使用ProGuard模糊GWT Web應用程序

Question

我想使用Proguard來模糊我的GWT（Vaadin）應用程序。我以前從未混淆java代碼，這是我第一次嘗試使用Proguard。

我有我的配置文件設置如下：

-libraryjars JAVA_HOME\rt.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\appfoundation.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\blackboard-2.1.1.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\cssinject-0.9.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\eclipselink.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\eclipselink-jpa-modelgen_2.0.2.v20100323-r6872.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\gwt-visualization.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\iText-5.0.4.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\javax.persistence_1.0.0.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\javax.persistence_2.0.0.v201002051058.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\vaadin-6.4.4.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\vaadin-calendar-0.5.1.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\vaadin-chameleon-theme-1.0.1.jar 
-libraryjars MYPATH\test\WebContent\WEB-INF\lib\VisualizationsForVaadin.jar 
-libraryjars "C:\Program Files\eclipse\configuration\com.vaadin.integration.eclipse\download\gwt-dev\2.0.3\gwt-dev.jar" 
-libraryjars "C:\Program Files\eclipse\configuration\com.vaadin.integration.eclipse\download\gwt-user\2.0.3\gwt-user.jar" 
-injars test.war 
-outjar test_after.war 
-printseeds 
-ignorewarnings 
-keep public class TestApplication extends com.vaadin.Application { 
public void init(); 
} 

然後我執行使用ProGuard的命令：

java -jar proguard.jar @test.pro 

我不得到與配置文件中的任何錯誤，但我確實收到很多警告。輸出文件被創建，但我很擔心警告。我需要在我的配置文件中指定更多的jar文件嗎？我列出了我在應用程序中使用的所有罐子。還有什麼我做錯了嗎？

下面是過去的20〜行命令行輸出的

感謝的文檔片斷預先

S.

 Maybe this is library method 'sun.jdbc.odbc.JdbcOdbcStatement { java.sql.Connection getConnection(); }' 
     Maybe this is library method 'sun.jdbc.odbc.ee.CommonDataSource { java.sql.Connection getConnection(); }' 
     Maybe this is library method 'sun.jdbc.odbc.ee.ConnectionPoolDataSource {java.sql.Connection getConnection(); }' 
     Maybe this is library method 'sun.jdbc.odbc.ee.DataSource { java.sql.Connection getConnection(); }' 
     Maybe this is library method 'sun.jdbc.odbc.ee.PooledConnection { java.sql.Connection getConnection(); }' 
     Maybe this is library method 'sun.rmi.transport.StreamRemoteCall { sun.rmi.transport.Connection getConnection(); }' 
Note: org.eclipse.persistence.sdo.helper.DynamicClassWriter accesses a declared method 'writeReplace()' dynamically 
     Maybe this is program method 'org.eclipse.persistence.sdo.SDODataObject {java.lang.Object writeReplace(); }' 
     Maybe this is program method 'org.eclipse.persistence.sdo.helper.ListWrapper { java.lang.Object writeReplace(); }' 
     Maybe this is library method 'com.sun.corba.se.impl.presentation.rmi.InvocationHandlerFactoryImpl$CustomCompositeInvocationHandlerImpl { 
Note: there were 4 unresolved dynamic references to classes or interfaces. 
     You should check if you need to specify additional program jars. 
Note: there were 10 accesses to class members by means of introspection. 
     You should consider explicitly keeping the mentioned class members 
     (using '-keep' or '-keepclassmembers'). 
Warning: there were 3649 unresolved references to classes or interfaces. 
     You may need to specify additional library jars (using '-libraryjars'). 

Warning: there were 173 unresolved references to program class members. 
     Your input classes appear to be inconsistent. 
     You may need to recompile them and try again. 
     Alternatively, you may have to specify the option 
     '-dontskipnonpubliclibraryclassmembers'. 

Answer 1

GWT兩個部分生成代碼。

1. 客戶端代碼。這是在瀏覽器中運行的內容，由用戶界面和對服務器的任何異步調用組成。當您編寫Java源代碼時，它會直接從源代碼轉換爲Javascript。即GWT編譯器甚至不會查看類文件。要混淆生成的JS，請使用GWT編譯器標誌（請參閱下文）
2. 服務器端代碼。服務器代碼將是您的客戶端應用程序調用的終點。例如您可能會調用GWT RPC調用並將GWT servlet作爲終點。混淆您的網絡應用程序，就像您通過Proguard或其他類似軟件進行嘗試和錯誤一樣。從一個簡單的配置開始，輕輕混淆然後從那裏繼續。

由於GWT客戶端是從Java源代碼生成的，所以在提供給GWT之前沒有簡單的混淆方法。我想你可以通過Proguard進行混淆，然後反編譯並將其提供給GWT編譯器。這似乎是過度殺傷，但它可能是可能的。

混淆的正常方法是爲GWT編譯器指定-style OBF。這將徹底混淆你的代碼。你可能會走得更遠，並通過另一個JS混淆器運行它，儘管收益遞減規律，錯誤等都適用。

我建議你理解當你提供OBF作爲樣式時會產生什麼。你的目的可能已經足夠了。顯然，服務器端放置的東西越多（例如安全性，cookie驗證等），客戶端中的代碼就越少。