TavernKeeper Scan Report

luisbrandao/SillyTavern-Tracker

Commit 657b8a8 Reviewed

No material or high-risk concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 0 material 1 low

What this review found

No material or high-risk item was identified.

Expected scanner matches (1)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The extension allows users to enter their own JavaScript code in the settings to customize how the tracker works. The code runs this custom script. This is a normal feature for advanced users, though it means the script can do anything the user can do in the browser.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The code uses `new Function` to execute JavaScript stored in the extension's settings (`extensionSettings.mesTrackerJavascript`). This setting is updated via a textarea input handler and persisted using `saveSettingsDebounced`. Executing user-provided JavaScript is an inherent risk, but since the input originates from the local user configuring their own extension settings, it aligns with expected behavior for advanced customization features in SillyTavern extensions.

Impact: low · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
src/settings/settings.js:742

Coverage and limitations

Tools

Limitations

Technical scan identity