TavernKeeper Scan Report

ZapoVerde/SillyTavern-Canonize

Commit a64812c Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 6 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
lorebook/utils.js:90

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A crafted input might briefly slow or freeze the local client, without showing broader security harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex. The match applies to this repository.

Contextual assessment: The expression may permit a local CPU slowdown, but this evidence shows no credential, persistence, code-execution, or cross-user impact.

Impact: low · Exploitability: plausible

Developer action: Bound the input length or replace the expression when practical.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
core/hookseeker-output.js:76
Contextual expected matches (2)

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The extension fetches a list of embedding models from the OpenRouter API and displays them in a dropdown. The model names are escaped before display, and no code is executed from the fetched data. This is a standard model-browser feature.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
settings/handlers-rag-embed.js:87-147

JavaScript analysis reported javascript.download-to-execution

Expected behavior · high confidence

The preview button fetches an orphaned file and shows its contents as plain text. There is no code execution or HTML injection. This is a normal preview feature for a file-management modal.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.

Contextual assessment: The flagged region fetches a client-relative path via fetch(path), reads the body as text, and renders it with jQuery's $panel.text(text). The .text() method sets textContent, which does not parse HTML or execute script. There is no eval, Function constructor, innerHTML assignment of fetched data, or command sink. Template literals constructing $row use escapeHtml() for the path/filename. The .html() calls at lines 41 and 51 use static string literals with no interpolation. The scanner's 'execution sink' correlation does not correspond to any actual dynamic code execution path in the fetched data flow.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
Rule
javascript.download-to-execution
File role
production
Source
modal/orphan-modal.js:68-77

Related contextual observations

Preview uses text() not html() for fetched content

low risk · high confidence

Fetched file content is inserted as plain text, which prevents any embedded markup or scripts from running. This is safe behavior.

Technical assessment

The fetch result is rendered exclusively via $panel.text(text), which assigns to textContent and neutralizes any HTML or script in the response body. No innerHTML, .html(), eval, or similar sink receives the network-retrieved data.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

OpenRouter model IDs are HTML-escaped before DOM insertion

low risk · high confidence

Model names from the OpenRouter API are escaped before being shown in the dropdown, so any unusual characters cannot break the page or run scripts.

Technical assessment

Detailed technical wording was omitted by the public report safety filter.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity