No material or immediate-danger item was identified.
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The code uses a regular expression that could be made to run very slowly by a specially crafted error message from the AI. But the input is limited in size and the attack would need someone to control the AI's output, so the chance of harm is low.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 569 in isAttributionProviderErrorEnvelope contains nested optional quantifiers and [\s\S]* at the end, which can cause catastrophic backtracking on crafted input. However, the input is LLM response text length-limited by MAX_ATTRIBUTION_VERIFIER_RESPONSE_CHARS before reaching this function, which substantially reduces the practical ReDoS risk. The worst-case impact is a client-side UI freeze, recoverable by closing the tab or waiting. No concrete exploit path is demonstrated.
Impact: low · Exploitability: unlikely
Developer action: Consider hardening the regex by simplifying the ending optional group or removing the trailing [\s\S]* if not needed, or switching to bounded searches. The receptor can also be left as-is given the input length limit.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/verify.js:569
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This pattern that checks for API error messages could be tricked into running slowly with a specially crafted error message, but the message length is limited and the attacker would need to control what the AI says, so harmful slowdowns are unlikely.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 568 in isAttributionProviderErrorEnvelope is a long alternation with many elements containing \s* and [\s\S]* patterns. While it could theoretically cause catastrophic backtracking on adversarial input, the practical risk is mitigated by the input length cap (MAX_ATTRIBUTION_VERIFIER_RESPONSE_CHARS) applied before this function is invoked. The maximum impact is a temporary client-side denial of service. No concrete exploit scenario is demonstrated.
Impact: low · Exploitability: unlikely
Developer action: Refactor the regex to reduce backtracking potential, for example by removing the final [\s\S]* optional group or using a simpler string-starts-with check for supported HTTP status phrases. The current implementation is acceptable given the length limit.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/verify.js:568
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This regular expression might be slow on specially crafted text, but it only processes AI responses you already see. It is unlikely to cause a real problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 742 in unwrapLLMColorizeResponse matches fenced code blocks and uses nested optional groups and a non-greedy capture. A crafted LLM response could cause exponential backtracking, but the pattern is anchored and bounded by typical chat message length. No evidence of actual exploit or performance impact was provided.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/live-colors.js:742
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This pattern is simple and not dangerous. The scanner flagged it by mistake.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 737 in stripLLMColorMetadata removes trailing LLM color metadata. Its character class [^\]\r\n]* is negated and safe; no nested quantifiers or alternations are present. The JS-X-Ray signal is likely a generic over-approximation. No ReDoS risk is demonstrated.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/live-colors.js:737
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This line uses a complex regular expression to detect error messages from AI providers. In theory, a specially crafted message could make the pattern run slowly, but that would require the AI to produce a very specific error, so the risk is low.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression at line 144 contains an optional trailing `[\s\S]*` inside a group with `\s*` and an alternation. While not a classic ReDoS pattern, it could cause performance degradation on crafted long inputs that partially match the prefix, potentially leading to UI unresponsiveness. However, attacker control over the model response is required, and typical inputs trigger fast matching. The scanner's static analysis flagged potential ReDoS, but manual review indicates the actual risk is minimal.
Impact: low · Exploitability: plausible
Developer action: Consider simplifying the regex or capping input length before matching. The pattern could be refactored to use a more linear approach, such as splitting on newlines or checking for keywords without the greedy `[\s\S]*` suffix.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/llm.js:144
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The code contains a pattern for reading colors that might be slow with a weird input, but the only way it could be triggered is on your own computer, and it would only cause a temporary lag that you can fix by refreshing the page.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 1262 (`/^rgba?\(\s*([\d.]+)[,\s]+([\d.]+)[,\s]+([\d.]+)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/i`) uses nested quantifiers (`[,\s]+` and optional groups) that could, in theory, cause catastrophic backtracking on a maliciously crafted input. However, the function `parseCssColor` is invoked only on DOM computed style values (e.g., `getComputedStyle(element).backgroundColor`) or on already-normalized hex color strings. These inputs are short and constrained by the browser or the extension's own validation. No evidence demonstrates an attacker-controlled path that supplies an adversarial string to this regex at runtime. Even if triggered, the consequence would be a client-side browser slowdown (self-DoS), recoverable by reloading the page. The scanner's 'unsafe-regex' signal is a quality concern, not an exploitable vulnerability in the current usage context.
Impact: low · Exploitability: unlikely
Developer action: Consider using a more restrictive character class for the number groups (e.g., `[\d]+` instead of `[\d.]+` if decimal support is needed) and avoid the open-ended `[,\s]+` by specifying the exact expected separator pattern. Alternatively, replace the regex with a simple manual parser that is immune to backtracking.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/palettes.js:1262
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This line uses a complex regular expression to detect error messages from AI providers. In theory, a specially crafted message could make the pattern run slowly, but that would require the AI to produce a very specific error, so the risk is low.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression at line 147 contains an optional trailing `[\s\S]*` inside a group with `\s*` and an alternation. While not a classic ReDoS pattern, it could cause performance degradation on crafted long inputs that partially match the prefix, potentially leading to UI unresponsiveness. However, attacker control over the model response is required, and typical inputs trigger fast matching. The scanner's static analysis flagged potential ReDoS, but manual review indicates the actual risk is minimal.
Impact: low · Exploitability: plausible
Developer action: Consider simplifying the regex or capping input length before matching. The pattern could be refactored to use a more linear approach, such as splitting on newlines or checking for keywords without the greedy `[\s\S]*` suffix.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/llm.js:147
Expected scanner matches (21)
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This test checks that the extension won't accept trick preset names like 'constructor' or '__proto__' that could break the program. It's a safety check, not a bug.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: The scanner flagged the presence of strings 'constructor', 'prototype', and '__proto__' on line 157 as a potential prototype-pollution signal. However, this is a regression test (file_role: test) that asserts the extension's resolveColorPresetName function rejects those exact strings by returning an empty string. The test validates an existing security control—no exploitable code path exists in this context. The production code being tested actively filters these dangerous input values, so the flagged line is defensive, not vulnerable.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- tests/audit-regressions.test.js:157
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This is a test that deliberately creates a tricky property named __proto__ to check that the extension's data migration ignores it safely. No actual security issue exists.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: This is a test that deliberately defines a __proto__ property on a source object to verify that the migration function migrateLegacyRegistryEntries handles prototype-pollution attempts safely. The test asserts that the migrated registry has a null prototype and that Object.prototype.polluted remains undefined, confirming the production code protects against this attack vector. The scanner flagged the literal __proto__ key, but the code is defensive and does not introduce a vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- tests/storage-migration.test.js:23
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code has a regular expression to check timestamps. It is written carefully and will not cause slowdowns or crashes. The security warning is not an actual problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex pattern on line 35 is an ISO 8601 timestamp validator anchored with ^ and $. It uses fixed-length digit groups (\d{4}, \d{2}, etc.) and a simple alternation between 'Z' and a timezone-offset pattern. There are no nested quantifiers, overlapping alternatives, or repeated groups that could enable catastrophic backtracking. JS-X-Ray's 'unsafe-regex' signal is a false positive; the pattern does not introduce a ReDoS vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/storage.js:35
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test file uses JavaScript's `new Function` only as a way to call an internal function from the main extension code during testing. It does not run any code from the internet or from a user's chat. This is a normal testing technique and not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The `new Function` call at lines 77–80 is inside a test file that reads the project's own source code (`src/ui.js`) at line 5 and isolates a known helper function (`buildRemoteFontImportDisclosure`) by matching its function name. The test passes only a locally defined `escapeHtml` function (which performs safe HTML escaping) and a hardcoded settings object with a single boolean. No user-controlled or external input reaches the constructor. The test asserts that the resulting disclosure string correctly reflects the 'cannot grant remote-font permission' rule. This is a legitimate testing pattern for exercising internal functions without exposing them as exports; there is no runtime data flow to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/ui-import-review.test.js:77-80
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
The test file deliberately uses '__proto__' to check that the extension rejects dangerous names, not as a real vulnerability. The extension's actual code blocks prototype pollution.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: The scanner signal at line 33 detects the string '__proto__' inside a test loop that deliberately verifies rejection of dangerous registry identity names. The file is a test (file_role: test) and the production code includes explicit prototype pollution defenses validated by the test at lines 47-65. No vulnerability is present; the signal reflects defensive testing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- tests/registry-style.test.js:33
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
The code has a list of dangerous names like '__proto__' and 'prototype' that it checks against when users enter names. If someone tries to use those names, the code rejects them. This is a safety measure, not a vulnerability.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: The scanner flagged the presence of '__proto__', 'prototype', and 'constructor' strings, but the code uses them exclusively in a defensive blocklist (`DANGEROUS_REGISTRY_IDENTITIES`). The `normalizeRegistryIdentity` function rejects any user-supplied name matching these values, and dictionaries are created with `Object.create(null)` to prevent prototype pollution. No code path uses these strings to access object properties unsafely. The signal is a false positive from static analysis.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- production
- Source
- src/group-profiles.js:3
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a harmless regex in a test file that looks for function definitions. It doesn't pose any security risk because it's simple, not exposed to user input, and only runs during testing.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 33 is a simple static pattern that matches function declarations. It has no nested quantifiers, alternations, or other features that would cause catastrophic backtracking. The pattern is anchored with ^ and the m flag, so it only matches at line starts. The character class [A-Za-z_$] followed by [\w$]* is safe. This regex is used only in a test helper to extract source sections; it is not exposed to user input or used in production code. The 'unsafe-regex' scanner signal is a false positive for this pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/source-contracts.test.js:33
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
This is a harmless fake function in a test file that returns a made-up image string. It is not a real network request and cannot be used to send data anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: Line 268 in file is part of a canvas mock used only in automated tests. The toDataURL method returns a static data URI string; no actual network request or data encoding is performed. The scanner signal 'shady-link' likely matched the literal 'data:image/png;base64,test', but this is a test helper and not present in shipped code. There is no data flow to an external destination, no attacker-controlled input, and no confidentiality impact.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/persona-character.test.js:268
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The code uses a simple number-matching pattern that is not dangerous. It just checks if a text looks like a percentage.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The static analysis rule flagged a regex on line 72, but the regex `/^\d+(?:\.\d+)?%?$/` is a simple, linear pattern with no nested quantifiers or overlapping alternations. It cannot cause catastrophic backtracking. The regex is used to validate and parse confidence percent strings, and it correctly handles all intended inputs. The scanner signal is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/verify.js:72
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged regular expression is used to parse percentage values like "50%" or "-25.5%" into numbers. It is simple and safe, with no risk of slowing down or crashing your browser.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex `/^-?\d+(?:\.\d+)?%$/` on line 157 is used to parse percentage strings from the `normalizeAttributionConfidence` function. This is a simple, bounded pattern with no nested quantifiers, alternation, or backreferences. It does not exhibit ReDoS characteristics nor does it process untrusted input in a way that causes security harm. The static analysis alert is a false positive; the regex is safe and appropriate for the intended validation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/attribution-store.js:157
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a routine function that removes old font tags from chat messages so the extension can re-color them. The regular expression it uses is safe and standard for this kind of text cleanup.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 194 is used to strip HTML font tags from chat text. Its structure — non-greedy quantifier, limited character class, and simple alternation — does not create catastrophic backtracking or ReDoS risk in practice. The signal from JS-X-Ray is a generic static-analysis heuristic that does not reflect actual unsafe behavior here. The function is a legitimate utility for the extension's color-processing workflow.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/utils.js:194
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test file uses JavaScript's `new Function` only as a way to call an internal function from the main extension code during testing. It does not run any code from the internet or from a user's chat. This is a normal testing technique and not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The `new Function` call at lines 26–30 is inside a test file that reads the project's own source code (`src/ui.js`) at line 5 and isolates a known helper function (`buildStylePackAssignmentOverrideDetails`) by matching its function name. The test passes only a locally defined `escapeHtml` function (which performs safe HTML escaping) and a numeric constant (`3`, the diagnostic limit). No user-controlled or external input reaches the constructor. The test verifies that the output HTML is bounded to 3 items and that HTML metacharacters are properly escaped. This is a legitimate testing pattern for exercising internal functions without exposing them as exports; there is no runtime data flow to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/ui-import-review.test.js:26-30
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This is a test that deliberately creates a tricky property named __proto__ to check that the extension's data migration ignores it safely. No actual security issue exists.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: This is a test that sets the value of a __proto__ property on a synthetic legacy data object. The test is part of the suite that validates the migration function's robustness against prototype pollution, including verifying that no pollution leaks to Object.prototype and that the resulting registry uses a null-prototype object. The scanner flagged the literal string pattern, but the context confirms it is a security test, not a vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- test
- Source
- tests/storage-migration.test.js:24
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The extension is looking at text near a quote to determine who is speaking. The pattern it uses is fixed and simple, so it cannot be made to run slowly or do anything harmful, and nothing is sent anywhere.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged expression is a static literal with a bounded repetition of at most six characters and a single optional group. It is applied to a length-preserving masked slice of chat text. Matching is linear with no nested or overlapping quantifiers, so catastrophic backtracking is not possible. No attacker-controlled pattern construction, external destination, or exfiltration path appears; the pattern serves ordinary speaker-tag parsing within the local process. This is a scanner heuristic match on a safe pattern shape rather than a demonstrated weakness.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/attribution.js:476
JavaScript analysis reported javascript.xray.shady-link
Expected behavior · high confidence
The scanner found a line in a test file that looks like it might contain a suspicious link, but it is just a made-up test example used to check that the extension's code handles certain text patterns safely. No actual link or network activity happens.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.shady-link in this repository.
Contextual assessment: The scanner candidate flags line 140 of a test file for containing the string 'irc:room', which matches a pattern for a protocol-like string. The line is part of a unit test that verifies the function returns null when provided with a Markdown autolink syntax. No network access, data transmission, or any runtime effect occurs. The test is executed only during development and does not ship to users. The flagged string is static test data with no real connection or trigger.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.shady-link
- File role
- test
- Source
- tests/ui-selection-mapping.test.js:140
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The flagged regular expression is a standard date/time format checker. It is safe because it has no tricky parts that could cause slowdowns, and it only runs on short text that the extension already cleaned up.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 179 is a static, hardcoded ISO 8601 timestamp validation pattern with bounded quantifiers and no nested or overlapping alternations. It is not user-injectable and presents no ReDoS risk. The input is pre-limited to 40 characters by normalizeString. The scanner signal 'unsafe-regex' is a false positive for this particular pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/style-packs.js:179
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is another fixed pattern used to recognize phrases like a name followed by a speech tag before a quote. It is simple and bounded, cannot be exploited to slow down or damage the app, and does not transmit any data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: This second flagged expression is also a fixed literal anchored to a word, with one optional word group and a bounded trailing repetition of at most six characters. It is matched against a masked slice of current chat paragraph text. The pattern is linear and bounded, with no nested quantifiers, and it is part of the local pronoun speech-tag resolver. The evidence shows no attacker-controlled regex construction, no network or storage destination, and no demonstrated activation path for harm. This is consistent with expected parsing behavior and is not a demonstrated vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- src/attribution.js:485
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a test-only helper that uses a fixed pattern to find functions in source code. It's not used by the extension itself, so there's no risk to anyone using the extension.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 16 is a static pattern used only in test code to locate function definitions within pre-loaded source files. It is not constructed from user input and has no runtime impact on the extension's users. The 'unsafe-regex' scanner signal typically flags regular expressions with potential ReDoS characteristics, but this fixed pattern poses no denial-of-service risk because it operates on static, trusted data in a test environment. No attacker-controlled data flow reaches this regex, and no production behavior depends on it.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/host-lifecycle-contracts.test.js:16
JavaScript analysis reported javascript.xray.prototype-pollution
Expected behavior · high confidence
This code is being careful to block dangerous words like '__proto__' when reading JSON files. It's a safety measure, not a problem. The scanner saw the word and got suspicious, but the code is using it correctly to protect against attacks.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.prototype-pollution in this repository.
Contextual assessment: The static scanner flagged line 8 because the string '__proto__' appears in a source file, which can be associated with prototype pollution attacks. However, the code explicitly defines a constant list of reserved JSON keys (__proto__, prototype, constructor) and uses them defensively in inspectContainer (line 89-90) to detect and reject any JSON input containing these keys. The RESERVED_KEY_SET is used to throw an ImportCodecError('reserved_key') if any such key is encountered, preventing prototype pollution. This is a standard defensive coding pattern, not a vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.prototype-pollution
- File role
- production
- Source
- src/import-codec.js:8
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a test that checks if gradient preset names follow a specific naming pattern. The 'unsafe regex' signal is a false alarm—the pattern is simple and safe, and it only runs on the developer's machine, never on a user's chat data.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex `/^[a-z0-9]+(-[a-z0-9]+)*$/` is used in a test file to validate that preset names are kebab-case. The regex does not contain nested quantifiers causing catastrophic backtracking; it is a standard pattern for kebab-case strings. The test operates on hardcoded preset data (BUILTIN_GRADIENT_PRESETS), not on user or external input. Even if the regex had mild backtracking issues, the attack surface is nonexistent because the test code runs only during development and the input is controlled. No data flows to this regex from any untrusted source in shipped code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/gradient-presets.test.js:131
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is a test file that checks that certain functions exist in the SillyTavern extension's own code. The flagged line is a regular expression that looks for function names – it's a harmless pattern that only runs when the developer runs tests. It doesn't process any user messages or external input, so it is not a security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The scanner flagged line 120 of a test file (file) as an unsafe regex. The regex `/^(?:export\s+)?(?:async\s+)?function\s+[A-Za-z_$][\w$]*\s*\(/m` is a hard-coded pattern used to detect function declarations in the extension's own source file (context-menu.js) for a contract test. It is never evaluated against untrusted user input or external data. The test runs under node --test in a controlled environment. No user-facing processing path uses this regex. There is no demonstrated runtime reachability from attacker-controlled input, no risk of ReDoS in practice, and no security impact on end users. The signal is a false positive in this context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- test
- Source
- tests/manual-color-assignment.test.js:120