# I keep getting rejected b/c of obfuscated code, please help me find my obfuscated code

**URL:** <https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125>\
**Category:** Extensions\
**Created:** [September 21, 2017, 10:08pm UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125 "2017-09-21T22:08:46Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![guanzo](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/guanzo/32/3833_2.png) [@guanzo](https://discuss.dev.twitch.com/u/guanzo)\
**Post date:** [September 21, 2017, 10:08pm UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/1 "2017-09-21T22:08:46Z")

</div>

I’ve been rejected 3 times now because of obfuscated code. The first 2 times were justified because of my own mistakes, however this most recent rejection is questionable.

Project here: [dist.zip](https://drive.google.com/file/d/0B4JlenpxodYeZEg5cDEzcWUxNk0/view?usp=sharing)

I’ve made sure that my javascript files are not minified and obfuscated. Maybe they are talking about my html/css/map files? Those files are minified, they are not obfuscated. Anyone can put these files into a beautifier and see the source code. Surely they don’t care about minified css right? I also submit the Github link for this project during the review, but they don’t seem to care about that.

I have complaints about the review process in general. They only mentioned “Your Extension appears to contain insecure content. Please make sure all links, images, and requests are HTTPS only.” on the THIRD submission attempt. There are too many submission requirements, you can’t just list the first problem and click “reject”, when there are potentially other problems that would justify a rejection.

EDIT: I had already disabled all UglifyJS options before my most recent submission. I even enabled the `beautify` option for purposeful formatting.

---

<div class="post-metadata">

**Author:** ![dhQk](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dhqk/32/3386_2.png) [@dhQk](https://discuss.dev.twitch.com/u/dhQk)\
**Post date:** [September 21, 2017, 11:15pm UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/2 "2017-09-21T23:15:39Z")

</div>

all your js files are “obfuscated” using webpak

edit: to expand on this, your code should be “human” readable. a function named “+ZMJ” doesn’t convey what the function actually does.

---

<div class="post-metadata">

**Author:** ![guanzo](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/guanzo/32/3833_2.png) [@guanzo](https://discuss.dev.twitch.com/u/guanzo)\
**Post date:** [September 21, 2017, 11:42pm UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/3 "2017-09-21T23:42:58Z")

</div>

So am I just screwed then? It’s not feasible for me to dig into webpacks code and change the way it works, and I don’t think i can change this behavior thru webpack config.

Can someone who’s successfully submitted an extension built by Webpack help me?

---

<div class="post-metadata">

**Author:** ![dhQk](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dhqk/32/3386_2.png) [@dhQk](https://discuss.dev.twitch.com/u/dhQk)\
**Post date:** [September 21, 2017, 11:46pm UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/4 "2017-09-21T23:46:36Z")

</div>

ill take a look, but maybe staff my able to chime in because i just inspected streamlabs extension and they have vue and webpack so it might be something else entirely thats triggering it

---

<div class="post-metadata">

**Author:** ![Dist](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/dist/32/7192_2.png) [@Dist](https://discuss.dev.twitch.com/u/Dist)\
**Post date:** [September 22, 2017, 12:42am UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/5 "2017-09-22T00:42:19Z")

</div>

I don’t see why you wouldn’t be able to use webpack without obfuscating the code. When in development mode it does the normal bundling process but without uglify/minificaiton or anything like that, and when building for production you can set up the webpack configuration in a similar way and just not do those steps.

---

<div class="post-metadata">

**Author:** ![Alca](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/alca/32/2783_2.png) [@Alca](https://discuss.dev.twitch.com/u/Alca)\
**Post date:** [September 22, 2017, 12:58am UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/6 "2017-09-22T00:58:13Z")

</div>

```auto
module.exports = {
  build: {
    extend (config) {
      config.plugins = config.plugins.filter((plugin) => plugin.constructor.name !== 'UglifyJsPlugin')
    }
  }
}

```

> <https://github.com/nuxt/nuxt.js/issues/250#issuecomment-280681399>

---

<div class="post-metadata">

**Author:** ![guanzo](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/guanzo/32/3833_2.png) [@guanzo](https://discuss.dev.twitch.com/u/guanzo)\
**Post date:** [September 22, 2017, 1:20am UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/7 "2017-09-22T01:20:39Z")

</div>

UglifyJS was not active during my most recent submission.

Here is the config

```
    new webpack.optimize.UglifyJsPlugin({
      compress: false,
      mangle: false,
      output: { beautify: true },
      sourceMap: true
    }),

```

You can see that i even turned on `beautify`.

If you examine my js files you can see my original source code underneath all the webpack code.

My Code:

```
<script>
import { START_NEW_VOTE } from '@/store/actions'
import voteResults from '@/components/viewer/VoteResults'

export default {
	name: 'live-config',
    methods:{
        startVote(){
            this.$store.dispatch(START_NEW_VOTE)
        }
    },
    components:{
        voteResults
    }
}
</script>

```

Webpack output code:

```
"7Q9G": function(module, __webpack_exports__ , __webpack_require__ ) {
	"use strict";
	var __WEBPACK_IMPORTED_MODULE_0__ store_actions __=__ webpack_require__("mUbh");
	var __WEBPACK_IMPORTED_MODULE_1__ components_viewer_VoteResults __=__ webpack_require__("vVR9");
	__webpack_exports__ ["a"] = {
		name: "live-config",
		methods: {
			startVote: function startVote() {
				this.$store.dispatch( __WEBPACK_IMPORTED_MODULE_0__ store_actions__["c"]);
			}
		},
		components: {
			voteResults: __WEBPACK_IMPORTED_MODULE_1__ components_viewer_VoteResults__["a"]
		}
	};
},

```

I don’t think the webpack code can be labeled “obfuscated”.

In response to the first poster

> to expand on this, your code should be “human” readable. a function named “+ZMJ” doesn’t convey what the function actually does.

These cryptic function names are the module id’s that webpack assigns. They have nothing to do with the twitch extension logic itself, which is what Twitch is concerned about.

If Twitch could just specify which file violated the obfuscation rule, we could all avoid wasting time on speculation.

---

<div class="post-metadata">

**Author:** ![StreamDecker](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/streamdecker/32/3526_2.png) [@StreamDecker](https://discuss.dev.twitch.com/u/StreamDecker)\
**Post date:** [September 27, 2017, 6:48am UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/8 "2017-09-27T06:48:32Z")

</div>

Did you get it approved im writing my Extension in react +redux and i’m using webpack and i’m getting it kicked back aswell

---

<div class="post-metadata">

**Author:** ![guanzo](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/guanzo/32/3833_2.png) [@guanzo](https://discuss.dev.twitch.com/u/guanzo)\
**Post date:** [September 27, 2017, 9:37pm UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/9 "2017-09-27T21:37:23Z")

</div>

Nope. A twitch member reached out to me and i was able to ask a lot of questions about webpack and the review process. I’m still waiting for a response. I’ll post in this thread once i get one.

---

<div class="post-metadata">

**Author:** ![IllusionaryOne](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/illusionaryone/32/2011_2.png) [@IllusionaryOne](https://discuss.dev.twitch.com/u/IllusionaryOne)\
**Post date:** [September 28, 2017, 12:05am UTC](https://discuss.dev.twitch.com/t/i-keep-getting-rejected-b-c-of-obfuscated-code-please-help-me-find-my-obfuscated-code/12125/10 "2017-09-28T00:05:02Z")

</div>

Just a general comment. When I write software for enterprise clients, they use a third party service, such as Veracode, to inspect the code. I only submit obfuscated code and they are somehow able to verify if a web page or application is safe. I can also submit binaries, without debugging symbols, and they can perform security scans and validate software for large enterprises. Is Twitch really reading files line by line as a security process? That seems error prone to say the least.