OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The extension allows users to enter their own JavaScript code in the settings to customize how the tracker works. The code runs this custom script. This is a normal feature for advanced users, though it means the script can do anything the user can do in the browser.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The code uses `new Function` to execute JavaScript stored in the extension's settings (`extensionSettings.mesTrackerJavascript`). This setting is updated via a textarea input handler and persisted using `saveSettingsDebounced`. Executing user-provided JavaScript is an inherent risk, but since the input originates from the local user configuring their own extension settings, it aligns with expected behavior for advanced customization features in SillyTavern extensions.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- src/settings/settings.js:742