TavernKeeper Scan Report

GetfroggyHoe/universal-immersion-engine

Commit d51c175 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 2 low

What this review found

No material or immediate-danger item was identified.

Expected scanner matches (1)

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a calculator feature that evaluates math expressions typed by the user. Before running the expression, it checks that it contains only numbers and math symbols, so no harmful code can sneak in. This is normal and expected for a calculator app.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The Function constructor is used to evaluate a calculator expression. Before execution, the expression is normalized and validated against a strict whitelist regex that permits only digits, arithmetic operators, parentheses, decimal points, and whitespace. This prevents injection of arbitrary JavaScript. The expression is built from local calculator UI button presses, and the result is only accepted if it is a finite number. This is a standard and safe calculator implementation pattern.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
src/modules/phone.js:1974

Related contextual observations

Calculator expression validation is effective

low risk · high confidence

The calculator checks that only math characters are present before doing the calculation, which keeps it safe.

Technical assessment

The regex at line 1972 restricts the evaluated string to digits, arithmetic operators, parentheses, decimal points, and whitespace only. This whitelist approach effectively prevents arbitrary code execution via the Function constructor on line 1974.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity