A pattern-matching rule used to clean up character card text before sending it to the AI was flagged as potentially slow on certain inputs. The rule removes specific labeled sections from the card. If someone created a specially crafted character card, it might cause the browser to slow down or freeze temporarily. This only affects the person using that card and causes no data loss, credential exposure, or other serious harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.
Contextual assessment: The scanner flagged repeated regex patterns on line 705 as potentially unsafe. The flagged regex uses (?:.*\n)*? with a lookahead and the multiline flag to strip an Anatomy Snapshot block from system message content. While such patterns can theoretically exhibit elevated backtracking on adversarial input, the lazy quantifier and non-overlapping alternatives make catastrophic backtracking unlikely rather than certain. The input is character card system message text, which is typically the user's own content. Even if a crafted card triggered excessive backtracking, the worst-case result is a frozen browser tab, which is a local self-DoS. The same block-stripping pattern appears multiple times for Appearance, Sexual Tendencies, and Anatomy Snapshot sections, all operating on the same local content with the same low-impact ceiling.
Impact: low · Exploitability: unlikely
Developer action: Consider pre-compiling the block-stripping regexes once rather than reconstructing them inline on every turn, and test with large adversarial card content to confirm backtracking stays bounded. If performance issues arise, replace the multi-line lookahead pattern with a simpler line-by-line filter.
This extension is designed to load and run JavaScript lore modules from the internet or from the SillyTavern server. That is its core feature, clearly documented in the README. The code does exactly what it says: fetches a JS file and runs it as a module. There is no hidden execution or credential theft.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags co-located network retrieval (fetch) and dynamic code execution (import()). The extension's stated purpose is a programmable lore engine that loads JS modules implementing processTurn()/handleResponse(). loadLoreFromUrl fetches JS source from a user-provided URL and passes it to loadLoreFromSource, which creates a Blob, generates an object URL, and calls import() to execute it. The fetch('/api/files/upload') calls upload debug sidecar files and lore modules to the local ST server. All network destinations are either the user-provided lore URL (GitHub raw, documented), the local ST server API endpoints, or stored server paths for cross-device sync. No credentials, API keys, or private content are sent to external destinations. The auto-update feature polls a version.json and downloads updated lore modules, which is documented in the README. This data flow is proportional to and directly implements the stated project purpose.