No material or immediate-danger item was identified.
Expected scanner matches (16)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that pulls a function out of the extension's own code and runs it in isolation with fake dependencies to verify it behaves correctly. The code being run is the project's own, not anything from outside.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute a function (applyMerged/mergeChainSummary) extracted by string-slicing the project's own shipped extension source, passing in stubbed dependencies. The dynamically executed code originates from the project's own source file, not from user input or external data. This is a standard pattern for isolating and testing extracted functions outside their normal runtime context.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:751-754
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that pulls a function out of the extension's own source code and runs it in a simulated environment to verify it works correctly. The code being executed comes from the project itself, not from anything a user or attacker could control. This is a normal and safe testing approach.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged dynamic execution is in a self-check test harness. The new Function constructor builds a wrapper around source text extracted from the project's own extension.js via readFileSync and regex matching. The extracted function body is the shipped adoptLegacyNamespace routine, invoked against a fake localStorage shim with controlled constant arguments. No user input, network data, or external content reaches the executed string. The pattern is a deliberate testing strategy to run the actual production code rather than a hand-maintained mirror, as explained in surrounding comments. There is no exfiltration, credential access, or persistence beyond the test scope.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:363
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a built-in test that extracts a function from the extension's own code and runs it with fake dependencies to check it behaves correctly. The code being executed is the extension's own source, not anything from the outside, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check file reads the extension's own bundled source and slices out the shipped doCommit function, then compiles it via new Function with stubbed dependencies to run isolated assertions. The evaluated string is a substring of the project's own source code, not user input, network data, or external content. No untrusted data reaches the constructor. This is a test-harness pattern for verifying shipped logic in isolation.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:1138-1142
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that runs the extension's own patch-guarding function with fake data sources to make sure it refuses to write when the server returns broken data. Only the project's own code is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute guardedPatch extracted from the project's own shipped source, with stubbed cachedMessages/confirmOverwrite/patchMessage dependencies. The body is a string slice of the extension's own code, not external or user-controlled input. This isolates the function for testing non-array re-read failure paths.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:950-953
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that extracts the extension's own summary-reporting function and checks it produces the right partial-failure message. No outside code is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute mergeChainSummary extracted by string-slicing the project's own shipped extension source. The dynamically constructed function body is a substring of the project's own code, not external or user-controlled input. This isolates the summary function for assertion testing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:820
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that pulls helper functions out of the extension's own code and checks them with made-up test data. Nothing from the user or the internet is executed, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check file extracts fingerprint helper functions from the extension's own source and compiles them via new Function to test them against crafted string inputs. The constructor body is a slice of the project's own shipped code. The arguments passed to the returned functions are hardcoded test strings. No external or user-controlled data flows into the dynamic execution path.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:1082-1083
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that pulls a piece of the extension's own code out of its source file and runs it to check that it still works correctly. It only runs code that is already in the project, not anything from outside.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The new Function call at line 116 executes a substring extracted from the project's own extension.js source file (read via readFileSync and sliced between two known markers). This is a drift-guard test harness that runs the shipped apiFetch header logic to assert correct Content-Type and CSRF behavior. No external or user-controlled input reaches the function body; the executed code is a verbatim slice of the project's own committed source. This is a Node.js test script, not browser-shipped code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:116
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that runs the extension's own write-guard function with fake message stores to verify it detects when another process changed a message before overwriting. Only the project's own code is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute guardedPatch extracted from the project's own shipped source, with stubbed dependencies for invalidateMsgCache, cachedMessages, confirmOverwrite, and patchMessage. The function body is a string slice of the extension's own code. This isolates the guard for testing concurrent-edit detection and cache-invalidation behavior.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:865-868
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that pulls the extension's own text-escaping function out of its source and checks that it prevents malicious prompt-injection text from breaking out of context fences. Only the project's own code is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute escFence extracted by string-slicing the project's own shipped extension source. The function body is a substring of the extension's own code, not external or user-controlled input. This isolates the fence-escaping helper to verify it neutralizes injected closing tags from untrusted character-card and lorebook content.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:652
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a self-test that takes pieces of the extension's own code and runs them with fixed test data to make sure bad data does not crash the extension. No outside or user-controlled input is involved, and nothing is sent anywhere.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: This candidate is a new Function call inside a self-check file that reads the extension's own source text and executes extracted slices in an isolated function scope to validate that malformed legacy profile data does not throw. The argument passed to the generated function is a hardcoded test string, not user-controlled input. No network calls, credential access, or persistence occur. The dynamic execution is confined to a test harness validating the extension's own code logic.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:519-524
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test extracts the text-alignment functions from the extension's own source file and runs them to verify they produce correct results. It only uses code already in the project, with no outside input.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The new Function call at lines 174-178 constructs a test harness by concatenating two slices of the project's own extension.js source (the span-alignment functions) with a return statement, then invokes it to run alignment assertions. The function body is derived entirely from the project's committed source file read from disk. No external, network, or user-supplied data influences the executed string. This is a standard pattern for testing shipped functions by extracting and executing them in a Node.js test script.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:174-178
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that extracts the extension's own prompt-budget function and checks it correctly drops lower-priority context when the total is too large. Only the project's own code is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute trimContextToBudget and PROMPT_BUDGET extracted by string-slicing the project's own shipped extension source. The function body is a substring of the extension's own code, not external or user-controlled input. This isolates the budget-trimming logic for assertion testing against oversized context assemblies.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:687-690
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that takes a function from the extension's own code, gives it fake on-screen elements, and checks that its Apply button works correctly. The code being run is the extension's own, not anything from outside, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check file extracts the shipped reviewThenPatch function from the extension's own source and compiles it via new Function with stubbed DOM builders and mock dependencies, then simulates clicking its Apply handler. The evaluated string is a substring of the project's own source code. All inputs are hardcoded test fixtures. No untrusted data reaches the constructor.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:1036-1039
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that runs the extension's own write-guard function with a simulated server failure to confirm it refuses to overwrite when it cannot verify the current message state. Only the project's own code is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute guardedPatch extracted from the project's own shipped source, with stubbed dependencies that simulate a failed re-read (Promise.reject). The function body is a string slice of the extension's own code. This verifies the guard rejects rather than writing blind when the re-check fails.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:928-931
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test that extracts the extension's own undo and redo functions and checks they correctly go through the write guard and handle user declines. Only the project's own code is executed.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: A self-check test harness uses new Function to execute doUndo and doRedo extracted by string-slicing the project's own shipped extension source, with stubbed guardedPatch, history, and UI helpers. The function body is a substring of the extension's own code, not external or user-controlled input. This isolates the undo/redo logic for assertion testing against the guard's accept and decline paths.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:971-974
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
Detailed wording was omitted by the public report safety filter.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- selfcheck.mjs:548-556