fix: fix CodeQL issues (#222)

test-cases/onigtests/fixtures/typescript.js

@@ -24842,7 +24842,7 @@ var ts;
                 trace(state.host, ts.Diagnostics.Module_name_0_matched_pattern_1, moduleName, matchedPatternText);
             }
             return ts.forEach(state.compilerOptions.paths[matchedPatternText], function (subst) {
-                var path = matchedStar_1 ? subst.replace("*", matchedStar_1) : subst;
+                var path = matchedStar_1 ? subst.replace("*", matchedStar_1) : subst; // CodeQL [SM02383] According to the documentation at L24706, there is at most one matching asterisk.
                 var candidate = ts.normalizePath(ts.combinePaths(state.compilerOptions.baseUrl, path));
                 if (state.traceEnabled) {
                     trace(state.host, ts.Diagnostics.Trying_substitution_0_candidate_module_location_Colon_1, subst, path);
@@ -75586,7 +75586,7 @@ var ts;
                     var lineEnd = i < lastLineInFile ? ts.getPositionOfLineAndCharacter(file, i + 1, 0) : file.text.length;
                     var lineContent = file.text.slice(lineStart, lineEnd);
                     lineContent = lineContent.replace(/\s+$/g, ""); // trim from end
-                    lineContent = lineContent.replace("\t", " "); // convert tabs to single spaces
+                    lineContent = lineContent.replace(/\t/g, " "); // convert tabs to single spaces
                     // Output the gutter and the actual contents of the line.
                     context += formatColorAndReset(padLeft(i + 1 + "", gutterWidth), gutterStyleSequence) + gutterSeparator;
                     context += lineContent + host.getNewLine();
@@ -99163,7 +99163,7 @@ var ts;
                             ts.startsWith(relativeToBaseUrl, prefix) &&
                             ts.endsWith(relativeToBaseUrl, suffix)) {
                             var matchedStar = relativeToBaseUrl.substr(prefix.length, relativeToBaseUrl.length - suffix.length);
-                            return key.replace("*", matchedStar);
+                            return key.replace("*", matchedStar); // CodeQL [SM02383] According to the documentation at L24706, there is at most one matching asterisk.
                         }
                     }
                     else if (pattern === relativeToBaseUrl || pattern === relativeToBaseUrlWithIndex) {