TavernKeeper Scan Report

Kenhito/Marinara-RPG-Extension

Commit 39160a6 Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 22 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

The code evaluates a math formula using a method that can run arbitrary code, but it strictly filters the input to only allow numbers and basic math symbols, making it safe from hacking. However, it might not work on web pages with strict security settings.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The code uses `new Function` to evaluate a formula string. The input is sanitized by a regex `/^[\s0-9+\-*/().]+$/` which only permits digits, whitespace, arithmetic operators, parentheses, and decimal points. This prevents arbitrary code execution. However, using `new Function` may fail in environments with strict Content Security Policy (CSP) that blocks 'unsafe-eval', as noted in the project's own README for a different evaluator.

Impact: low · Exploitability: unlikely

Developer action: Replace `new Function` with a recursive descent parser or a safe math expression evaluator to ensure compatibility with strict Content Security Policy (CSP) environments, consistent with the approach used in the project's other formula evaluator.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:9872

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Minor caution · high confidence

The code builds a small math expression from a user-imported ruleset and runs it. It first checks that the expression contains only numbers and basic math symbols, which stops anyone from sneaking in real code. The main drawback is that this approach can break on systems with strict security settings, and the project already uses a safer method for other similar calculations.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The candidate uses new Function to evaluate a crit/fumble formula string sourced from an imported ruleset bundle. Before execution, the substituted string is validated against a whitelist regex that permits only digits, arithmetic operators, parentheses, and whitespace. This character-class restriction prevents JavaScript identifier or statement injection, so arbitrary code execution is not achievable through this path. The residual weakness is the use of new Function itself, which is blocked under strict Content Security Policy and is inconsistent with the project's stated move to a recursive-descent evaluator for similar formulas elsewhere.

Impact: low · Exploitability: unlikely

Developer action: Replace the new Function evaluator with the same recursive-descent arithmetic parser already used for skillBonusFormula, eliminating the CSP-unsafe eval path and keeping behavior consistent across the extension.

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
extension/RPG-Extension-GM-Mode.js:10119
Expected scanner matches (13)

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner thought it found a secret password or API key, but it actually found a label the extension uses to remember where a window was dragged on screen. This is normal app behavior and not a security issue.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal identifying client-side UI state, not a credential, API key, or secret. The gitleaks generic-api-key pattern produced a false positive on the key-like string format. No credential is present and no sensitive data is exposed.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
extension/RPG-Extension-GM-Mode.js:1786

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner mistook a setting name used to remember where a panel sits on screen for a secret password or API key. It is just a label for saving window position, not a real credential.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line contains a localStorage storage key name used to persist the screen position of a UI flyout panel. It is a positional preference string, not an API key, token, or credential. The generic-api-key rule produced a false positive on a key-value-like string. No credential is present, transmitted, or used.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
extension/RPG-Extension-GM-Mode.js:7120

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner thought it found a secret password or API key, but the text is just a label the extension uses to remember where a pop-up window was last moved on screen. It is not a credential and cannot be used to access anything.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged string is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded identifier passed to a panel-creation helper, not a credential, API key, or secret. No network destination, authentication value, or sensitive data flow is involved. The gitleaks generic-api-key rule produced a false positive on this UI-state key.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:2213

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is just a label the extension uses to remember where a popup window was last moved on screen. It is not a password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal with no credential value, no network destination, and no secret material. The gitleaks generic-api-key rule produced a false positive on the string format.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:2059

Gitleaks reported generic-api-key

Expected behavior · high confidence

The flagged text is just a label the extension uses to remember where a popup window was placed on screen. It is not a password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The gitleaks generic-api-key rule matched the string value on line 8166, which is a localStorage storage key identifier used to persist the position of a UI panel. It is not a credential, token, or secret. No credential exposure or sensitive data flow is present.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:8166

OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval

Expected behavior · high confidence

The code uses a dynamic evaluation feature to calculate RPG dice crit/fumble thresholds from user-authored ruleset formulas. Before running anything, it checks that the formula contains only numbers and basic math symbols, blocking any attempt to sneak in code. This is a normal pattern for a tabletop RPG rules engine and does not pose a security risk.

Technical evidence

Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.

Contextual assessment: The flagged `new Function` is inside `evalRollUnderFormula`, which evaluates user-supplied crit/fumble threshold formulas from ruleset bundles. Before execution, the substituted string is validated against a strict whitelist regex `^[\s0-9+\-*/().]+$` that permits only digits, whitespace, arithmetic operators, and parentheses. No letters, identifiers, quotes, semicolons, or other JavaScript syntax can pass the gate, so arbitrary code execution via the formula string is not achievable. The function also wraps the call in try/catch and rejects non-numeric results. This is a constrained arithmetic evaluator matching the project's stated purpose of computing RPG roll thresholds.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
opengrep 1.26.0
Rule
tavernkeeper.dynamic-execution.javascript-eval
File role
production
Source
releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:10119

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner flagged what looks like a key, but it is just a label the extension uses to remember where a pop-up items window was last moved on screen. It is not a password or secret of any kind.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The gitleaks generic-api-key rule matched the string value on line 7919, which is a UI panel configuration property. The matched value is a localStorage key name used to persist the draggable position of an items flyout panel. It contains no credential material, secret tokens, or authentication data. It is a benign identifier for client-side UI state persistence, consistent with the extension's stated purpose of rendering resizable, draggable character sheets and panels.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:7919

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner saw a string that looks like it could be a key, but it is just a label the extension uses to remember where a popup window was moved on screen. It is not a password or API key and is not sent anywhere.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line assigns a localStorage key name used to persist the screen position of a UI flyout panel. The matched value is a descriptive identifier for client-side UI state, not a credential, token, or secret. No credential is present in the surrounding code, and the value is never transmitted to any network destination or used for authentication.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
extension/RPG-Extension-GM-Mode.js:2213

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner saw a string that looks like it could be an API key by pattern, but it is actually just a label the extension uses to remember where a popup window was dragged on screen.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal naming a client-side storage slot, not a credential, token, or secret. No network destination, authentication context, or sensitive data flow is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:7919

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is just a label the extension uses to remember where a popup window was last moved on screen. It is not a password or secret key of any kind.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line contains a UI panel position persistence key used by a localStorage-style storage mechanism to remember where the item bag flyout panel was last positioned. It is a descriptive identifier for local client-side UI state, not a credential, token, or secret. The generic-api-key rule produced a false positive on a string literal that merely contains the word 'key'.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:8166

Gitleaks reported generic-api-key

Expected behavior · high confidence

This is just a label the extension uses to remember where a popup window was dragged on screen. It is not a password or API key.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line is a localStorage storage key name used to persist the draggable panel position for the items flyout. It is a hardcoded UI state key, not a credential, token, or secret. The gitleaks generic-api-key rule matched on the hyphenated alphanumeric string format, producing a false positive. No credential is present and no network or authentication use occurs.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
extension/RPG-Extension-GM-Mode.js:8166

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner saw a string that looks like it could be an API key, but it is actually just a label the extension uses to remember where a popup window was last moved on screen. There is no password or secret here.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged line is a localStorage key name used to persist the screen position of a UI flyout panel. It is a static string literal assigned to a storageKey property, not a credential value, API key, or secret. The gitleaks generic-api-key pattern matched on the hyphenated alphanumeric key name, producing a false positive. No credential is present, exfiltrated, or transmitted.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:2059

Gitleaks reported generic-api-key

Expected behavior · high confidence

The scanner saw a string that looks like it could be a key and flagged it. It is actually just a label the extension uses to remember where a popup window was last moved on screen. It is not a password or secret.

Technical evidence

Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.

Contextual assessment: The flagged value is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal naming a client-side storage slot, not a credential, API key, or secret. No network destination, authentication context, or sensitive data flow is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
gitleaks 8.30.1
Rule
generic-api-key
File role
production
Source
releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:2213

Related contextual observations

LocalStorage key name false-positives on generic-api-key pattern

low risk · high confidence

The extension uses named labels to save window positions locally. These labels can look like API keys to automated scanners but contain no secrets.

Technical assessment

The storageKey string is one of several panel-position persistence keys used by the extension's draggable UI panels. These are static identifiers with no sensitive payload. Similar hyphenated key names elsewhere in the file may also trigger generic credential scanners.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Panel position storage key misidentified as credential

low risk · high confidence

A label for remembering window position was mistaken for a secret key. No security issue.

Technical assessment

The matched string is a localStorage key for persisting UI panel coordinates. It contains no secret material and is not transmitted anywhere.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Panel position storage key false positive

low risk · high confidence

The scanner mistook a window-position label for a secret. It is harmless.

Technical assessment

The matched value is a localStorage key for persisting UI panel position. It contains no secret material and is not used for authentication or remote access.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

UI panel position storage key misidentified as credential

low risk · high confidence

The scanner mistook a window-position label for a secret. There is no security issue here.

Technical assessment

The storageKey property is assigned a constant string used as a localStorage identifier for persisting panel coordinates. No secret is present and no credential is exposed.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Panel position persisted under a named localStorage key

low risk · high confidence

The extension saves the last on-screen position of a window so it reopens in the same spot. The label used for that save is what the scanner mistook for a secret.

Technical assessment

The panel-creation call passes a storageKey property whose value is a fixed string identifying where to save and restore the panel's position. This is a standard pattern for draggable UI panels and does not involve credentials or external communication.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Formula evaluator uses new Function instead of a parser

low risk · high confidence

The project already replaced a similar calculator elsewhere with a safer method. This one still uses a technique that some browsers' security settings may block, though the current input checks keep it safe.

Technical assessment

The README notes the project migrated the main skill-bonus formula evaluator to recursive descent for CSP safety, but this roll-under crit/failure evaluator still relies on `new Function` with a regex whitelist. While the whitelist is effective, a recursive-descent or `Function`-free arithmetic parser would be more robust against future regex mistakes and would work under strict CSP environments that block `unsafe-eval`.

Impact: low · Exploitability: unlikely

Developer action: Consider replacing this `new Function` call with the same recursive-descent parser approach already used for skill-bonus formulas, for consistency and CSP compatibility.

Sources:

Panel position persistence key misidentified as credential

low risk · high confidence

The extension saves where you moved a popup window so it reopens in the same spot. The scanner mistook the save label for a secret key.

Technical assessment

The storageKey value is passed to a panel creation helper to persist draggable panel coordinates in localStorage. This is consistent with the project purpose of rendering resizable, draggable character sheet and flyout panels. No network call, credential, or secret is involved.

Impact: none · Exploitability: unlikely

Developer action: none

Sources:

Coverage and limitations

Tools

Limitations

Technical scan identity