This is a calculator feature that evaluates math expressions typed by the user. Before running the expression, it checks that it contains only numbers and math symbols, so no harmful code can sneak in. This is normal and expected for a calculator app.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The Function constructor is used to evaluate a calculator expression. Before execution, the expression is normalized and validated against a strict whitelist regex that permits only digits, arithmetic operators, parentheses, decimal points, and whitespace. This prevents injection of arbitrary JavaScript. The expression is built from local calculator UI button presses, and the result is only accepted if it is a finite number. This is a standard and safe calculator implementation pattern.
The calculator checks that only math characters are present before doing the calculation, which keeps it safe.
Technical assessment
The regex at line 1972 restricts the evaluated string to digits, arithmetic operators, parentheses, decimal points, and whitespace only. This whitelist approach effectively prevents arbitrary code execution via the Function constructor on line 1974.