add support for ESM; add check for newExpr; complement taint matching

src/checker/taint/common-kit/source-util.ts

@@ -157,6 +157,12 @@ function introduceFuncArgTaintByRuleConfig(scope: any, node: any, callInfo: Call
             }
             break
           }
+        } else if (call.name === tspec.fsig) {
+          const args = prepareArgs(callInfo, undefined, tspec)
+          for (let i = 0; i < args.length; i++) {
+            markTaintSource(args[i], { path: node, kind: tspec.kind })
+          }
+          break
         }
       }
     }

src/checker/taint/js/js-taint-checker.ts

@@ -278,6 +278,22 @@ class JsTaintChecker extends TaintChecker {
       }
     }
   }
+
+  /**
+   *
+   * @param analyzer
+   * @param scope
+   * @param node
+   * @param state
+   * @param info
+   */
+  triggerAtNewExprAfter(analyzer: any, scope: any, node: any, state: any, info: any) {
+    if (config.analyzer !== 'JavaScriptAnalyzer') {
+      return
+    }
+    const { fclos, callInfo } = info
+    this.checkSinkAtFunctionCall(node, fclos, callInfo, state)
+  }
 
   /**
    *

src/engine/analyzer/javascript/common/js-analyzer.ts

@@ -835,24 +835,35 @@ class JsAnalyzer extends Analyzer {
     // handle ext
     if (!fs.existsSync(pathname) || !fs.statSync(pathname).isFile()) {
       let isExist = false
-      let cwd
-      let filename
-
-      cwd = path.join(pathname, '../')
-      filename = pathname.split('/').pop()
-      const files = [`${filename}.(js|ts|mjs|cjs)`]
-      const filepaths = globby.sync(files, { cwd, caseSensitiveMatch: false })
-      if (filepaths && filepaths.length !== 0) {
-        pathname = path.join(cwd, filepaths[0])
-        isExist = true
-      } else if (fs.existsSync(pathname)) {
-        cwd = pathname
-        filename = '(i|I)ndex'
+
+      if (pathname.endsWith('.js')) { // handle ts
+        const tsPathname = pathname.replace(/\.js$/, '.ts')
+        if (fs.existsSync(tsPathname) && fs.statSync(tsPathname).isFile()) {
+          pathname = tsPathname
+          isExist = true
+        }
+      }
+
+      if (!isExist) {
+        let cwd
+        let filename
+
+        cwd = path.join(pathname, '../')
+        filename = pathname.split('/').pop()
         const files = [`${filename}.(js|ts|mjs|cjs)`]
         const filepaths = globby.sync(files, { cwd, caseSensitiveMatch: false })
         if (filepaths && filepaths.length !== 0) {
-          pathname = path.join(pathname, filepaths[0])
+          pathname = path.join(cwd, filepaths[0])
           isExist = true
+        } else if (fs.existsSync(pathname)) {
+          cwd = pathname
+          filename = '(i|I)ndex'
+          const files = [`${filename}.(js|ts|mjs|cjs)`]
+          const filepaths = globby.sync(files, { cwd, caseSensitiveMatch: false })
+          if (filepaths && filepaths.length !== 0) {
+            pathname = path.join(pathname, filepaths[0])
+            isExist = true
+          }
         }
       }