/packages/babel-types/src/converters/toIdentifier.ts#L4-L26 > > `toIdentifier` definitely seems like a more robust approach than the current 'prefix with `_`' approach for sure. > > Though I wonder if a 'proper fix' should also involve tweaking how we prompt for/filter the suggestions coming back from the LLM itself as well. Like instead of just forcing an invalid suggestion to be valid (with `toIdentifier`), we could detect that it's invalid (with `isValidIdentifier`) and then provide that feedback to the LLM, asking it to give a new suggestion; probably with some max retry limit; after which we could fall back to using the invalid suggestion run through `toIdentifier`, or log a warning and leave it un-renamed or similar. > > _Originally posted by @0xdevalias in https://github.com/jehna/humanify/issues/117#issuecomment-2381046017_

kerem commented

2026-03-03 13:52:08 +03:00

Author

Owner

@jehna commented on GitHub (Oct 18, 2024):

Using BindingIdentifier instead of Identifier now, thanks for reporting this! Closing for now, should be fixed

@jehna commented on GitHub (Oct 18, 2024): Using `BindingIdentifier` instead of `Identifier` now, thanks for reporting this! Closing for now, should be fixed

kerem commented

2026-03-03 13:52:08 +03:00

Author

Owner

@0xdevalias commented on GitHub (Feb 18, 2025):

Using BindingIdentifier instead of Identifier now

For continuity, I believe this was implemented in: github.com/jehna/humanify@1fffcde1d1

github.com/jehna/humanify@311758f42f/src/plugins/local-llm-rename/visit-all-identifiers.ts (L68-L77)

@0xdevalias commented on GitHub (Feb 18, 2025): > Using `BindingIdentifier` instead of `Identifier` now For continuity, I believe this was implemented in: https://github.com/jehna/humanify/commit/1fffcde1d1bed609fb3e1b72171ea983e0c1d2bd https://github.com/jehna/humanify/blob/311758f42f1c1b4ce599b2e84116454bbfc000b7/src/plugins/local-llm-rename/visit-all-identifiers.ts#L68-L77

kerem referenced this issue

2026-03-03 13:53:06 +03:00

[PR #21] [CLOSED] Updating model to gpt-4o-mini #105

Rows
Columns

[GH-ISSUE #8] Unsafe identifier renames #5