TavernKeeper Scan Report

ZDOSt/Story-Engine

Commit 3bab20b Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 48 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 710 in parseMetricHeightCentimeters contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.

Impact: low · Exploitability: plausible

Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:710

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A pattern used to check character sheet text for an 'isekai' origin has a complex regular expression that might run slowly if someone feeds it a specially crafted string. This could cause the browser to lag temporarily, but it won't steal data or break anything permanently.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 108 contains complex alternatives with optional groups (e.g., `lost\s+(?:(?:his|her|their|its|the)\s+)?life`) that could, under adversarial crafted input, cause excessive backtracking and client-side performance degradation. This is a static pattern applied to LLM-generated character sheet text, not dynamically constructed. No actual exploit or ReDoS is demonstrated in the supplied evidence. The impact is limited to recoverable local slowdown or tab freezing, which is low.

Impact: low · Exploitability: plausible

Developer action: Consider simplifying the regex by splitting into multiple simpler checks or using a non-backtracking approach. Alternatively, add a timeout or input length limit to mitigate potential ReDoS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-validation.js:108

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This is a minor code quality note where a regular expression could potentially be slow with very carefully crafted input. Since you control your own character sheet, the risk is only to yourself and unlikely to be a problem.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 4363 is used to parse bold-markdown ability names from persona text. JS-X-Ray flagged it as potentially unsafe, but the pattern uses a lazy quantifier (.+?) and no nested quantifiers, so catastrophic backtracking is not evident. The input originates from the user's own persona description, which is self-controlled and limited in size. Any ReDoS exploit would only affect the user's own session and cause a temporary local slowdown, not data exposure or code execution. The risk is not demonstrated in the supplied evidence.

Impact: low · Exploitability: unlikely

Developer action: Consider adding a length limit on persona text or using a simpler string method (e.g., .startsWith) if feasible to avoid any theoretical ReDoS risk, though the current pattern is not known to be vulnerable.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:4363

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A line of code that splits text into sentences uses a pattern that might be slow on weird input. If someone fed it a specially-crafted long sentence, it could temporarily freeze your browser tab until you refresh. No one has shown this happening in practice, and it's a low-severity quality issue.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: Line 292 contains a regular expression /[^.!?\r\n]+(?:[.!?]+(?=(?:["'\u2019\u201d\u00bb)\]]+)?(?:\s|$))|$)/g used for sentence splitting. Static analysis flagged it as potentially unsafe due to nested quantifiers that could cause catastrophic backtracking on crafted input. However, the regex is applied to narration text generated by the LLM or user, which is not attacker-controlled in a meaningful way; the worst-case impact is a local slowdown or frozen tab that is resolved by refreshing. No concrete exploit is demonstrated in the supplied evidence, and the regex has been present in the codebase without reported issues.

Impact: low · Exploitability: plausible

Developer action: Consider reviewing the regex at line 292 and simplifying it if possible (e.g., avoid nested optional groups and alternation inside lookaheads) to reduce the risk of catastrophic backtracking. Alternatively, add a length or complexity check on the input before applying the regex.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
prose-guard-edits.js:292

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 722 in parseImperialHeightInches contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.

Impact: low · Exploitability: plausible

Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:722

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

The code uses a complex pattern to find a character's age in text. This pattern could slow down the browser if someone writes a very tricky character description, but since it only applies to your own characters, it's not a security problem for others.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 1194 in resolveIsekaiCharacterAge contains nested optional quantifiers and alternation that may cause catastrophic backtracking (ReDoS) on crafted input. However, the regex is only applied to the user's own character text during story seed generation, which is bounded in size and not exposed to external attacker control. No evidence of actual exploitation or performance impact was provided; the scanner signal is a static warning. The practical risk is low because the attacker would need to supply a malicious character card to their own client, which is a self-targeted action with no cross-user harm.

Impact: low · Exploitability: unlikely

Developer action: Consider simplifying the regex or splitting it into multiple simpler checks to reduce the risk of catastrophic backtracking. Alternatively, use a parser-based approach or impose a reasonable input length limit on character text before applying the regex.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
pre-flight.js:1194

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This code uses a pattern to find a character's name from a description. If someone creates a very long weird description that doesn't match the expected format, it could slow down your browser for a moment. It's not a security risk but could be improved to run faster.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex in parsePersonaName() (line 9195) uses a greedy quantifier ([^\n\r]+) after a fixed prefix. On a long non-matching input, the engine may backtrack character-by-character, producing O(n) worst-case time. While not a classic catastrophic ReDoS, this could cause a momentary slowdown if a maliciously crafted character card field is parsed. The scanner correctly identifies a potential weak pattern, but no concrete exploit path or exposure is demonstrated.

Impact: low · Exploitability: unlikely

Developer action: Consider anchoring the regex to the end of the line (e.g., adding $) or using a non-greedy quantifier ([^\n\r]+?) to limit backtracking. If the intended match is always a single line, the pattern could be made more specific.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:9195

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This is a slow regular expression that could make your browser freeze if someone sends a specially crafted message, but it wouldn't steal any data or break your game.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 5923 is complex with many alternations and optional groups, which can cause catastrophic backtracking (ReDoS) when applied to untrusted user input. While it only operates client-side on narrative text and the impact is limited to local performance degradation, it is a quality issue that should be addressed.

Impact: low · Exploitability: plausible

Developer action: Simplify or restructure the regex to avoid nested optional groups and alternations that cause backtracking. Use a regex debugger to verify performance or replace with simpler pattern matching.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:5993

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A complex pattern used to rewrite item names might cause the browser to slow down or freeze if someone sends a very carefully crafted name, but there's no evidence this can actually happen or be exploited in practice.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The unsafe-regex signal flags a potentially vulnerable regular expression at line 6570 used in formatTrackerItemDisplayName for text normalization. The regex /^(?:one|two|three|four|five|six|seven|eight|nine|ten|\d+)\s+(?:leather\s+)?bootlaces\s+and\s+(?:a|an|one)\s+whetstone$/i could exhibit catastrophic backtracking on crafted input, but the input is a short string from user-provided tracker item names or game content. No attacker-controlled path is demonstrated; the function is called with sanitized or game-generated strings. Impact is limited to a potential local browser tab unresponsiveness, which is recoverable and not a security breach.

Impact: low · Exploitability: unlikely

Developer action: Consider simplifying the regex or using a non-backtracking approach (e.g., replace with a plain string match or a less complex pattern) to eliminate the theoretical ReDoS risk.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:6570

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This line uses a search pattern that might slow down or freeze your browser if the AI's response contains many partial matches of the markers. This is unlikely to happen normally, but someone could intentionally cause it. A simple browser refresh fixes it.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 67 uses `[\s\S]*?` non-greedily, which can cause catastrophic backtracking when the input contains many incomplete matches of BEGIN_PROSE_GUARD_EDITS without the terminating END_PROSE_GUARD_EDITS. This is a client-side operation on AI-generated text; a malicious input crafted to trigger the backtracking could freeze the browser tab temporarily. No evidence of exploitation exists, and the impact is limited to local, recoverable denial of service. The pattern is consistent with the file's purpose of stripping structured markers from narration output.

Impact: low · Exploitability: unlikely

Developer action: Consider hardening the regex by limiting input length before processing, or using a non-regex approach (e.g., indexOf and slice) for these specific markers. If regex is retained, use atomic groups or possessive quantifiers to prevent backtracking, or split and rejoin on known markers.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
narration-sanitizer.js:67

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This line uses a pattern to find dice-roll results in text. Under certain unusual inputs, it could cause the browser to slow down briefly, but no actual attack or data theft is possible from this alone.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 2588 contains a lazy quantifier `.*?` and optional groups that could, in theory, cause excessive backtracking on crafted input. However, the regex is highly specific to a fixed dice-roll format, and the `.*?` is lazy, limiting backtracking risk. No ReDoS exploit is demonstrated, and the worst-case impact is a temporary client-side slowdown or unresponsiveness, which is recoverable by reloading the tab. This is a code-quality issue rather than a material vulnerability.

Impact: low · Exploitability: plausible

Developer action: Consider adding a length limit on the input string before applying the regex, or reworking the regex to eliminate the lazy quantifier if performance becomes a concern. For example, replace `.*?` with a more constrained pattern like `\s*` or a character class.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
pre-flight.js:2588

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This line uses a pattern to find dice-roll margins in text. While flagged as potentially unsafe, it's actually quite safe in practice and no harm has been shown.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 2587 uses optional non-capturing groups and alternation, but does not contain nested quantifiers or ambiguous alternations that typically lead to catastrophic backtracking. The pattern is well-constrained to a specific dice-roll format. No ReDoS exploit is demonstrated, and the worst-case impact is a minor temporary slowdown, recoverable by the user. This is a code-quality signal, not a material vulnerability.

Impact: low · Exploitability: plausible

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
pre-flight.js:2587

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A regular expression used to detect helpful actions in the Story Engine could be abused to slow down or freeze your browser if someone sends a specially crafted message. Because the extension runs only on your own computer, this would only affect you, and the problem is limited to a temporary slowdown or freeze. It's a quality issue rather than a security threat.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The JS-X-Ray scanner flagged a regular expression on line 6383 of file as potentially vulnerable to ReDoS (Regular Expression Denial of Service). The regex is part of the isCooperativeAidAction function and contains nested alternations, optional groups, and variable-length patterns (e.g., 'pull\s+(?:him|her|them|[a-z]+)\s+(?:clear|free|out)') that could cause catastrophic backtracking on crafted inputs. The source text originates from user messages or LLM output, so an attacker who can influence that input might trigger excessive CPU consumption. However, the extension runs entirely client-side in the browser; the worst-case outcome is a frozen tab or UI unresponsiveness, which is a recoverable local denial of service. No actual exploitation is demonstrated in the supplied evidence, and the pattern is a legitimate NLP heuristic for detecting aid-related actions. The technical risk is limited to self-DoS with low impact.

Impact: low · Exploitability: plausible

Developer action: Consider refactoring the regex to avoid exponential backtracking. Break the pattern into simpler checks, use word-boundary-anchored literal alternations without nested optional quantifiers, or pre-validate input length. Tools like regex101 or recheck can help identify problematic patterns. While not urgent, this would improve robustness against crafted inputs.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:6383

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A pattern used to figure out if a vessel name refers to the player might be slow on some unusual inputs, but there's no proof it can be used to cause harm.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The unsafe-regex signal at line 6631 flags the regex /^(?:the\s+)?(?:\{\{user\}\}|user|player|player character|you|your|his|her|their|body|mind|head|vessel)(?:'s)?(?:\s+(?:body|mind|head|vessel|soul|spirit))?$/i used in formatBoundCompanionVessel to detect a user reference. This regex could cause backtracking if fed a long string with many alternatives, but the input is a short vessel description from game state. No demonstrated attack path; the function is called with bearer data under normal extension operation. Impact is limited to local unresponsiveness.

Impact: low · Exploitability: unlikely

Developer action: Replace this regex with a simpler string check or an anchored prefix/suffix test to avoid any backtracking issues.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:6631

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · high confidence

This long pattern-matching rule could potentially slow down the extension if someone sends a weirdly long message, but it's not a serious security risk. It's just a text-detection tool for the game rules.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 9289 in `hasDirectBodilyAggression` is a large static alternation pattern used to classify text for game mechanic resolution. While the regex is complex and could theoretically cause performance degradation on specially crafted long inputs (ReDoS), it does not contain nested quantifiers or backtracking patterns typical of catastrophic backtracking. The input is user-provided text in a single-player local environment, so any denial of service would be self-inflicted and recoverable. No evidence of an actual exploit or external exposure is present.

Impact: low · Exploitability: unlikely

Developer action: Consider adding a maximum input length guard before applying the regex, or refactor the pattern into multiple simpler checks to reduce complexity. However, the current risk is low and no immediate change is required.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:9289

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A regular expression used to clean up AI-generated text might be able to cause a brief slowdown if a specially crafted line were fed to it. However, the lines it processes are short and come from the AI model, so the chance of harmful performance issues is very low.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 230 of file (/^(?:[*_~]{1,3})?\s*(?:CONCLUSION|VALIDATION CONCLUSION|FINAL CHECK|RENDER CHECK)\s*:/i) was flagged as an unsafe-regex by JS-X-Ray. While the pattern contains optional quantifiers and whitespace, the subpatterns are bounded and the regex is tested against short, trimmed lines from LLM output. There is no evidence of actual catastrophic backtracking, and the worst-case impact is a brief client-side slowdown during narration sanitization. This is a minor weakness with low risk in the SillyTavern extension context.

Impact: low · Exploitability: plausible

Developer action: Review the regex for potential ReDoS patterns and consider anchoring the whitespace more tightly (e.g., using \s{0,10} instead of \s*) to further reduce any backtracking risk. The current pattern is likely safe but a conservative hardening would improve robustness.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
narration-sanitizer.js:230

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A pattern used to rename 'bandage roll of linen' might be slow on some inputs, but it's not a security problem.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The unsafe-regex signal at line 6568 flags the regex /^bandage\s+roll\s+of\s+(?:boiled\s+)?linen$/i used in formatTrackerItemDisplayName. This regex has nested quantifiers that could cause backtracking, but the input is always short (item names). No attacker-controlled path demonstrated; the function processes game-generated or user-provided item names. Impact is low (potential temporary UI slowdown).

Impact: low · Exploitability: unlikely

Developer action: Consider using a simple string comparison or a less nested regex pattern.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:6568

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A pattern used to find words like 'rope' or 'chain' might be slow on some inputs, but it's not a real danger.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The unsafe-regex signal at line 6544 flags the regex /\b(?:[a-z][a-z-]*\s+)?(?:rope|cord|cable|chain|wire)\b/ig used in formatTrackerItemDisplayName to extract material names. This regex uses alternation with a quantifier, which could be slow on crafted input, but the input is a short item name. No demonstrated exploitation path; the function is only called with game data. Impact is low (local tab unresponsiveness).

Impact: low · Exploitability: unlikely

Developer action: Simplify the regex or use a fixed list of words with a single alternation without the optional prefix to reduce backtracking risk.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:6544

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

The extension uses a large, complicated regular expression to check if a description contains game-like numbers or terms. This could, in theory, make your browser slow or freeze if the AI generates a very tricky sentence, but the risk is low because the text is short and the attacker would need to trick the AI first.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The function hasProgressionMechanicalLanguage at line 12070 combines three complex regular expressions with many alternations, optional quantifiers, and lookarounds. In principle, this pattern could cause catastrophic backtracking on adversarial input, leading to a temporary browser freeze. However, the input is limited to AI-generated descriptions clipped to 520 characters, and the attacker would need to control the LLM's output to produce a pathological string. No actual ReDoS exploit is demonstrated, and any potential denial of service is local and recoverable (browser tab freeze).

Impact: low · Exploitability: plausible

Developer action: Consider simplifying the regex by removing unnecessary alternations or using a more bounded approach (e.g., split into smaller tests or use a parser). Test with known ReDoS patterns to confirm vulnerability. If performance is a concern, add a timeout or input length limit (already present via clipText).

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:12070

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

Similar to the other finding, this regex could theoretically be slow with oddly crafted text, but since it's your own character sheet, there's no real security concern.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 4365 parses plain text ability names with a bounded quantifier {1,60} and no nested quantifiers, making catastrophic backtracking highly unlikely. Input again comes from the user's own persona content, self-controlled and size-limited. Any theoretical performance impact would be localized and temporary.

Impact: low · Exploitability: unlikely

Developer action: No change required for security. If desired, an input length cap on persona text would add defense in depth.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:4365

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 716 in parseMetricHeightCentimeters contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.

Impact: low · Exploitability: plausible

Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:716

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A pattern used to detect phrases like 'coil of' might be slow, but there's no evidence it can be used to cause any real problem.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The unsafe-regex signal at line 6543 flags the regex /^(?:a\s+)?(?:coil|length)\s+of\b/i used in formatTrackerItemDisplayName. This regex is part of a conditional check and could cause backtracking if combined with adversarially chosen input, but the input is short and game-controlled. No demonstrated attack path; impact is low (potential minor slowdown).

Impact: low · Exploitability: unlikely

Developer action: Consider using a simple starts-with check or a non-regex approach for this pattern.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:6543

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This is a slow regular expression that could cause a temporary freeze if someone types a tricky sentence, but it won't harm your data or privacy.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 5993 is large with many alternations and optional whitespace groups, making it susceptible to ReDoS. It is used on user-supplied narrative text and can cause local client slowdown. The impact is limited to denial of service for the user's own session.

Impact: low · Exploitability: plausible

Developer action: Refactor the regex to reduce backtracking: split into multiple simpler checks, use string includes, or employ a regex engine safe against ReDoS. Test with adversarial inputs.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:5923

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · low confidence

A security scanner thought a pattern in the code might cause the browser to slow down or freeze, but looking at the actual code, the pattern is well-written and won't cause problems. There's no evidence of a real risk.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The scanner flagged a regex at line 183 used to detect tool-related error messages. The regex uses alternation and optional groups but does not contain nested quantifiers or overlapping alternations that would cause catastrophic backtracking. Input is a concatenation of LLM error message and body, which is bounded and not attacker-controlled beyond normal LLM output. No ReDoS (Regular Expression Denial of Service) vector is demonstrated in the supplied evidence. The flag is a heuristic false positive from JS-X-Ray.

Impact: low · Exploitability: unlikely

Developer action: No change required. The regex is safe as written. If desired, consider adding a length limit on the input string as defense-in-depth, but it is not necessary for security.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:183

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 730 in parseImperialHeightInches contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.

Impact: low · Exploitability: plausible

Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:730

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

A specially crafted height measurement could slow down or freeze your browser, but no data is stolen or leaked.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex at line 713 in parseMetricHeightCentimeters contains nested optional groups and alternations that may cause catastrophic backtracking on crafted input, leading to client-side denial of service. The input is user-supplied height text from character sheet fields.

Impact: low · Exploitability: plausible

Developer action: Simplify the regex, add input length limits, or implement a timeout for regex execution to mitigate ReDoS.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
character-sheet-generation.js:713
Expected scanner matches (18)

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The security scanner flagged a long word-matching pattern used to detect when a character's injury is healed or resolved. This pattern is built into the code and doesn't change based on anything you type. It's not dangerous; the warning is just a cautious signal about the pattern's length.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged regex at line 4544 is a static, hardcoded pattern used to match resolved injury evidence in narration text. It is not dynamically constructed from user or external input. While the pattern is long, it does not contain nested quantifiers or overlapping alternations known to cause catastrophic backtracking under typical input. The scanner signal 'unsafe-regex' is a generic heuristic that does not account for the real-world usage context or the pattern's structure. No attacker-controlled input reaches the regex construction; it operates on pre-existing narrative strings. Even if pathological input were crafted, the worst outcome would be a temporary CPU spike in the user's own browser, a self-denial-of-service with no external harm.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:4544

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The security scanner flagged a long pattern used to figure out if a player is accepting an item in a roleplay. This pattern is fixed (not built from user input) and doesn't have the dangerous nested loops that could slow down or crash the game. It works as intended.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The scanner rule 'javascript.xray.unsafe-regex' flagged a static regex literal on line 3584. This regex is used to detect user acceptance of an offered object. It is a fixed pattern with no user-controlled dynamic construction. The input is normalized via normalizeItemPossessionClaimText before being tested. The pattern contains alternations and optional groups but no nested quantifiers or overlapping alternations that would cause catastrophic backtracking (ReDoS). The same file contains other similarly long static regex patterns, all proportionate to the project's game mechanic parsing needs. No ReDoS vulnerability is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:3584

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is just a harmless pattern that extracts names and paths from a string. It does not slow down or crash and is not dangerous.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex /^relationshipEngine\[([^\]]+)\](?:\.(.*))?$/ at line 44 is used to parse a structured path string. It contains no nested quantifiers, alternation, or overlapping groups that would cause catastrophic backtracking. The pattern is simple and safely bounded by literal anchors and character class negation. No ReDoS vulnerability is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-golden-evaluator.mjs:44

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This test file uses a programming technique to isolate and check internal parts of the extension's code. It does this by taking snippets of the extension's own source and running them in a controlled test environment. This is a standard testing practice and does not affect the safety of the extension for users.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This candidate matches a use of `new Function` inside a test file (file) that extracts source code from the project's own file to test internal functions. The function body is constructed from a controlled slice of the project source, not from user or external input. The test code is not loaded during normal extension execution; it only runs during development testing. There is no attacker-controlled data path, and the dynamic execution poses no risk to users.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:16322-16330

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner thought it found a secret key, but it's actually a test that checks that the extension properly hides secret information in error messages. The test intentionally includes fake secrets to make sure the hiding code works correctly.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The Gitleaks match on line 16893 of file corresponds to a test fixture that deliberately constructs an Error object containing placeholder secret tokens (e.g., [REDACTED_SECRET:b80965ff4cbf]) to verify that the formatSemanticDiagnostic function correctly redacts credential-like strings. The subsequent assertions confirm that the redacted output does not contain the original placeholder values. This is a defensive test of a security-sensitive redaction feature, not an actual credential exposure. No real API keys, bearer tokens, or secrets are present in the shipped or executable code.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
test-behavior.mjs:16893

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The code uses a regular expression to detect relationship-related phrases like 'start a romance'. This pattern is safe and does not have performance problems or security issues.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged regex at line 4928 is a simple alternation pattern with fixed word boundaries and no nested quantifiers or overlapping alternations that could cause catastrophic backtracking. JS-X-Ray's 'unsafe-regex' signal is a false positive in this context; the pattern is safe against ReDoS attacks and operates on user-provided chat text as expected for a relationship-detection function.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
deterministic-runner.js:4928

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This code uses a regular expression to fix formatting in text coming from the AI, changing single quotes to double quotes. The flagged pattern is a normal way to handle quotes and is not dangerous because the text being processed comes from the AI itself, not from a user who might try to cause problems.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged regex at line 1868 is used within the function `repairToolArgumentJson` to convert single-quoted strings to double-quoted strings, escaping internal double quotes. This function processes tool-call argument JSON produced by an LLM semantic ledger, not arbitrary user-controlled input. The regex pattern `/:\s*'([^'\\]*(?:\\.[^'\\]*)*)'/g` is a standard pattern for matching single-quoted strings with escape sequences. While static analysis flags it as potentially vulnerable to ReDoS, the input source (LLM output) is not attacker-controlled, and the regex does not exhibit catastrophic backtracking patterns with nested quantifiers on the same token; the quantifier `*` operates on alternates that are mutually exclusive. Therefore, there is no practical security risk.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:1868

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This test creates a temporary function from a part of the extension's code to check if settings migration works correctly. It's like taking a piece of the extension and running it in a testing sandbox. Since this only happens during testing and doesn't involve your data, it is not a security concern for users.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: This candidate matches a `new Function` call in file that constructs a function from source code extracted from index.js. The purpose is to test the settings migration logic of the extension. The source used is controlled and derived from the project's own code, and the test receives only static predefined arguments. There is no user-influence or external untrusted data involved. The test file is not executed during normal use of the extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:16278-16292

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This is a test that creates a temporary function to check that some layout code works correctly. It only runs during development, never when you use the extension, so it's harmless.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The call to new Function appears inside a test file (file) and constructs a function from a slice of the production source code solely for the purpose of unit testing the layout and display logic of the tracker widget. The function is never shipped or executed in the runtime extension. No untrusted input reaches this code; the source is read from the project's own file file, which is static at test time. There is no data exfiltration, hidden execution, or malicious intent.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:11200-11203

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This code is checking for sensitive info like passwords or API keys in error messages and replacing them with '[REDACTED]' so that private keys don't accidentally get shown to users or logged. The security scanner flagged this pattern as potentially dangerous, but actually it's a safety feature—it helps protect your credentials from leaking.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex flagged by JS-X-Ray as 'unsafe-regex' is used inside `sanitizeDiagnosticText` to redact credentials (API keys, authorization tokens, secrets) from diagnostic error messages before they are logged or displayed. The pattern is well-structured, does not exhibit catastrophic backtracking risks due to its limited alternatives and use of negated character classes, and its only purpose is to protect sensitive data from leaking in error output. The rule is a false positive in this context because the regex is a defensive security measure, not a vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:345

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This code uses a regular expression to parse error messages and extract details. The pattern is safe and does not cause performance issues, even with unexpected input.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 1780 (`/^(\$(?:\.[^\s.\[\]]+|\[\d+\])*)/`) is used to extract a JSON path from an error message. The pattern is well-structured with safe character classes and bounded nesting; it does not exhibit catastrophic backtracking. Input is limited to short error messages. The scanner's 'unsafe-regex' signal is a false positive for this use case.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:1783

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This regular expression checks error messages to see what data type was expected. It is simple and safe; it cannot be tricked into slowing down the system.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex on line 1783 (`/must be (?:an? |a )?(boolean|string|integer|array|object)/i`) matches a type description in error messages. It uses a simple optional group and a flat alternation of fixed words. No nested quantifiers or overlapping alternatives exist that could cause ReDoS. Input is bounded. The scanner alert is a false positive.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:1780

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This test creates a temporary function to verify that old widget settings can be updated. It only runs during development, not when you use the extension.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The new Function call is within the same test file and constructs a migration helper from a trusted slice of the production source. It is used to validate that tracker widget settings migration works correctly. No attacker-controlled input is involved, and the function is not shipped to users.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:11193-11199

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This code pattern simply checks for words related to short-lived injuries, like 'hit' or 'pain'. It comes pre-written and doesn't change based on user input. The warning is not actionable.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged regex at line 4488 is a static, hardcoded pattern used to identify transient injury language like 'hit', 'blow', 'pain'. It is not dynamically constructed from untrusted input. The pattern's structure is a flat alternation of fixed strings and simple optional groups without problematic nesting. No concrete ReDoS vulnerability is demonstrated. The regex operates on user-provided narrative strings within the extension's intended text-analysis role. The resource impact of any pathological input is limited to the user's own client.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:4488

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This code uses a regular expression to check if a line of text looks like a money amount (like '5 silver' or '$10'). The pattern is simple and does not have any security risk—it just matches common currency formats. The scanner warning is unnecessary.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regular expression at line 3689 is used to validate currency strings extracted from user persona text. It matches either a dollar sign followed by a digit, or a numeric amount followed by currency abbreviations (e.g., silver, credits, dollars). The pattern has no nested quantifiers or ambiguous alternations that could cause catastrophic backtracking. The input is a single trimmed line from the user's own persona data, which is not attacker-controlled in a cross-user context. The scanner alert for 'unsafe-regex' is a false positive; the regex is safe and performs a simple validation.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
index.js:3689

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This code uses regular expressions to help figure out a character's name from their description. The patterns are safe and won't cause slowdowns or crashes.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The three regex patterns at line 2309-2311 are used by getPersonaIdentityHints() to extract name-like fields from character persona text. Each regex uses bounded character classes with max length constraints and no nested quantifiers, making them resistant to catastrophic backtracking. The input is a local string from character card fields, not untrusted external input. The scanner's 'unsafe-regex' signal is a false positive; no ReDoS or other security vulnerability is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:2309

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This line checks for words related to medical treatment, like 'bandage' or 'stitch'. It's a fixed list of words built into the extension, not something that can be tricked. No danger.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The flagged regex at line 4500 is a static, hardcoded pattern used to detect treatment language like 'bandage', 'splint', 'stitch'. It is not dynamically assembled from user input. The pattern is a flat alternation with simple optional groups; it does not exhibit ReDoS-prone constructs. The signal from the static analyzer is a generic heuristic. The regex operates on narrative text within the extension's domain of semantic analysis. No evidence of exploitability or harm beyond trivial client-side slowdown exists.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
semantic-extractor.js:4500

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

This test creates a temporary function to check that the tracker widget stays on the screen. It only runs during development, never when you use the extension.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The new Function call is in the same test file and creates a function container for clamping math used in widget positioning. The source is a trusted slice of the production index.js. The function is only invoked during test assertions to verify correct coordinate calculation. No attacker input reaches this path, and the code is never present in the shipped extension.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
test-behavior.mjs:11182-11192

Related contextual observations

Multiple ReDoS-vulnerable regex patterns in height parsing

low risk · medium confidence

There are several complex patterns used to read height measurements. A specially written height could make the browser slow or freeze temporarily, but no personal data is at risk.

Technical assessment

The file file contains five regex patterns in the height parsing functions (parseMetricHeightCentimeters and parseImperialHeightInches) that are flagged as potentially vulnerable to catastrophic backtracking. All operate on user-supplied text from the character sheet appearance height field. While no data exfiltration or credential access is possible, a crafted input could cause client-side denial of service (browser freeze or slowdown).

Impact: low · Exploitability: plausible

Developer action: Review all regex patterns in the height parsing functions and refactor them to avoid nested optional quantifiers and overlapping alternations. Consider adding input length validation and a regex execution timeout as defense-in-depth.

Sources:

False positive unsafe-regex signal on safe pattern

low risk · high confidence

The scanner warning about an unsafe regular expression is not accurate for this particular pattern. The regex works correctly and doesn't have the dangerous structure that could cause slowdowns or crashes.

Technical assessment

JS-X-Ray flagged this regex as unsafe, but analysis of the actual pattern confirms it is a straightforward alternation with no quantifier nesting or overlapping that could cause exponential backtracking. The regex contains only simple word boundaries, a non-capturing group with three literals, optional word 'a', and another alternation. It is safe for use on any input.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Multiple regex patterns with potential backtracking in file

low risk · medium confidence

Several search patterns in this file could cause the browser to slow down if the AI writes a message with many partial matches. The patterns are used to clean up the AI's responses, but they are not perfectly safe from performance issues.

Technical assessment

In addition to line 67, the file contains many other regex patterns using `[\s\S]*?` (e.g., lines 56–80, 149, 161, 228–229, etc.) that could be vulnerable to catastrophic backtracking under crafted input. These are all used for legitimate sanitization of AI output, but collectively they increase the surface for a potential client-side DoS.

Impact: low · Exploitability: unlikely

Developer action: Review all regex patterns using `[\s\S]*?` and consider using alternatives like split/join or anchored patterns with possessive quantifiers. Benchmark with large inputs to ensure no catastrophic backtracking occurs.

Sources:

Test verifies secret redaction from diagnostics

low risk · high confidence

The extension includes a test to make sure that if something goes wrong, the error messages won't accidentally show your private API keys. The test uses fake keys to confirm the hiding mechanism works.

Technical assessment

The surrounding code in file (lines 16892-16900) tests that secrets embedded in error messages are redacted before being printed or exposed. The test constructs an error containing a bearer token, an API key, and a query parameter key, then asserts that none of the original values appear in the formatted diagnostic output. This demonstrates proactive security testing rather than an actual vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

JavaScript coverage

Unresolved JavaScript stages

Tools

Limitations

Technical scan identity