No material or immediate-danger item was identified.
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Minor caution · high confidence
The code evaluates a math formula using a method that can run arbitrary code, but it strictly filters the input to only allow numbers and basic math symbols, making it safe from hacking. However, it might not work on web pages with strict security settings.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The code uses `new Function` to evaluate a formula string. The input is sanitized by a regex `/^[\s0-9+\-*/().]+$/` which only permits digits, whitespace, arithmetic operators, parentheses, and decimal points. This prevents arbitrary code execution. However, using `new Function` may fail in environments with strict Content Security Policy (CSP) that blocks 'unsafe-eval', as noted in the project's own README for a different evaluator.
Impact: low · Exploitability: unlikely
Developer action: Replace `new Function` with a recursive descent parser or a safe math expression evaluator to ensure compatibility with strict Content Security Policy (CSP) environments, consistent with the approach used in the project's other formula evaluator.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:9872
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Minor caution · high confidence
The code builds a small math expression from a user-imported ruleset and runs it. It first checks that the expression contains only numbers and basic math symbols, which stops anyone from sneaking in real code. The main drawback is that this approach can break on systems with strict security settings, and the project already uses a safer method for other similar calculations.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate uses new Function to evaluate a crit/fumble formula string sourced from an imported ruleset bundle. Before execution, the substituted string is validated against a whitelist regex that permits only digits, arithmetic operators, parentheses, and whitespace. This character-class restriction prevents JavaScript identifier or statement injection, so arbitrary code execution is not achievable through this path. The residual weakness is the use of new Function itself, which is blocked under strict Content Security Policy and is inconsistent with the project's stated move to a recursive-descent evaluator for similar formulas elsewhere.
Impact: low · Exploitability: unlikely
Developer action: Replace the new Function evaluator with the same recursive-descent arithmetic parser already used for skillBonusFormula, eliminating the CSP-unsafe eval path and keeping behavior consistent across the extension.
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- extension/RPG-Extension-GM-Mode.js:10119
Expected scanner matches (13)
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner thought it found a secret password or API key, but it actually found a label the extension uses to remember where a window was dragged on screen. This is normal app behavior and not a security issue.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal identifying client-side UI state, not a credential, API key, or secret. The gitleaks generic-api-key pattern produced a false positive on the key-like string format. No credential is present and no sensitive data is exposed.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- extension/RPG-Extension-GM-Mode.js:1786
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner mistook a setting name used to remember where a panel sits on screen for a secret password or API key. It is just a label for saving window position, not a real credential.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line contains a localStorage storage key name used to persist the screen position of a UI flyout panel. It is a positional preference string, not an API key, token, or credential. The generic-api-key rule produced a false positive on a key-value-like string. No credential is present, transmitted, or used.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- extension/RPG-Extension-GM-Mode.js:7120
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner thought it found a secret password or API key, but the text is just a label the extension uses to remember where a pop-up window was last moved on screen. It is not a credential and cannot be used to access anything.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged string is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded identifier passed to a panel-creation helper, not a credential, API key, or secret. No network destination, authentication value, or sensitive data flow is involved. The gitleaks generic-api-key rule produced a false positive on this UI-state key.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:2213
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a label the extension uses to remember where a popup window was last moved on screen. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal with no credential value, no network destination, and no secret material. The gitleaks generic-api-key rule produced a false positive on the string format.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:2059
Gitleaks reported generic-api-key
Expected behavior · high confidence
The flagged text is just a label the extension uses to remember where a popup window was placed on screen. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched the string value on line 8166, which is a localStorage storage key identifier used to persist the position of a UI panel. It is not a credential, token, or secret. No credential exposure or sensitive data flow is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:8166
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The code uses a dynamic evaluation feature to calculate RPG dice crit/fumble thresholds from user-authored ruleset formulas. Before running anything, it checks that the formula contains only numbers and basic math symbols, blocking any attempt to sneak in code. This is a normal pattern for a tabletop RPG rules engine and does not pose a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged `new Function` is inside `evalRollUnderFormula`, which evaluates user-supplied crit/fumble threshold formulas from ruleset bundles. Before execution, the substituted string is validated against a strict whitelist regex `^[\s0-9+\-*/().]+$` that permits only digits, whitespace, arithmetic operators, and parentheses. No letters, identifiers, quotes, semicolons, or other JavaScript syntax can pass the gate, so arbitrary code execution via the formula string is not achievable. The function also wraps the call in try/catch and rejects non-numeric results. This is a constrained arithmetic evaluator matching the project's stated purpose of computing RPG roll thresholds.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:10119
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner flagged what looks like a key, but it is just a label the extension uses to remember where a pop-up items window was last moved on screen. It is not a password or secret of any kind.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The gitleaks generic-api-key rule matched the string value on line 7919, which is a UI panel configuration property. The matched value is a localStorage key name used to persist the draggable position of an items flyout panel. It contains no credential material, secret tokens, or authentication data. It is a benign identifier for client-side UI state persistence, consistent with the extension's stated purpose of rendering resizable, draggable character sheets and panels.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:7919
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner saw a string that looks like it could be a key, but it is just a label the extension uses to remember where a popup window was moved on screen. It is not a password or API key and is not sent anywhere.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line assigns a localStorage key name used to persist the screen position of a UI flyout panel. The matched value is a descriptive identifier for client-side UI state, not a credential, token, or secret. No credential is present in the surrounding code, and the value is never transmitted to any network destination or used for authentication.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- extension/RPG-Extension-GM-Mode.js:2213
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner saw a string that looks like it could be an API key by pattern, but it is actually just a label the extension uses to remember where a popup window was dragged on screen.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal naming a client-side storage slot, not a credential, token, or secret. No network destination, authentication context, or sensitive data flow is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:7919
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a label the extension uses to remember where a popup window was last moved on screen. It is not a password or secret key of any kind.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line contains a UI panel position persistence key used by a localStorage-style storage mechanism to remember where the item bag flyout panel was last positioned. It is a descriptive identifier for local client-side UI state, not a credential, token, or secret. The generic-api-key rule produced a false positive on a string literal that merely contains the word 'key'.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:8166
Gitleaks reported generic-api-key
Expected behavior · high confidence
This is just a label the extension uses to remember where a popup window was dragged on screen. It is not a password or API key.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a localStorage storage key name used to persist the draggable panel position for the items flyout. It is a hardcoded UI state key, not a credential, token, or secret. The gitleaks generic-api-key rule matched on the hyphenated alphanumeric string format, producing a false positive. No credential is present and no network or authentication use occurs.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- extension/RPG-Extension-GM-Mode.js:8166
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner saw a string that looks like it could be an API key, but it is actually just a label the extension uses to remember where a popup window was last moved on screen. There is no password or secret here.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged line is a localStorage key name used to persist the screen position of a UI flyout panel. It is a static string literal assigned to a storageKey property, not a credential value, API key, or secret. The gitleaks generic-api-key pattern matched on the hyphenated alphanumeric key name, producing a false positive. No credential is present, exfiltrated, or transmitted.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.4.2/install-files/RPG-Extension-GM-Mode.js:2059
Gitleaks reported generic-api-key
Expected behavior · high confidence
The scanner saw a string that looks like it could be a key and flagged it. It is actually just a label the extension uses to remember where a popup window was last moved on screen. It is not a password or secret.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule generic-api-key in this repository.
Contextual assessment: The flagged value is a localStorage key name used to persist the screen position of a draggable UI panel. It is a hardcoded string literal naming a client-side storage slot, not a credential, API key, or secret. No network destination, authentication context, or sensitive data flow is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- gitleaks 8.30.1
- Rule
- generic-api-key
- File role
- production
- Source
- releases/v0.5.0/install-files/RPG-Extension-GM-Mode.js:2213