This is a test that loads part of the project's own code and runs it in isolation to verify it works correctly. No outside or untrusted input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test file reads the project's own committed index.js source, slices a known function region, and passes it to new Function to execute that extracted code with hardcoded test inputs. The code being dynamically executed is the project's own source, not user input, network data, or model output. No untrusted data reaches the dynamic execution path.
This is a test that runs a piece of the project's own code with fixed test data to check its behavior. No untrusted input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test file extracts a migration function body from the project's own committed index.js source and wraps it in new Function to execute it with hardcoded test objects. The dynamically executed code originates solely from the project's own source tree; no external, user-controlled, or model-generated data is interpolated into the function body.
This is part of the project's test suite. It runs a piece of the extension's own code in a controlled way to check that settings migration works correctly. It does not touch user data, secrets, or the network.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function(...)` call inside a test file. It reads source from the extension's own `index.js`, slices a named function body, and invokes it with mocked dependencies to assert settings-migration behavior. The executed code is the project's own source, not user input, network data, or untrusted content. No external destinations, credentials, persistence, or obfuscation are involved. This is a standard test-harness pattern for exercising internal logic in isolation.
This is another test-suite helper. It runs a slice of the extension's own code with fake inputs to confirm that per-profile thinking settings behave correctly. No secrets, network calls, or user data are involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function(...)` call inside a test file. It extracts a slice of the extension's own `index.js` source containing thinking-disable format helpers, then invokes that code with mocked profile and route lookups to verify per-profile settings resolution. The dynamically executed text is the project's own source code, not external or user-controlled input. There is no network activity, credential access, persistence, or concealment. This is an isolated unit-test pattern.
This is a test that runs a piece of the project's own formatting code with a simple built-in helper function. No untrusted input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A test file extracts a display formatting function from the project's own committed index.js source and wraps it in new Function, injecting a trivial trimming helper as the sole parameter. The function body is sourced exclusively from the project's own code, and the injected argument is a hardcoded inline lambda. No untrusted or external data reaches the dynamic execution path.