No material or immediate-danger item was identified.
Contextual expected matches (24)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that uses JavaScript's new Function to isolate and test functions from the extension. It only runs the project's own code in a test context, not in the browser. This is a normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at line 144 is a new Function call inside file that constructs a sort function from extracted source of file for unit testing. The test harness reads file via readFileSync, extracts function bodies by brace counting, and wraps them in new Function for isolated testing with stubbed dependencies. No untrusted or external input reaches the new Function constructor; the code under test is the project's own production source. This is a standard test isolation pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:144
JavaScript analysis reported javascript.download-to-execution
Expected behavior · high confidence
The extension calls SillyTavern's own local chat-list API to get branch metadata for organizing chats. This is exactly what a chat-organization extension should do. There is no evidence of downloaded code being executed.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: The scanner flags co-occurrence of a network retrieval primitive and a code execution sink. The visible fetch at line 285 targets '/api/chats/recent' — a relative URL to the local SillyTavern server, used to retrieve branch parentage metadata (chat_metadata.main_chat). The request body is a static JSON object with a small max value. No data from this fetch is passed into eval, new Function, or any dynamic execution sink in the shown source. The response is parsed as JSON and filtered by character key. This is expected behavior for an extension whose stated purpose is chat organization and branch family display.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.download-to-execution
- File role
- production
- Source
- index.js:9-285
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that uses JavaScript's new Function to pull individual functions out of the extension's own source code and run them with test data. No untrusted or external input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The candidate at line 563 uses new Function('escapeHtml', extract('buildMoveSectionHtml') + ...) to construct a test instance of the extension's own buildMoveSectionHtml function with a custom escapeHtml stub. This is inside a test harness (file) that reads the project's own source via readFileSync, extracts function bodies, and runs assertions. The executed code originates entirely from the project's own source, not from untrusted input, network data, or user-controlled strings. No external data flow reaches the new Function constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:563
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is part of a test file that extracts a function from the extension's own source code and runs it in isolation to verify it works correctly. No untrusted input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The matched `new Function` at line 446 is inside file and constructs a test wrapper around the project's own getTitleEl function extracted via extract(). The function body originates from the extension's own source code, not from attacker-controlled input. This is a standard unit-testing pattern that compiles extracted source functions with mock dependencies to run assertions. No external data flow, network calls, or credential access is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:446
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test uses new Function to create an isolated test of the extension's panel visibility logic. Only the project's own code is executed. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at lines 207-210 is a new Function call in file that constructs a test harness for syncPanelVisibility by injecting stub state variables and the extracted function body. The source passed to new Function is the project's own file function. No external or user-controlled input is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:207-210
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test uses new Function to test the extension's content cache logic with the project's own code. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at lines 226-228 is a new Function call in file constructing a test harness for touchContentCache. The function body is extracted from the project's own index.js. No untrusted input reaches the constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:226-228
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test uses new Function to test the extension's branch parentage logic with the project's own code. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at line 118 is a new Function call in file that constructs a test for getBranchParent using the extracted function body from index.js. The only argument is a static activityData object. No untrusted input is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:118
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test script builds a test wrapper around the extension's moveChatToCharacter function using new Function, injecting mock dependencies like a fake fetch. This is standard test isolation with no external input.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Lines 499-505 use new Function('fetch', 'SillyTavern', 'toastr', 'console', deps + extract(...) + ...) to assemble a testable instance of moveChatToCharacter with mocked dependencies (a fake fetch, a stub SillyTavern context, etc.). All code strings come from the project's own source via extract() and hardcoded dependency stubs. No untrusted or network-sourced data is passed to the Function constructor. This is a test-only pattern for testing non-exported functions.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:499-505
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test file uses new Function to build a test harness for the extension's helper functions. Only the project's own code is used. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at lines 25-26 is a new Function call in file that constructs an API object from extracted helper functions (escapeHtml, highlightText, getActiveChatName, isActiveChatFile) from index.js. The source is entirely the project's own production code. No external input reaches the constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:25-26
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test uses new Function to test the extension's pin-scoping logic with the project's own code. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at line 249 is a new Function call in file that constructs a test harness for pin-related functions (normalizeChatId, pinKey, isPinnedFile, togglePin) extracted from index.js. All source is the project's own code with stub dependencies injected.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:249
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that creates a wrapper around the extension's own refreshActivityData function to test its behavior with mock inputs. No untrusted or external data is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The `new Function` at lines 294-296 in file wraps the project's own refreshActivityData function extracted from source, passing mock dependencies (mock fetch, mock SillyTavern context) as named parameters. The executed code is the extension's own source, not user-supplied input. This is a standard isolation-testing pattern with no network exfiltration or credential access.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:294-296
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that checks the structure of the extension's own performSync function. No dynamic execution of untrusted input occurs.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The match at line 435 falls within a test block that uses stripComments and string-includes assertions against the project's own extracted performSync source. The surrounding context shows static structural assertions (checking for scroll capture, depth reset patterns) rather than dynamic execution of untrusted input. The new Function usage visible in nearby test blocks follows the same extract-and-test pattern with the project's own code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:435
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test creates a callable version of the extension's buildMoveSectionHtml function using new Function and runs assertions on the HTML it produces. Only test-controlled data is used.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Line 547 uses new Function('escapeHtml', extract('buildMoveSectionHtml') + ...) to create a test instance of the extension's own buildMoveSectionHtml function, passing a simple identity escapeHtml stub. The function source is extracted from the project's own code. The test then calls it with hardcoded test data (folder arrays and strings) and asserts on the HTML output. No untrusted input flows into the Function constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:547
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test uses new Function to test the extension's branch metadata extraction logic with the project's own code. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at line 96 is a new Function call in file that constructs a test for buildActivityData using the extracted function body from index.js. The test passes static item arrays. No untrusted input reaches the constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:96
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test extracts the extension's buildCardsOverview function and wraps it with new Function to test it in isolation. All inputs are hardcoded test fixtures.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Line 470 uses new Function(extract('buildCardsOverview') + ...) to create a testable instance of the extension's own buildCardsOverview function extracted from the project source. The test passes hardcoded fixture arrays (items, chars, groups) and asserts on ordering and name resolution. No untrusted or external data reaches the Function constructor; the code body is the project's own function source.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:470
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that extracts the extension's own getBranchParent function and tests it with sample data. No untrusted input is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The `new Function` at line 339 in file compiles the project's own getBranchParent function extracted via extract(), passing a mock activityData object as a parameter. The test verifies metadata-first and filename-pattern fallback logic with hardcoded test inputs. No external or attacker-controlled data reaches the dynamic execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:339
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that extracts the extension's own familyClusters function and tests it with sample chat names. No untrusted input is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The `new Function` at lines 374-376 in file compiles the project's own familyClusters function extracted from source and tests it with hardcoded sample chat names to verify lineage clustering behavior. The executed code is the extension's own source, not attacker-controlled input. No network calls or credential access occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:374-376
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test wraps the extension's formatRelativeTime function with new Function and checks its time-formatting output against hardcoded timestamps. No external input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Line 569 uses new Function(extract('formatRelativeTime') + ...) to create a testable instance of the extension's own formatRelativeTime function. The test calls it with hardcoded numeric timestamps and asserts on string outputs like '5m ago' and '2d ago'. The Function constructor body is sourced exclusively from the project's own code via extract(); no untrusted input is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:569
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that extracts several of the extension's own activity-tracking functions and tests them with mock settings. No untrusted input is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The `new Function` at line 328 in file compiles multiple project-owned functions (lastActiveKey, stampActivity, getLastActive, pruneLastActive) extracted via extract(), passing mock getSettings, getCurrentCharacterId, getActiveChatName, and saveSettings as parameters. The test verifies activity stamping scope and pruning with hardcoded test data. No external input reaches the execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:328
JavaScript analysis reported javascript.xray.obfuscated-code
Expected behavior · high confidence
The code is plainly readable with clear comments throughout. There is nothing hidden or scrambled. The scanner flag is a false positive.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code. The match applies to this repository.
Contextual assessment: The JS-X-Ray obfuscation signal fires at line 1 with low scanner confidence. The supplied source is plainly readable, well-structured JavaScript with extensive inline comments explaining version history and design decisions. There are no encoded strings, packed payloads, character-array deobfuscation, or concealed logic. The signal does not correspond to any demonstrated obfuscation in the actual code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1_families-1
- Rule
- javascript.xray.obfuscated-code
- File role
- production
- Source
- index.js:1
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test uses new Function to test the extension's sort logic with the project's own code. Normal testing pattern.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Candidate at lines 187-190 is a new Function call in file that constructs a test harness for sortChats extracted from index.js. The function body is the project's own production code. No external or untrusted input is passed to the constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:187-190
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
A test extracts the extension's adaptChatForTarget function and uses new Function to run it with hardcoded test message arrays. This is standard test isolation with no external input.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: Line 454 uses new Function(extract('adaptChatForTarget') + ...) to create a testable instance of the extension's own adaptChatForTarget function. The test passes a hardcoded array of message objects and asserts on header rewriting, name renaming, and non-mutation of inputs. The Function constructor body comes entirely from the project's own source code via extract(); no untrusted or network-sourced data is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:454
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that extracts the extension's own activity-stamping functions and tests them with mock settings. No untrusted input is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The `new Function` at line 315 in file compiles the project's own lastActiveKey, stampActivity, getLastActive, and pruneLastActive functions extracted from source, with mock dependencies passed as named parameters. The test verifies scoped activity stamping and pruning behavior with hardcoded test data. No attacker-controlled input is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:315
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that extracts the extension's own escAttr function and tests that it properly escapes filenames. No untrusted input is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval. The match applies to this repository.
Contextual assessment: The `new Function` at lines 269-271 in file compiles the project's own escAttr function extracted via extract() and tests it with hardcoded strings to verify proper escaping of quotes and backslashes. The executed code is the extension's own source. No external or attacker-controlled input reaches the dynamic execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test_tmc.mjs:269-271