This is part of a test file that loads the project's own source code to test individual functions in isolation. It does not run in the actual extension and does not process any outside input, so it poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a Node.js test file. The function body is assembled from source text read from the project's own committed `src/ui.js` file and from hardcoded test arguments. No untrusted or remote input reaches the dynamic constructor. The purpose is to isolate and unit-test a specific helper function from the extension source. This is a test-only construct and does not ship to users.
This is test code that loads the project's own source to check how a disclosure message is built. It does not run in the actual extension and uses no outside input, so it is not a security concern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call in a Node.js test file. Its body is built from source text extracted from the project's own committed `src/ui.js` and invoked with a hardcoded test settings object. No untrusted input flows into the dynamic constructor. The construct exists solely to unit-test an internal disclosure-building function and is not part of the shipped extension runtime.