This is test code that loads a piece of the extension's own source code and runs it with fake dependencies to verify it behaves correctly. There is no outside input involved, so it poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file. It extracts a source slice from the project's own index.js, injects mocked helper dependencies, and executes the slice to unit-test internal thinking-disable format resolution logic. No untrusted or user-controlled input reaches the function body; the code being executed is the project's own source, and all parameters are controlled test fixtures. This is a standard pattern for testing non-exported internal functions.
This is test code that loads the extension's own settings-migration logic and runs it with fake data to confirm old settings are cleaned up properly. No outside input is involved, so it poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file. It extracts the `getSettings` function source from the project's own index.js, injects mocked dependencies and a mock settings store, and executes it to verify retired settings are migrated and removed correctly. No untrusted or user-controlled input reaches the function body; the executed code is the project's own source and all arguments are controlled test fixtures.
This is a test that pulls a small piece of the extension's own code and runs it in isolation to check that item names display correctly. No outside or user-controlled data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file. It reads source from the project's own index.js, extracts a formatter function body via string slicing, and executes it with a controlled helper argument to verify display formatting behavior. The code passed to the dynamic function originates entirely from the project's own committed source, not from user input, network data, or untrusted content. This is a standard test-time pattern for exercising pure functions extracted from production source.
This is a test that feeds fake, already-redacted credential-looking text into a redaction feature to make sure it hides secrets properly. There is no real password or API key here, and the test proves the tool scrubs them out.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is inside a test file and constructs a synthetic Error object whose message contains placeholder credential-like strings already wrapped in REDACTED_SECRET markers. The test asserts that the diagnostic formatter removes these values and replaces them with generic REDACTED placeholders, and that the original sensitive-looking substrings do not appear in output. The domain used is example.invalid, a reserved testing domain. No real credential is present, and the code path under test is a redaction routine, not credential handling or exfiltration.
This is a test that extracts the extension's own settings-upgrade code and runs it to make sure old settings get converted correctly. No outside data is used.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file. It reads source from the project's own index.js, extracts a settings-migration function body via string slicing, and immediately invokes it to verify migration logic. The dynamically executed code is sourced exclusively from the project's own committed source file. No untrusted or external input flows into the function body or its arguments.
This is a test that takes the extension's own window-sizing code and runs it with fake screen dimensions to confirm the tracker window stays on screen. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file. It reads source from the project's own index.js, extracts a widget-layout clamping function body via string slicing, and invokes it with a synthetic globalThis object to verify position and dimension clamping math. The function body is derived solely from the project's committed source, and the arguments are hardcoded test fixtures. No untrusted input reaches the dynamic execution path.