This code is part of a test suite. It dynamically loads a piece of the extension's own code to test it in isolation. This is a standard testing technique and does not pose a security risk because it only runs during development and only uses the project's own code, not external or user-provided input.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is located in a test file and uses `new Function` to dynamically evaluate source code extracted directly from a local source file (`../src/ui.js`) via `readFile`. This is a common testing pattern to isolate and test internal functions without exporting them. The evaluated code is not derived from user input or external sources, and the execution occurs only within the test environment.
This code is part of a test suite. It dynamically loads a piece of the extension's own code to test it in isolation. This is a standard testing technique and does not pose a security risk because it only runs during development and only uses the project's own code, not external or user-provided input.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is located in a test file and uses `new Function` to dynamically evaluate source code extracted directly from a local source file (`../src/ui.js`) via `readFile`. This is a common testing pattern to isolate and test internal functions without exporting them. The evaluated code is not derived from user input or external sources, and the execution occurs only within the test environment.