Opy在处理多行或隐式字符串的拼接时存在漏洞（Opy has a vulnerability when handling the concatenation of multiple lines or implicit strings）

[yuyifan0723]

原文（original text）：
问题挺简单的，就是不支持Python的隐式字符串拼接。目前是使用多行隐式字符串拼接进行测试的，比如下面这个例子：

test_string = (
    "你好"
    "世界"
)

按理来说，test_string会被Python解释器拼接为"你好世界"这一行字符串，中间不需要显式添加符号。但将代码交给Opy混淆后，可能就会变成下面这个样子

l1ll1111ll1l11_opy_ = (
    l11lllll1_opy_ (u"……")
    l11lllll1_opy_ (u"……")
)

很明显，经Opy处理后，Python解释器不再能理解这种表达式，所以会直接报出语法错误，正确的处理方式应该是显式添加合并符，或者是合并后再加密，例如：

l1ll1111ll1l11_opy_ = (
    l11lllll1_opy_ (u"......" ) +
    l11lllll1_opy_ (u"......" )
))

或

l1ll1111ll1l11_opy_ = (
    l11lllll1_opy_ (u"......(我不确定合并后他们会变成什么)" )
)

希望这个问题能被修复。

English:
The problem is quite simple. It's the lack of support for implicit string concatenation in Python. Currently, we are testing it using multi-line implicit string concatenation, such as in the following example:

test_string = (
    "Hello "
    "World" 
)

According to theory, the "test_string" would be concatenated by the Python interpreter into the line string "Hello World"， without the need for explicit addition of symbols in the middle. However, when the code is handed over to Opy obfuscation， it might become something like this:

l1ll1111ll1l11_opy_ = (
    l11lllll1_opy_ (u"……" )
    l11lllll1_opy_ (u"……" )
)

Obviously, after being processed by Opy, the Python interpreter can no longer understand this expression, so it will directly report a syntax error. The correct approach should be to explicitly add the merge symbol, or to merge and then encrypt, for example:

l1ll1111ll1l11_opy_ = (
    l11lllll1_opy_ (u"……" ) +
    l11lllll1_opy_ (u"……" )
)

or

l1ll1111ll1l11_opy_ = (
    l11lllll1_opy_ (u"……(I'm not sure what they will become after the merger)" )
)

Hope this issue can be fixed.

[yuyifan0723]

原文（original text）：
我编写了4个函数，用于批量修改我的代码，在使用_fix_implicit_string_concat处理代码后，问题就被成功解决了。这些代码可以直接用于Opy修复，直接避开问题。代码如下：

def _fix_implicit_string_concat(content: str) -> str:
    """修复隐式字符串拼接，在相邻字符串字面量之间插入 +
    匹配模式：字符串字面量后面紧跟（可选空白/换行/注释）另一个字符串字面量
    """
    # 匹配 Python 字符串字面量（单引号/双引号/三引号，含前缀 r/b/f/u/F/R/B/U）
    # 简化处理：逐行扫描，检测括号内的隐式拼接
    # 更简单可靠的方法：逐行处理，检测括号内的隐式拼接
    lines = content.split("\n")
    result_lines = []
    i = 0
    while i < len(lines):
        line = lines[i]
        # 检测是否在括号上下文中（赋值/参数列表中的多行字符串拼接）
        # 策略：如果一行以字符串字面量结尾（后跟可选逗号），且下一行以字符串字面量开头
        # 则在当前行末尾添加 +

        stripped = line.rstrip()
        # 检查当前行是否以字符串字面量结尾（不含逗号）
        if _line_ends_with_string_literal(stripped):
            # 检查下一行是否以字符串字面量开头
            if i + 1 < len(lines):
                next_stripped = lines[i + 1].lstrip()
                if _line_starts_with_string_literal(next_stripped):
                    # 检查是否在括号上下文中（当前行有未闭合的括号，或之前有）
                    if _is_in_paren_context(line, result_lines):
                        # 在当前行末尾添加 +
                        line = stripped + " +"

        result_lines.append(line)
        i += 1

    return "\n".join(result_lines)


def _line_ends_with_string_literal(line: str) -> bool:
    """检查行是否以字符串字面量结尾（不含逗号、冒号等）"""
    # 去掉行尾注释
    # 简单匹配：行尾是引号结尾，且前面不是 + - * / % & | ^ = < > ! , : 等运算符
    # 也不匹配以逗号结尾的行（那是元组，不是隐式拼接）
    stripped = line.rstrip()
    if not stripped:
        return False
    # 不能以逗号、冒号、反斜杠结尾
    if stripped[-1] in (',', ':', '\\'):
        return False
    # 以引号结尾
    if stripped[-1] not in ('"', "'"):
        return False
    # 检查是否是三引号结尾
    if stripped.endswith('"""') or stripped.endswith("'''"):
        return True
    # 单/双引号结尾，检查前面不是运算符
    if len(stripped) >= 2:
        prev_char = stripped[-2] if stripped[-1] in ('"', "'") else stripped[-1]
        # 前一个字符不能是运算符（排除 s + "xxx" 这种显式拼接）
        if prev_char in '+-*/%&|^=<>!':
            return False
    return True


def _line_starts_with_string_literal(line: str) -> bool:
    """检查行是否以字符串字面量开头"""
    stripped = line.lstrip()
    if not stripped:
        return False
    # 检查是否以字符串前缀或引号开头
    i = 0
    # 跳过字符串前缀
    while i < len(stripped) and stripped[i].lower() in 'rbuf':
        i += 1
    if i >= len(stripped):
        return False
    # 检查是否是引号
    if stripped[i] in ('"', "'"):
        return True
    return False


def _is_in_paren_context(current_line: str, prev_lines: list) -> bool:
    """检查是否在括号上下文中（隐式拼接只发生在括号内）"""
    # 计算未闭合的括号数
    paren_depth = 0
    # 检查最近几行
    check_lines = prev_lines[-20:] + [current_line]
    for line in check_lines:
        in_string = False
        string_char = None
        j = 0
        while j < len(line):
            c = line[j]
            if in_string:
                if c == '\\':
                    j += 1  # 跳过转义
                elif c == string_char:
                    # 检查三引号
                    if j + 2 < len(line) and line[j:j+3] == string_char * 3:
                        in_string = False
                        j += 2
                    else:
                        in_string = False
            else:
                if c in ('"', "'"):
                    # 检查三引号
                    if j + 2 < len(line) and line[j:j+3] == c * 3:
                        # 跳过三引号字符串
                        end = line.find(c * 3, j + 3)
                        if end != -1:
                            j = end + 2
                        else:
                            in_string = True
                            string_char = c * 3
                    else:
                        in_string = True
                        string_char = c
                elif c == '(':
                    paren_depth += 1
                elif c == ')':
                    paren_depth -= 1
            j += 1

    return paren_depth > 0

希望能派上用场。

English:
I wrote four functions to batch modify my code. After processing the code with _fix_implicit_string_concat, the problem was successfully resolved. These codes can be directly used for Opy fixes, bypassing the problem altogether. The codes are as follows:

def _fix_implicit_string_concat(content: str) -> str:
    """Fix implicit string concatenation by inserting + between adjacent string literals
    Matching pattern: a string literal followed by another string literal (with optional whitespace/newlines/comments in between)
    """
    # Match Python string literals (single/double/triple quotes, including prefixes r/b/f/u/F/R/B/U)
    # Simplified processing: scan line by line and detect implicit concatenation inside parentheses
    # A simpler and more reliable approach: process line by line and detect implicit concatenation inside parentheses
    lines = content.split("\n")
    result_lines = []
    i = 0
    while i < len(lines):
        line = lines[i]
        # Detect if in a parenthesis context (multi-line string concatenation in assignments/argument lists)
        # Strategy: if a line ends with a string literal (followed by optional comma), and the next line starts with a string literal
        # Then add + at the end of the current line

        stripped = line.rstrip()
        # Check if the current line ends with a string literal (without a trailing comma)
        if _line_ends_with_string_literal(stripped):
            # Check if the next line starts with a string literal
            if i + 1 < len(lines):
                next_stripped = lines[i + 1].lstrip()
                if _line_starts_with_string_literal(next_stripped):
                    # Check if in a parenthesis context (unclosed parentheses in current line or previous lines)
                    if _is_in_paren_context(line, result_lines):
                        # Add + at the end of the current line
                        line = stripped + " +"

        result_lines.append(line)
        i += 1

    return "\n".join(result_lines)


def _line_ends_with_string_literal(line: str) -> bool:
    """Check if a line ends with a string literal (excluding commas, colons, etc.)"""
    # Remove trailing comments from the line
    # Simple match: line ends with a quote, and the preceding character is not an operator like + - * / % & | ^ = < > ! , :
    # Also exclude lines ending with a comma (those are tuples, not implicit concatenation)
    stripped = line.rstrip()
    if not stripped:
        return False
    # Cannot end with comma, colon, or backslash
    if stripped[-1] in (',', ':', '\\'):
        return False
    # Ends with a quote
    if stripped[-1] not in ('"', "'"):
        return False
    # Check if it ends with triple quotes
    if stripped.endswith('"""') or stripped.endswith("'''"):
        return True
    # Ends with single/double quote, check the preceding character is not an operator
    if len(stripped) >= 2:
        prev_char = stripped[-2] if stripped[-1] in ('"', "'") else stripped[-1]
        # The preceding character cannot be an operator (exclude explicit concatenation like s + "xxx")
        if prev_char in '+-*/%&|^=<>!':
            return False
    return True


def _line_starts_with_string_literal(line: str) -> bool:
    """Check if a line starts with a string literal"""
    stripped = line.lstrip()
    if not stripped:
        return False
    # Check if it starts with a string prefix or quote
    i = 0
    # Skip string prefixes
    while i < len(stripped) and stripped[i].lower() in 'rbuf':
        i += 1
    if i >= len(stripped):
        return False
    # Check if it is a quote
    if stripped[i] in ('"', "'"):
        return True
    return False


def _is_in_paren_context(current_line: str, prev_lines: list) -> bool:
    """Check if in a parenthesis context (implicit concatenation only occurs inside parentheses)"""
    # Calculate the number of unclosed parentheses
    paren_depth = 0
    # Check the last few lines
    check_lines = prev_lines[-20:] + [current_line]
    for line in check_lines:
        in_string = False
        string_char = None
        j = 0
        while j < len(line):
            c = line[j]
            if in_string:
                if c == '\\':
                    j += 1  # Skip escaped characters
                elif c == string_char:
                    # Check for triple quotes
                    if j + 2 < len(line) and line[j:j+3] == string_char * 3:
                        in_string = False
                        j += 2
                    else:
                        in_string = False
            else:
                if c in ('"', "'"):
                    # Check for triple quotes
                    if j + 2 < len(line) and line[j:j+3] == c * 3:
                        # Skip triple-quoted string
                        end = line.find(c * 3, j + 3)
                        if end != -1:
                            j = end + 2
                        else:
                            in_string = True
                            string_char = c * 3
                    else:
                        in_string = True
                        string_char = c
                elif c == '(':
                    paren_depth += 1
                elif c == ')':
                    paren_depth -= 1
            j += 1

    return paren_depth > 0

Hope it will be of use.

[yuyifan0723]

原文（original text）：
多行字符串也会出现问题，我懒得多写了，和上面的代码结合就可以了，以下是修复代码：

def _fix_multiline_strings(content: str) -> str:
    """将多行三引号字符串转为单行字符串，避免 Opy 混淆时破坏多行结构

    例如：
        s = """hello
        world"""
    转为：
        s = "hello\nworld"
    """
    result = []
    i = 0
    length = len(content)

    while i < length:
        # 检查是否是字符串前缀
        prefix = ""
        prefix_start = i
        while i < length and content[i].lower() in 'rbuf':
            prefix += content[i]
            i += 1

        if i >= length:
            result.append(content[prefix_start:])
            break

        # 检查是否是三引号
        if content[i] in ('"', "'") and i + 2 < length and content[i] * 3 == content[i:i+3]:
            quote_char = content[i]
            triple_quote = quote_char * 3
            i += 3  # 跳过开头三引号

            # 查找结尾三引号
            end = content.find(triple_quote, i)
            if end == -1:
                # 未找到结尾，保留原样
                result.append(content[prefix_start:])
                break

            # 提取字符串内容
            string_body = content[i:end]
            i = end + 3  # 跳过结尾三引号

            # 检查是否是多行的（包含换行符）
            if '\n' in string_body or '\r' in string_body:
                # 转为单行字符串
                # 处理转义：先处理已有的反斜杠，再处理换行
                # 保留原始前缀（r/b/f/u）
                is_raw = 'r' in prefix.lower()
                is_bytes = 'b' in prefix.lower()

                if is_raw:
                    # raw 字符串：不处理转义，只替换换行
                    # raw 字符串中 \n 是字面量两个字符，不需要额外转义
                    # 但换行符需要变为 \\n（raw 字符串中的 \n 字面量）
                    # 实际上 raw 多行字符串转单行比较复杂，直接用非 raw 替代
                    # 去掉 r 前缀，手动转义反斜杠
                    new_body = string_body.replace('\\', '\\\\')
                    new_body = new_body.replace('\r\n', '\\n')
                    new_body = new_body.replace('\n', '\\n')
                    new_body = new_body.replace('\r', '\\n')
                    new_body = new_body.replace(quote_char, '\\' + quote_char)
                    new_prefix = prefix.replace('r', '').replace('R', '')
                    if not new_prefix and is_bytes:
                        new_prefix = 'b'
                    result.append(f'{new_prefix}{quote_char}{new_body}{quote_char}')
                else:
                    # 非 raw 字符串
                    new_body = string_body
                    # 替换换行
                    new_body = new_body.replace('\r\n', '\\n')
                    new_body = new_body.replace('\n', '\\n')
                    new_body = new_body.replace('\r', '\\n')
                    # 转义引号（如果和字符串引号相同）
                    new_body = new_body.replace(quote_char, '\\' + quote_char)
                    result.append(f'{prefix}{quote_char}{new_body}{quote_char}')
            else:
                # 单行三引号，转为单引号
                # 需要转义内容中的引号
                new_body = string_body.replace(quote_char, '\\' + quote_char)
                result.append(f'{prefix}{quote_char}{new_body}{quote_char}')
        else:
            # 不是三引号，保留前缀字符和当前字符
            result.append(content[prefix_start:i + 1] if i < length else content[prefix_start:])
            i += 1

    return "".join(result)

English:
Multiline strings can also encounter problems. I was too lazy to write them out. Just combine them with the above code, and here is the fixed code:

def _fix_multiline_strings(content: str) -> str:
    """Convert multi-line triple-quoted strings to single-line strings to avoid breaking multi-line structures when obfuscated by Opy

    Example:
        s = """hello
        world"""
    Converts to:
        s = "hello\nworld"
    """
    result = []
    i = 0
    length = len(content)

    while i < length:
        # Check for string prefixes (r, b, u, f)
        prefix = ""
        prefix_start = i
        while i < length and content[i].lower() in 'rbuf':
            prefix += content[i]
            i += 1

        if i >= length:
            result.append(content[prefix_start:])
            break

        # Check for triple quotes
        if content[i] in ('"', "'") and i + 2 < length and content[i] * 3 == content[i:i+3]:
            quote_char = content[i]
            triple_quote = quote_char * 3
            i += 3  # Skip opening triple quotes

            # Find closing triple quotes
            end = content.find(triple_quote, i)
            if end == -1:
                # Closing quotes not found, keep original
                result.append(content[prefix_start:])
                break

            # Extract string content
            string_body = content[i:end]
            i = end + 3  # Skip closing triple quotes

            # Check if it's multi-line (contains newlines)
            if '\n' in string_body or '\r' in string_body:
                # Convert to single-line string
                # Handle escaping: process existing backslashes first, then newlines
                # Preserve original prefix (r/b/f/u)
                is_raw = 'r' in prefix.lower()
                is_bytes = 'b' in prefix.lower()

                if is_raw:
                    # Raw string: do not process escapes, only replace newlines
                    # In raw strings, \n is two literal characters and doesn't need extra escaping
                    # But newlines need to be converted to \\n (literal \n in raw strings)
                    # Converting multi-line raw strings to single-line is complex; replace with non-raw
                    # Remove r prefix and manually escape backslashes
                    new_body = string_body.replace('\\', '\\\\')
                    new_body = new_body.replace('\r\n', '\\n')
                    new_body = new_body.replace('\n', '\\n')
                    new_body = new_body.replace('\r', '\\n')
                    new_body = new_body.replace(quote_char, '\\' + quote_char)
                    new_prefix = prefix.replace('r', '').replace('R', '')
                    if not new_prefix and is_bytes:
                        new_prefix = 'b'
                    result.append(f'{new_prefix}{quote_char}{new_body}{quote_char}')
                else:
                    # Non-raw string
                    new_body = string_body
                    # Replace newlines
                    new_body = new_body.replace('\r\n', '\\n')
                    new_body = new_body.replace('\n', '\\n')
                    new_body = new_body.replace('\r', '\\n')
                    # Escape quotes if they match the string quote character
                    new_body = new_body.replace(quote_char, '\\' + quote_char)
                    result.append(f'{prefix}{quote_char}{new_body}{quote_char}')
            else:
                # Single-line triple quotes, convert to regular quotes
                # Escape quotes inside the content
                new_body = string_body.replace(quote_char, '\\' + quote_char)
                result.append(f'{prefix}{quote_char}{new_body}{quote_char}')
        else:
            # Not triple quotes, keep prefix and current character
            result.append(content[prefix_start:i + 1] if i < length else content[prefix_start:])
            i += 1

    return "".join(result)

[yuyifan0723]

还有，不要问我为什么不拉取一个新的分支，我懒~（Also, don't ask me why I didn't pull in a new branch. I'm just being lazy~）

[yuyifan0723]

最后声明一下，这里建议大家写代码的时候还是使用显式拼接比较好，目前这段修复代码对于中括号、大括号内的多行隐式拼接检测不到位，若出现问题，还请手动修复一下。
Finally, let me make a clear statement: It is recommended that when writing code, explicit concatenation is still a better choice. Currently, this fix code is not fully capable of detecting implicit concatenation within square brackets and curly braces. If any issues arise, please manually correct them.