What causes "obfuscator produced empty output" in crowdsecurity/crowdsec?

Verify the obfuscator options — ensure no settings disable/minimize output to nothing.

obfuscator produced empty output

Error message

obfuscator produced empty output

What it means

In the initialbundle generator, after compiling and obfuscating the challenge JS, run() checks that the obfuscator returned a non-empty string. An empty result cannot be written as a usable bundle, so the tool fails with this error before writing the gzip output. This guards against the obfuscator silently producing nothing.

Source

Thrown at pkg/appsec/challenge/js/cmd/initialbundle/main.go:89

	r := wazero.NewRuntime(ctx)
	defer r.Close(ctx)

	if _, err := wasi_snapshot_preview1.Instantiate(ctx, r); err != nil {
		return fmt.Errorf("instantiate wasi: %w", err)
	}

	compiled, err := r.CompileModule(ctx, wasmBytes)
	if err != nil {
		return fmt.Errorf("compile obfuscator wasm: %w", err)
	}

	obfuscated, err := obfuscate(ctx, r, compiled, source)
	if err != nil {
		return fmt.Errorf("obfuscate: %w", err)
	}

	if obfuscated == "" {
		return errors.New("obfuscator produced empty output")
	}

	if err := writeGzip(outputPath, obfuscated); err != nil {
		return fmt.Errorf("write %s: %w", outputPath, err)
	}

	fmt.Fprintf(os.Stderr, "initialbundle: input %d bytes -> obfuscated %d bytes -> compressed file written\n",
		len(source), len(obfuscated))

	return nil
}

func buildSourceBundle() (string, error) {
	raw, err := os.ReadFile(challengeCodePath)
	if err != nil {
		return "", fmt.Errorf("read %s: %w", challengeCodePath, err)
	}

View on GitHub (pinned to 909b515798)

Solutions

Verify the obfuscator options — ensure no settings disable/minimize output to nothing.
Check that the esbuild-compiled input is non-empty before obfuscating; log its length.
Update/verify the obfuscator library version and its API usage.
Inspect the source map/entry selection so the compiled code actually reaches obfuscate().

Example fix

// before
obfuscated, err := obfuscate(ctx, r, compiled, source)
if err != nil { return err }
// after: pre-validate input and output
if compiled == "" { return errors.New("compiled input is empty") }
obfuscated, err := obfuscate(ctx, r, compiled, source)
if err != nil { return err }
if obfuscated == "" { return errors.New("obfuscator produced empty output") }

Defensive patterns

Strategy: validation

Validate before calling

if compiled == "" {
    return errors.New("compiled JS input is empty before obfuscation")
}

Try / catch

obfuscated, err := obfuscate(ctx, r, compiled, source)
if err != nil {
    return fmt.Errorf("obfuscate: %w", err)
}
if obfuscated == "" {
    return errors.New("obfuscator produced empty output")
}

Prevention

Sanity-check input length before each pipeline stage
Keep obfuscator options reviewed in version control
Pin the obfuscator library version
Add a CI check that the generated bundle is non-empty

When it happens

Trigger: obfuscate(ctx, r, compiled, source) returns err==nil but an empty string in run(), called from main.

Common situations: Obfuscator misconfiguration (options that strip all code); input source unexpectedly empty or a no-op after compilation; a version change in the obfuscator library changing its return conventions; piping the wrong stream into the obfuscator.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/aab34f94c10e365b. Report an issue: GitHub.