This is part of the project's test suite. The code pulls a section of the project's own source file and runs it in a controlled way to test internal functions that aren't normally accessible. All the data fed in is fake test data created by the developer. There is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file (`file`). It reads a slice of the project's own `index.js` source via `fs.readFileSync`, then executes that slice to extract three internal helper functions for unit testing. All arguments passed to the constructed function are hardcoded test mocks (e.g., profile lists, route objects, format constants). No external or untrusted input reaches the dynamic execution path. This is a standard testing technique for exercising non-exported functions.
The code is part of a test suite that copies a piece of the project's own source code and runs it in a small isolated function to check that the layout math works correctly. No outside or user-controlled data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is in a test file (file) that reads the project's own committed index.js source from disk, extracts a known function region via string slicing, and wraps it in a new Function constructor to verify layout-clamping math in isolation. The executed code originates entirely from the project's own source tree; no user input, network data, or external content reaches the Function constructor. This is a testing pattern, not a runtime code-execution path.
This is part of the project's test suite. The code takes a piece of the project's own settings-handling logic and runs it with fake test data to verify that old settings are properly cleaned up. No real user data or outside input is involved. There is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate is a `new Function` call inside a test file (`file`). It reads a slice of the project's own `index.js` source (the `getSettings` function body) and executes it to test settings migration behavior. All arguments are hardcoded test fixtures, including a mock `retiredSettingsStore` and stub functions. No external or untrusted input flows into the dynamically constructed function. This pattern is used to unit-test internal non-exported logic.
The test file takes a formatting function from the project's own code and runs it in isolation to verify its behavior. No outside data is used.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is in a test file that extracts the formatTrackerItemDisplayName function body from the project's own committed index.js via string slicing and wraps it in a new Function to test it with a controlled callback. The only argument passed is a hardcoded arrow function. No untrusted or external input flows into the Function constructor. This is a test-only code isolation pattern.
The test file copies a settings-migration function from the project's own code and runs it in isolation to check that it handles various inputs correctly. No outside data is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is in a test file that extracts the migrateTrackerWidgetSettings function body from the project's own committed index.js via string slicing and wraps it in a new Function to test settings migration logic with controlled fixture objects. The executed code originates entirely from the project's own source; no user input, network data, or external content reaches the Function constructor.