This is a test that loads the project's own source code and runs a small piece of it in isolation to check that it behaves correctly. It does not run any outside or user-supplied code, and it is not part of the extension users install.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched `new Function` call is in a test file. It reads source text from the project's own `src/ui.js` via `readFile`, isolates a named helper function by string slicing, and compiles it with `new Function` to invoke that helper in isolation for assertions. The executed code is the project's own committed source, not user input, network data, or imported extension content. No untrusted data reaches the dynamic execution path. This is a test-only pattern and does not ship to users.
This is another test that runs a piece of the project's own source code in isolation to verify its output. It does not execute outside code and is not included in the shipped extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This second `new Function` match is the same test-only pattern in the same test file. It extracts another named helper (`buildRemoteFontImportDisclosure`) from the project's own `src/ui.js` source text and compiles it to invoke the helper with a fixed settings object for assertions. The dynamically executed body is committed project source, not external or user-controlled input. There is no data flow from untrusted sources into the function constructor.