TavernKeeper Scan Report

ZhenyaPav/SillyTavern-Namegen

Commit 00c80b5 Reviewed

No material or high-risk concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 high 0 material 5 low

What this review found

No material or high-risk item was identified.

Expected scanner matches (3)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a common, harmless snippet from a widely used helper library that simply finds the global environment object. It does not run any user-supplied code and poses no security risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged expression is a static `Function('return this')()` call inside a vendored lodash module bundled within the fantastical library. This is lodash's standard idiom for resolving the global object at module load time when `global` and `self` are unavailable. The argument is a hardcoded string literal, not user input or remote data, so there is no injection vector.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
lib/fantastical.js:1288

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This code is a routine boilerplate snippet found in bundled JavaScript libraries used to find the global object (like window in a browser). It does not run any user-supplied or remote code; it only evaluates fixed text to locate the global scope. This is normal and expected for a vendored library file.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The matched line is part of a standard webpack/browser-bundle global-object polyfill. It attempts to resolve the global reference via several fallbacks, including Function('return this')() and indirect eval of the literal 'this'. No attacker-controlled or dynamic data is passed to eval or Function; the operands are constant string literals used solely to obtain the global scope. This is a common pattern in vendored bundled libraries and does not introduce dynamic code execution of external input.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
lib/fantastical.js:1201

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a common, harmless trick bundled libraries use to find the global JavaScript object. It runs a fixed piece of code with no outside input, so there is no way for an attacker to influence it.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged line is the standard lodash-style global object resolution idiom used in a vendored browser build of the fantastical library. Function('return this')() executes a static string with no user-controlled input and is used solely to obtain a reference to the global object when freeGlobal and freeSelf are unavailable. No data flows into this call from extension users, SillyTavern state, or network sources.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
lib/fantastical.js:131

Related contextual observations

Vendored library global object resolution idiom

low risk · high confidence

The matched code is part of a bundled third-party library and uses a standard method to access the JavaScript global object. It does not handle any user data or secrets.

Technical assessment

The surrounding code is a vendored browser build of the fantastical name-generation library, containing lodash-style utility helpers. The Function constructor call is a static global-resolution pattern and does not process extension inputs, credentials, or network data.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Lodash global object resolution idiom

low risk · high confidence

The flagged line is part of a standard helper library routine for detecting the runtime environment, not a dynamic code execution risk.

Technical assessment

The surrounding code is a webpack-injected lodash module that resolves `root` via `freeGlobal || freeSelf || Function('return this')()`. This is a well-known lodash pattern with a constant string argument and no data flow from external inputs.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity