What this review found
No material or immediate-danger item was identified.
Minor cautions
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 710 in parseMetricHeightCentimeters contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.
Impact: low · Exploitability: plausible
Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:710
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A pattern used to check character sheet text for an 'isekai' origin has a complex regular expression that might run slowly if someone feeds it a specially crafted string. This could cause the browser to lag temporarily, but it won't steal data or break anything permanently.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 108 contains complex alternatives with optional groups (e.g., `lost\s+(?:(?:his|her|their|its|the)\s+)?life`) that could, under adversarial crafted input, cause excessive backtracking and client-side performance degradation. This is a static pattern applied to LLM-generated character sheet text, not dynamically constructed. No actual exploit or ReDoS is demonstrated in the supplied evidence. The impact is limited to recoverable local slowdown or tab freezing, which is low.
Impact: low · Exploitability: plausible
Developer action: Consider simplifying the regex by splitting into multiple simpler checks or using a non-backtracking approach. Alternatively, add a timeout or input length limit to mitigate potential ReDoS.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-validation.js:108
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This is a minor code quality note where a regular expression could potentially be slow with very carefully crafted input. Since you control your own character sheet, the risk is only to yourself and unlikely to be a problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 4363 is used to parse bold-markdown ability names from persona text. JS-X-Ray flagged it as potentially unsafe, but the pattern uses a lazy quantifier (.+?) and no nested quantifiers, so catastrophic backtracking is not evident. The input originates from the user's own persona description, which is self-controlled and limited in size. Any ReDoS exploit would only affect the user's own session and cause a temporary local slowdown, not data exposure or code execution. The risk is not demonstrated in the supplied evidence.
Impact: low · Exploitability: unlikely
Developer action: Consider adding a length limit on persona text or using a simpler string method (e.g., .startsWith) if feasible to avoid any theoretical ReDoS risk, though the current pattern is not known to be vulnerable.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:4363
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A line of code that splits text into sentences uses a pattern that might be slow on weird input. If someone fed it a specially-crafted long sentence, it could temporarily freeze your browser tab until you refresh. No one has shown this happening in practice, and it's a low-severity quality issue.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: Line 292 contains a regular expression /[^.!?\r\n]+(?:[.!?]+(?=(?:["'\u2019\u201d\u00bb)\]]+)?(?:\s|$))|$)/g used for sentence splitting. Static analysis flagged it as potentially unsafe due to nested quantifiers that could cause catastrophic backtracking on crafted input. However, the regex is applied to narration text generated by the LLM or user, which is not attacker-controlled in a meaningful way; the worst-case impact is a local slowdown or frozen tab that is resolved by refreshing. No concrete exploit is demonstrated in the supplied evidence, and the regex has been present in the codebase without reported issues.
Impact: low · Exploitability: plausible
Developer action: Consider reviewing the regex at line 292 and simplifying it if possible (e.g., avoid nested optional groups and alternation inside lookaheads) to reduce the risk of catastrophic backtracking. Alternatively, add a length or complexity check on the input before applying the regex.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- prose-guard-edits.js:292
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 722 in parseImperialHeightInches contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.
Impact: low · Exploitability: plausible
Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:722
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The code uses a complex pattern to find a character's age in text. This pattern could slow down the browser if someone writes a very tricky character description, but since it only applies to your own characters, it's not a security problem for others.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 1194 in resolveIsekaiCharacterAge contains nested optional quantifiers and alternation that may cause catastrophic backtracking (ReDoS) on crafted input. However, the regex is only applied to the user's own character text during story seed generation, which is bounded in size and not exposed to external attacker control. No evidence of actual exploitation or performance impact was provided; the scanner signal is a static warning. The practical risk is low because the attacker would need to supply a malicious character card to their own client, which is a self-targeted action with no cross-user harm.
Impact: low · Exploitability: unlikely
Developer action: Consider simplifying the regex or splitting it into multiple simpler checks to reduce the risk of catastrophic backtracking. Alternatively, use a parser-based approach or impose a reasonable input length limit on character text before applying the regex.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:1194
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This code uses a pattern to find a character's name from a description. If someone creates a very long weird description that doesn't match the expected format, it could slow down your browser for a moment. It's not a security risk but could be improved to run faster.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex in parsePersonaName() (line 9195) uses a greedy quantifier ([^\n\r]+) after a fixed prefix. On a long non-matching input, the engine may backtrack character-by-character, producing O(n) worst-case time. While not a classic catastrophic ReDoS, this could cause a momentary slowdown if a maliciously crafted character card field is parsed. The scanner correctly identifies a potential weak pattern, but no concrete exploit path or exposure is demonstrated.
Impact: low · Exploitability: unlikely
Developer action: Consider anchoring the regex to the end of the line (e.g., adding $) or using a non-greedy quantifier ([^\n\r]+?) to limit backtracking. If the intended match is always a single line, the pattern could be made more specific.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:9195
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This is a slow regular expression that could make your browser freeze if someone sends a specially crafted message, but it wouldn't steal any data or break your game.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 5923 is complex with many alternations and optional groups, which can cause catastrophic backtracking (ReDoS) when applied to untrusted user input. While it only operates client-side on narrative text and the impact is limited to local performance degradation, it is a quality issue that should be addressed.
Impact: low · Exploitability: plausible
Developer action: Simplify or restructure the regex to avoid nested optional groups and alternations that cause backtracking. Use a regex debugger to verify performance or replace with simpler pattern matching.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:5993
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A complex pattern used to rewrite item names might cause the browser to slow down or freeze if someone sends a very carefully crafted name, but there's no evidence this can actually happen or be exploited in practice.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The unsafe-regex signal flags a potentially vulnerable regular expression at line 6570 used in formatTrackerItemDisplayName for text normalization. The regex /^(?:one|two|three|four|five|six|seven|eight|nine|ten|\d+)\s+(?:leather\s+)?bootlaces\s+and\s+(?:a|an|one)\s+whetstone$/i could exhibit catastrophic backtracking on crafted input, but the input is a short string from user-provided tracker item names or game content. No attacker-controlled path is demonstrated; the function is called with sanitized or game-generated strings. Impact is limited to a potential local browser tab unresponsiveness, which is recoverable and not a security breach.
Impact: low · Exploitability: unlikely
Developer action: Consider simplifying the regex or using a non-backtracking approach (e.g., replace with a plain string match or a less complex pattern) to eliminate the theoretical ReDoS risk.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:6570
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This line uses a search pattern that might slow down or freeze your browser if the AI's response contains many partial matches of the markers. This is unlikely to happen normally, but someone could intentionally cause it. A simple browser refresh fixes it.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 67 uses `[\s\S]*?` non-greedily, which can cause catastrophic backtracking when the input contains many incomplete matches of BEGIN_PROSE_GUARD_EDITS without the terminating END_PROSE_GUARD_EDITS. This is a client-side operation on AI-generated text; a malicious input crafted to trigger the backtracking could freeze the browser tab temporarily. No evidence of exploitation exists, and the impact is limited to local, recoverable denial of service. The pattern is consistent with the file's purpose of stripping structured markers from narration output.
Impact: low · Exploitability: unlikely
Developer action: Consider hardening the regex by limiting input length before processing, or using a non-regex approach (e.g., indexOf and slice) for these specific markers. If regex is retained, use atomic groups or possessive quantifiers to prevent backtracking, or split and rejoin on known markers.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- narration-sanitizer.js:67
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This line uses a pattern to find dice-roll results in text. Under certain unusual inputs, it could cause the browser to slow down briefly, but no actual attack or data theft is possible from this alone.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 2588 contains a lazy quantifier `.*?` and optional groups that could, in theory, cause excessive backtracking on crafted input. However, the regex is highly specific to a fixed dice-roll format, and the `.*?` is lazy, limiting backtracking risk. No ReDoS exploit is demonstrated, and the worst-case impact is a temporary client-side slowdown or unresponsiveness, which is recoverable by reloading the tab. This is a code-quality issue rather than a material vulnerability.
Impact: low · Exploitability: plausible
Developer action: Consider adding a length limit on the input string before applying the regex, or reworking the regex to eliminate the lazy quantifier if performance becomes a concern. For example, replace `.*?` with a more constrained pattern like `\s*` or a character class.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:2588
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This line uses a pattern to find dice-roll margins in text. While flagged as potentially unsafe, it's actually quite safe in practice and no harm has been shown.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 2587 uses optional non-capturing groups and alternation, but does not contain nested quantifiers or ambiguous alternations that typically lead to catastrophic backtracking. The pattern is well-constrained to a specific dice-roll format. No ReDoS exploit is demonstrated, and the worst-case impact is a minor temporary slowdown, recoverable by the user. This is a code-quality signal, not a material vulnerability.
Impact: low · Exploitability: plausible
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- pre-flight.js:2587
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A regular expression used to detect helpful actions in the Story Engine could be abused to slow down or freeze your browser if someone sends a specially crafted message. Because the extension runs only on your own computer, this would only affect you, and the problem is limited to a temporary slowdown or freeze. It's a quality issue rather than a security threat.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The JS-X-Ray scanner flagged a regular expression on line 6383 of file as potentially vulnerable to ReDoS (Regular Expression Denial of Service). The regex is part of the isCooperativeAidAction function and contains nested alternations, optional groups, and variable-length patterns (e.g., 'pull\s+(?:him|her|them|[a-z]+)\s+(?:clear|free|out)') that could cause catastrophic backtracking on crafted inputs. The source text originates from user messages or LLM output, so an attacker who can influence that input might trigger excessive CPU consumption. However, the extension runs entirely client-side in the browser; the worst-case outcome is a frozen tab or UI unresponsiveness, which is a recoverable local denial of service. No actual exploitation is demonstrated in the supplied evidence, and the pattern is a legitimate NLP heuristic for detecting aid-related actions. The technical risk is limited to self-DoS with low impact.
Impact: low · Exploitability: plausible
Developer action: Consider refactoring the regex to avoid exponential backtracking. Break the pattern into simpler checks, use word-boundary-anchored literal alternations without nested optional quantifiers, or pre-validate input length. Tools like regex101 or recheck can help identify problematic patterns. While not urgent, this would improve robustness against crafted inputs.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:6383
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A pattern used to figure out if a vessel name refers to the player might be slow on some unusual inputs, but there's no proof it can be used to cause harm.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The unsafe-regex signal at line 6631 flags the regex /^(?:the\s+)?(?:\{\{user\}\}|user|player|player character|you|your|his|her|their|body|mind|head|vessel)(?:'s)?(?:\s+(?:body|mind|head|vessel|soul|spirit))?$/i used in formatBoundCompanionVessel to detect a user reference. This regex could cause backtracking if fed a long string with many alternatives, but the input is a short vessel description from game state. No demonstrated attack path; the function is called with bearer data under normal extension operation. Impact is limited to local unresponsiveness.
Impact: low · Exploitability: unlikely
Developer action: Replace this regex with a simpler string check or an anchored prefix/suffix test to avoid any backtracking issues.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:6631
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · high confidence
This long pattern-matching rule could potentially slow down the extension if someone sends a weirdly long message, but it's not a serious security risk. It's just a text-detection tool for the game rules.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 9289 in `hasDirectBodilyAggression` is a large static alternation pattern used to classify text for game mechanic resolution. While the regex is complex and could theoretically cause performance degradation on specially crafted long inputs (ReDoS), it does not contain nested quantifiers or backtracking patterns typical of catastrophic backtracking. The input is user-provided text in a single-player local environment, so any denial of service would be self-inflicted and recoverable. No evidence of an actual exploit or external exposure is present.
Impact: low · Exploitability: unlikely
Developer action: Consider adding a maximum input length guard before applying the regex, or refactor the pattern into multiple simpler checks to reduce complexity. However, the current risk is low and no immediate change is required.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:9289
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A regular expression used to clean up AI-generated text might be able to cause a brief slowdown if a specially crafted line were fed to it. However, the lines it processes are short and come from the AI model, so the chance of harmful performance issues is very low.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 230 of file (/^(?:[*_~]{1,3})?\s*(?:CONCLUSION|VALIDATION CONCLUSION|FINAL CHECK|RENDER CHECK)\s*:/i) was flagged as an unsafe-regex by JS-X-Ray. While the pattern contains optional quantifiers and whitespace, the subpatterns are bounded and the regex is tested against short, trimmed lines from LLM output. There is no evidence of actual catastrophic backtracking, and the worst-case impact is a brief client-side slowdown during narration sanitization. This is a minor weakness with low risk in the SillyTavern extension context.
Impact: low · Exploitability: plausible
Developer action: Review the regex for potential ReDoS patterns and consider anchoring the whitespace more tightly (e.g., using \s{0,10} instead of \s*) to further reduce any backtracking risk. The current pattern is likely safe but a conservative hardening would improve robustness.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- narration-sanitizer.js:230
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A pattern used to rename 'bandage roll of linen' might be slow on some inputs, but it's not a security problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The unsafe-regex signal at line 6568 flags the regex /^bandage\s+roll\s+of\s+(?:boiled\s+)?linen$/i used in formatTrackerItemDisplayName. This regex has nested quantifiers that could cause backtracking, but the input is always short (item names). No attacker-controlled path demonstrated; the function processes game-generated or user-provided item names. Impact is low (potential temporary UI slowdown).
Impact: low · Exploitability: unlikely
Developer action: Consider using a simple string comparison or a less nested regex pattern.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:6568
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A pattern used to find words like 'rope' or 'chain' might be slow on some inputs, but it's not a real danger.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The unsafe-regex signal at line 6544 flags the regex /\b(?:[a-z][a-z-]*\s+)?(?:rope|cord|cable|chain|wire)\b/ig used in formatTrackerItemDisplayName to extract material names. This regex uses alternation with a quantifier, which could be slow on crafted input, but the input is a short item name. No demonstrated exploitation path; the function is only called with game data. Impact is low (local tab unresponsiveness).
Impact: low · Exploitability: unlikely
Developer action: Simplify the regex or use a fixed list of words with a single alternation without the optional prefix to reduce backtracking risk.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:6544
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
The extension uses a large, complicated regular expression to check if a description contains game-like numbers or terms. This could, in theory, make your browser slow or freeze if the AI generates a very tricky sentence, but the risk is low because the text is short and the attacker would need to trick the AI first.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The function hasProgressionMechanicalLanguage at line 12070 combines three complex regular expressions with many alternations, optional quantifiers, and lookarounds. In principle, this pattern could cause catastrophic backtracking on adversarial input, leading to a temporary browser freeze. However, the input is limited to AI-generated descriptions clipped to 520 characters, and the attacker would need to control the LLM's output to produce a pathological string. No actual ReDoS exploit is demonstrated, and any potential denial of service is local and recoverable (browser tab freeze).
Impact: low · Exploitability: plausible
Developer action: Consider simplifying the regex by removing unnecessary alternations or using a more bounded approach (e.g., split into smaller tests or use a parser). Test with known ReDoS patterns to confirm vulnerability. If performance is a concern, add a timeout or input length limit (already present via clipText).
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:12070
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
Similar to the other finding, this regex could theoretically be slow with oddly crafted text, but since it's your own character sheet, there's no real security concern.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 4365 parses plain text ability names with a bounded quantifier {1,60} and no nested quantifiers, making catastrophic backtracking highly unlikely. Input again comes from the user's own persona content, self-controlled and size-limited. Any theoretical performance impact would be localized and temporary.
Impact: low · Exploitability: unlikely
Developer action: No change required for security. If desired, an input length cap on persona text would add defense in depth.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:4365
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 716 in parseMetricHeightCentimeters contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.
Impact: low · Exploitability: plausible
Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:716
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A pattern used to detect phrases like 'coil of' might be slow, but there's no evidence it can be used to cause any real problem.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The unsafe-regex signal at line 6543 flags the regex /^(?:a\s+)?(?:coil|length)\s+of\b/i used in formatTrackerItemDisplayName. This regex is part of a conditional check and could cause backtracking if combined with adversarially chosen input, but the input is short and game-controlled. No demonstrated attack path; impact is low (potential minor slowdown).
Impact: low · Exploitability: unlikely
Developer action: Consider using a simple starts-with check or a non-regex approach for this pattern.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:6543
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
This is a slow regular expression that could cause a temporary freeze if someone types a tricky sentence, but it won't harm your data or privacy.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 5993 is large with many alternations and optional whitespace groups, making it susceptible to ReDoS. It is used on user-supplied narrative text and can cause local client slowdown. The impact is limited to denial of service for the user's own session.
Impact: low · Exploitability: plausible
Developer action: Refactor the regex to reduce backtracking: split into multiple simpler checks, use string includes, or employ a regex engine safe against ReDoS. Test with adversarial inputs.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:5923
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · low confidence
A security scanner thought a pattern in the code might cause the browser to slow down or freeze, but looking at the actual code, the pattern is well-written and won't cause problems. There's no evidence of a real risk.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The scanner flagged a regex at line 183 used to detect tool-related error messages. The regex uses alternation and optional groups but does not contain nested quantifiers or overlapping alternations that would cause catastrophic backtracking. Input is a concatenation of LLM error message and body, which is bounded and not attacker-controlled beyond normal LLM output. No ReDoS (Regular Expression Denial of Service) vector is demonstrated in the supplied evidence. The flag is a heuristic false positive from JS-X-Ray.
Impact: low · Exploitability: unlikely
Developer action: No change required. The regex is safe as written. If desired, consider adding a length limit on the input string as defense-in-depth, but it is not necessary for security.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:183
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 730 in parseImperialHeightInches contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.
Impact: low · Exploitability: plausible
Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:730
JavaScript analysis reported javascript.xray.unsafe-regex
Minor caution · medium confidence
A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex at line 713 in parseMetricHeightCentimeters contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.
Impact: low · Exploitability: plausible
Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- character-sheet-generation.js:713
Expected scanner matches (18)
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The security scanner flagged a long word-matching pattern used to detect when a character's injury is healed or resolved. This pattern is built into the code and doesn't change based on anything you type. It's not dangerous; the warning is just a cautious signal about the pattern's length.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex at line 4544 is a static, hardcoded pattern used to match resolved injury evidence in narration text. It is not dynamically constructed from user or external input. While the pattern is long, it does not contain nested quantifiers or overlapping alternations known to cause catastrophic backtracking under typical input. The scanner signal 'unsafe-regex' is a generic heuristic that does not account for the real-world usage context or the pattern's structure. No attacker-controlled input reaches the regex construction; it operates on pre-existing narrative strings. Even if pathological input were crafted, the worst outcome would be a temporary CPU spike in the user's own browser, a self-denial-of-service with no external harm.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:4544
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The security scanner flagged a long pattern used to figure out if a player is accepting an item in a roleplay. This pattern is fixed (not built from user input) and doesn't have the dangerous nested loops that could slow down or crash the game. It works as intended.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The scanner rule 'javascript.xray.unsafe-regex' flagged a static regex literal on line 3584. This regex is used to detect user acceptance of an offered object. It is a fixed pattern with no user-controlled dynamic construction. The input is normalized via normalizeItemPossessionClaimText before being tested. The pattern contains alternations and optional groups but no nested quantifiers or overlapping alternations that would cause catastrophic backtracking (ReDoS). The same file contains other similarly long static regex patterns, all proportionate to the project's game mechanic parsing needs. No ReDoS vulnerability is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:3584
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This is just a harmless pattern that extracts names and paths from a string. It does not slow down or crash and is not dangerous.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex /^relationshipEngine\[([^\]]+)\](?:\.(.*))?$/ at line 44 is used to parse a structured path string. It contains no nested quantifiers, alternation, or overlapping groups that would cause catastrophic backtracking. The pattern is simple and safely bounded by literal anchors and character class negation. No ReDoS vulnerability is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-golden-evaluator.mjs:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test file uses a programming technique to isolate and check internal parts of the extension's code. It does this by taking snippets of the extension's own source and running them in a controlled test environment. This is a standard testing practice and does not affect the safety of the extension for users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate matches a use of `new Function` inside a test file (file) that extracts source code from the project's own file to test internal functions. The function body is constructed from a controlled slice of the project source, not from user or external input. The test code is not loaded during normal extension execution; it only runs during development testing. There is no attacker-controlled data path, and the dynamic execution poses no risk to users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:16322-16330
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner thought it found a secret key, but it's actually a test that checks that the extension properly hides secret information in error messages. The test intentionally includes fake secrets to make sure the hiding code works correctly.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The Gitleaks match on line 16893 of file corresponds to a test fixture that deliberately constructs an Error object containing placeholder secret tokens (e.g., [REDACTED_SECRET:b80965ff4cbf]) to verify that the formatSemanticDiagnostic function correctly redacts credential-like strings. The subsequent assertions confirm that the redacted output does not contain the original placeholder values. This is a defensive test of a security-sensitive redaction feature, not an actual credential exposure. No real API keys, bearer tokens, or secrets are present in the shipped or executable code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- test-behavior.mjs:16893
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
The code uses a regular expression to detect relationship-related phrases like 'start a romance'. This pattern is safe and does not have performance problems or security issues.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex at line 4928 is a simple alternation pattern with fixed word boundaries and no nested quantifiers or overlapping alternations that could cause catastrophic backtracking. JS-X-Ray's 'unsafe-regex' signal is a false positive in this context; the pattern is safe against ReDoS attacks and operates on user-provided chat text as expected for a relationship-detection function.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- deterministic-runner.js:4928
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code uses a regular expression to fix formatting in text coming from the AI, changing single quotes to double quotes. The flagged pattern is a normal way to handle quotes and is not dangerous because the text being processed comes from the AI itself, not from a user who might try to cause problems.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex at line 1868 is used within the function `repairToolArgumentJson` to convert single-quoted strings to double-quoted strings, escaping internal double quotes. This function processes tool-call argument JSON produced by an LLM semantic ledger, not arbitrary user-controlled input. The regex pattern `/:\s*'([^'\\]*(?:\\.[^'\\]*)*)'/g` is a standard pattern for matching single-quoted strings with escape sequences. While static analysis flags it as potentially vulnerable to ReDoS, the input source (LLM output) is not attacker-controlled, and the regex does not exhibit catastrophic backtracking patterns with nested quantifiers on the same token; the quantifier `*` operates on alternates that are mutually exclusive. Therefore, there is no practical security risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:1868
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test creates a temporary function from a part of the extension's code to check if settings migration works correctly. It's like taking a piece of the extension and running it in a testing sandbox. Since this only happens during testing and doesn't involve your data, it is not a security concern for users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate matches a `new Function` call in file that constructs a function from source code extracted from index.js. The purpose is to test the settings migration logic of the extension. The source used is controlled and derived from the project's own code, and the test receives only static predefined arguments. There is no user-influence or external untrusted data involved. The test file is not executed during normal use of the extension.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:16278-16292
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that creates a temporary function to check that some layout code works correctly. It only runs during development, never when you use the extension, so it's harmless.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The call to new Function appears inside a test file (file) and constructs a function from a slice of the production source code solely for the purpose of unit testing the layout and display logic of the tracker widget. The function is never shipped or executed in the runtime extension. No untrusted input reaches this code; the source is read from the project's own file file, which is static at test time. There is no data exfiltration, hidden execution, or malicious intent.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11200-11203
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code is checking for sensitive info like passwords or API keys in error messages and replacing them with '[REDACTED]' so that private keys don't accidentally get shown to users or logged. The security scanner flagged this pattern as potentially dangerous, but actually it's a safety feature—it helps protect your credentials from leaking.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex flagged by JS-X-Ray as 'unsafe-regex' is used inside `sanitizeDiagnosticText` to redact credentials (API keys, authorization tokens, secrets) from diagnostic error messages before they are logged or displayed. The pattern is well-structured, does not exhibit catastrophic backtracking risks due to its limited alternatives and use of negated character classes, and its only purpose is to protect sensitive data from leaking in error output. The rule is a false positive in this context because the regex is a defensive security measure, not a vulnerability.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:345
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code uses a regular expression to parse error messages and extract details. The pattern is safe and does not cause performance issues, even with unexpected input.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 1780 (`/^(\$(?:\.[^\s.\[\]]+|\[\d+\])*)/`) is used to extract a JSON path from an error message. The pattern is well-structured with safe character classes and bounded nesting; it does not exhibit catastrophic backtracking. Input is limited to short error messages. The scanner's 'unsafe-regex' signal is a false positive for this use case.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:1783
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This regular expression checks error messages to see what data type was expected. It is simple and safe; it cannot be tricked into slowing down the system.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regex on line 1783 (`/must be (?:an? |a )?(boolean|string|integer|array|object)/i`) matches a type description in error messages. It uses a simple optional group and a flat alternation of fixed words. No nested quantifiers or overlapping alternatives exist that could cause ReDoS. Input is bounded. The scanner alert is a false positive.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:1780
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test creates a temporary function to verify that old widget settings can be updated. It only runs during development, not when you use the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The new Function call is within the same test file and constructs a migration helper from a trusted slice of the production source. It is used to validate that tracker widget settings migration works correctly. No attacker-controlled input is involved, and the function is not shipped to users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11193-11199
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code pattern simply checks for words related to short-lived injuries, like 'hit' or 'pain'. It comes pre-written and doesn't change based on user input. The warning is not actionable.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex at line 4488 is a static, hardcoded pattern used to identify transient injury language like 'hit', 'blow', 'pain'. It is not dynamically constructed from untrusted input. The pattern's structure is a flat alternation of fixed strings and simple optional groups without problematic nesting. No concrete ReDoS vulnerability is demonstrated. The regex operates on user-provided narrative strings within the extension's intended text-analysis role. The resource impact of any pathological input is limited to the user's own client.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:4488
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code uses a regular expression to check if a line of text looks like a money amount (like '5 silver' or '$10'). The pattern is simple and does not have any security risk—it just matches common currency formats. The scanner warning is unnecessary.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The regular expression at line 3689 is used to validate currency strings extracted from user persona text. It matches either a dollar sign followed by a digit, or a numeric amount followed by currency abbreviations (e.g., silver, credits, dollars). The pattern has no nested quantifiers or ambiguous alternations that could cause catastrophic backtracking. The input is a single trimmed line from the user's own persona data, which is not attacker-controlled in a cross-user context. The scanner alert for 'unsafe-regex' is a false positive; the regex is safe and performs a simple validation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- index.js:3689
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This code uses regular expressions to help figure out a character's name from their description. The patterns are safe and won't cause slowdowns or crashes.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The three regex patterns at line 2309-2311 are used by getPersonaIdentityHints() to extract name-like fields from character persona text. Each regex uses bounded character classes with max length constraints and no nested quantifiers, making them resistant to catastrophic backtracking. The input is a local string from character card fields, not untrusted external input. The scanner's 'unsafe-regex' signal is a false positive; no ReDoS or other security vulnerability is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:2309
JavaScript analysis reported javascript.xray.unsafe-regex
Expected behavior · high confidence
This line checks for words related to medical treatment, like 'bandage' or 'stitch'. It's a fixed list of words built into the extension, not something that can be tricked. No danger.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.
Contextual assessment: The flagged regex at line 4500 is a static, hardcoded pattern used to detect treatment language like 'bandage', 'splint', 'stitch'. It is not dynamically assembled from user input. The pattern is a flat alternation with simple optional groups; it does not exhibit ReDoS-prone constructs. The signal from the static analyzer is a generic heuristic. The regex operates on narrative text within the extension's domain of semantic analysis. No evidence of exploitability or harm beyond trivial client-side slowdown exists.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
- Rule
- javascript.xray.unsafe-regex
- File role
- production
- Source
- semantic-extractor.js:4500
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test creates a temporary function to check that the tracker widget stays on the screen. It only runs during development, never when you use the extension.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The new Function call is in the same test file and creates a function container for clamping math used in widget positioning. The source is a trusted slice of the production index.js. The function is only invoked during test assertions to verify correct coordinate calculation. No attacker input reaches this path, and the code is never present in the shipped extension.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- test-behavior.mjs:11182-11192