build path.join called in require if args are string literals

src/probes/isRequire.js

@@ -11,6 +11,7 @@ import {
   getCallExpressionArguments
 } from "@nodesecure/estree-ast-utils";
 import { ProbeSignals } from "../ProbeRunner.js";
+import path from "path";
 
 function validateNodeRequire(node, { tracer }) {
   const id = getCallExpressionIdentifier(node, {
@@ -120,10 +121,12 @@ function main(node, options) {
 
     // require(Buffer.from("...", "hex").toString());
     case "CallExpression": {
-      walkRequireCallExpression(arg, tracer)
-        .forEach((depName) => analysis.addDependency(depName, node.loc, true));
+      const { dependencies, triggerWarning } = walkRequireCallExpression(arg, tracer);
+      dependencies.forEach((depName) => analysis.addDependency(depName, node.loc, true));
 
-      analysis.addWarning("unsafe-import", null, node.loc);
+      if (triggerWarning) {
+        analysis.addWarning("unsafe-import", null, node.loc);
+      }
 
       // We skip walking the tree to avoid anymore warnings...
       return ProbeSignals.Skip;
@@ -136,6 +139,7 @@ function main(node, options) {
 
 function walkRequireCallExpression(nodeToWalk, tracer) {
   const dependencies = new Set();
+  let triggerWarning = true;
 
   walk(nodeToWalk, {
     enter(node) {
@@ -181,11 +185,23 @@ function walkRequireCallExpression(nodeToWalk, tracer) {
           }
           break;
         }
+
+        case "path.join": {
+          if (!node.arguments.every((arg) => arg.type === "Literal" && typeof arg.value === "string")) {
+            break;
+          }
+
+          const constructedPath = path.posix.join(...node.arguments.map((arg) => arg.value));
+          dependencies.add(constructedPath);
+
+          triggerWarning = false;
+          break;
+        }
       }
     }
   });
 
-  return [...dependencies];
+  return { dependencies, triggerWarning };
 }
 
 export default {

test/issues/178-path-join-literal-args-is-not-unsafe.spec.js

@@ -0,0 +1,38 @@
+// Import Node.js Dependencies
+import { test } from "node:test";
+import assert from "node:assert";
+
+// Import Internal Dependencies
+import { runASTAnalysis } from "../../index.js";
+
+/**
+ * @see https://github.com/NodeSecure/js-x-ray/issues/178
+ */
+const validTestCases = [
+  "const bin = require(path.join('..', './bin.js'));",
+  "const bin = require.resolve(path.join('..', './bin.js'));"
+];
+
+test("should not detect unsafe-import for path.join if every argument is a string literal", () => {
+  validTestCases.forEach((test) => {
+    const { warnings, dependencies } = runASTAnalysis(test);
+
+    assert.strictEqual(warnings.length, 0);
+    assert.ok(dependencies.has("../bin.js"));
+  });
+});
+
+const invalidTestCases = [
+  "const bin = require(path.join(__dirname, '..', './bin.js'));",
+  "const bin = require(path.join(3, '..', './bin.js'));",
+  "const bin = require.resolve(path.join(__dirname, '..', './bin.js'));",
+  "const bin = require.resolve(path.join(3, '..', './bin.js'));"
+];
+
+test("should detect unsafe-import of path.join if not every argument is a string literal", () => {
+  invalidTestCases.forEach((test) => {
+    const { warnings } = runASTAnalysis(test);
+
+    assert.strictEqual(warnings.length, 1);
+  });
+});