No material or immediate-danger item was identified.
Expected scanner matches (18)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test file loads a project JavaScript file by reading it from disk and running it, which is a common way to test browser scripts in Node. The file path is fixed and internal to the project, so no outside input is involved.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a hardcoded relative path within the repository and executes it to load the frontend script into the test's global scope. No attacker-controlled data reaches the eval; the input is a static local file path. This is a typical hobbyist test harness pattern for loading non-modular browser JS in Node.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-edit-message.js:101
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file loading another file from the project itself so it can test it. It only reads a file that is already part of the project, not anything supplied by a user or the internet, so there is no security danger here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a JavaScript module from a fixed relative path inside the repository and executes it to load the module under test in a Node test harness. The path is built from __dirname and static relative segments with no external or user-controlled input. This is a common hobbyist pattern for loading a browser-oriented module into a mocked DOM environment when no bundler is present. No untrusted data reaches the eval, and execution is confined to the local test file.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-scroll-manager.js:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is part of a test script that loads the project's own code so it can be tested. It only uses files already inside the project and does not accept outside input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs inside a frontend test file. It reads a local source file from the repository's own static assets and evaluates it in the test's global scope to expose bare functions for unit testing. No external or attacker-controlled input reaches the eval; the evaluated string is a fixed local file plus a constant assignment. This is a common hobbyist test-harness pattern and poses no runtime risk to users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-status-panel.js:72
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that loads one of the project's own files to test it. It does not run in the actual app and does not accept any outside input, so it cannot be abused.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call is inside a unit test file and reads a project-local source file via a path constructed from __dirname and fixed relative segments. No external or attacker-controlled input reaches the eval. This is a common hobbyist pattern for loading a browser-oriented module into a Node test environment. It is not reachable at runtime in the shipped frontend and poses no security risk to users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-state-manager.js:28
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files to test it. It only reads files already inside the project folder and does not take input from users or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local repository source file via a path constructed from __dirname and fixed relative segments, then executes it in the test process. This is a common hobbyist pattern for loading browser-oriented scripts that lack module exports into a Node test harness. No external, user-controlled, or network-derived input reaches the eval. The file is a committed test, not shipped runtime code, and no credentials, persistence, or network destinations are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-list-manager.js:24
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code is inside a test file. It loads one of the project's own JavaScript files into the test environment so the tests can call its functions. It does not process any outside or user-supplied data, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call operates exclusively on a local source file read from the repository's own static/js/ui/lightbox.js, concatenated with a fixed string that assigns existing function declarations to the global window object. No external or user-controlled input reaches the eval. This is a test-harness technique to load a non-module source file into the test environment so its functions can be exercised. The data flow is entirely local and developer-controlled.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-lightbox.js:78
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It uses a built-in command to run that local file's code. Because the file is a fixed part of the project and not something an attacker can influence, this is normal for a test setup and not a security problem.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a fixed local file from the repository's own static directory at test time and executes it to load the module under test into the test scope. The path is constructed from __dirname and constant segments, not from user input, network data, or configuration. This is a test-only harness pattern for loading a non-module browser script into a Node test environment. No attacker-controlled data reaches the eval argument, and the code does not run in production.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-extract-data.js:23
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own code from disk so it can be tested. It only reads files that are already part of the project, and no outside input controls what gets run. This is normal for tests and not a security issue.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local, repository-relative source file via fs.readFileSync and evaluates it to load the module under test into the Node test harness. The path is hardcoded and constructed from __dirname with no external or attacker-controlled input. This is a common hobbyist test-loading pattern and executes only committed project source during tests.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-message-renderer.js:46
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. The code being loaded is a fixed local file from the project itself, not anything from the internet or from user input. Using eval this way in tests is a common shortcut for hobbyist projects and does not create a security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local project source file from a fixed relative path within the repository and executes it to load a browser-oriented IIFE module into the Node.js test environment. The input to eval is not attacker-controlled, not network-sourced, and not user-supplied; it is a static local file path constructed from __dirname. This is a test-only harness pattern for loading modules that attach to a global window object. No untrusted data flow reaches the eval.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-message-pruner.js:84
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own source files to run unit tests against it. The code being executed comes from a fixed location inside the repository, not from anything a user or attacker can control. This is a normal, if informal, testing approach.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a file via fs.readFileSync using a path built solely from __dirname and hardcoded relative path segments pointing to a source file inside the repository. No external or user-controlled data reaches the eval. This is a test harness pattern to load a browser-oriented module into a Node environment with DOM mocks so its registered functions can be exercised. The capability matches the stated test file role and project purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-reasoning-visibility.js:24
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that loads one of the project's own JavaScript files so the tests can check it. It only reads files already inside the project folder and does not contact the internet or handle any secrets, so it is not a security problem.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched eval call occurs in a unit test file. It reads a local, repository-relative source file using a path built from __dirname and fixed string segments, then evaluates it to load browser-oriented code into the Node test context. No external or user-controlled input reaches the evaluated content, there is no network destination, no credential access, and no persistence. This is a common hobbyist test-loading pattern and poses no runtime risk to users of the project.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-api-paths.js:7
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test file loads one of the project's own JavaScript files and runs it inside the test environment. It only uses code that is already part of the project, not anything supplied by users or the network, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval executes source read from a local repository file via fs.readFileSync using a path constructed from __dirname. No external or user-controlled input reaches the evaluated string. This is a test-harness technique to load frontend source into a Node test context without a module loader. The evaluated content is committed project source, not attacker-influenced data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-notifications.js:58
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own code to test it. The code being loaded comes from the project itself, not from any external or user-controlled source, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call operates on a local repository source file read from disk within the test directory. The input is not attacker-controlled or network-sourced; it is the project's own theme-manager module being loaded into the test harness to expose internal functions for unit testing. This is a common hobbyist test pattern and poses no runtime security risk.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-theme-manager.js:83
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so the tests can run it. The file path is hardcoded and points only to code inside the project, so there is no way for outside input to sneak anything in. It is a common hobbyist testing approach and poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a JavaScript file from a fixed relative path inside the project repository and executes it to load a browser-oriented module into the Node test environment. The path is built from __dirname and static relative segments with no external or user-controlled input. This is a test-only harness pattern for exercising frontend code outside a browser. No network, credential, persistence, or obfuscation behavior is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-delete-mode.js:74
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files to run unit tests against it. The code being loaded is a local file from the repository itself, not anything from the internet or from user input, so there is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched eval reads a local project source file via a relative path constructed from __dirname and executes it in the test process. This is a common hobbyist pattern for loading a browser-oriented IIFE module into a Node.js test harness. The file path is fixed and points to the project's own committed JavaScript; no external, user-controlled, or network-derived input reaches the eval. The file role is a unit test and the capability matches the stated test purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-file-staging.js:83
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code is part of a test file. It loads another file from the project itself so the tests can run against it. It does not run anything from the internet or from user input, and it only executes when the developer runs the tests.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a unit test file. It reads a local, repository-relative JavaScript module from disk and evaluates it to load the module under test in a Node-based test harness that mocks browser globals. The path is constructed from the test directory and fixed relative segments with no external or user-controlled input. This is a common hobbyist test-loading pattern and does not introduce runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-backup-manager.js:35
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It reads a local file from the project folder and runs it, which is a normal (if old-fashioned) way to test code that was written for the browser. There is no external or user-controlled input involved, and nothing is sent anywhere.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local, committed project source file via fs.readFileSync and evaluates it to load the module under test. The path is constructed from __dirname and fixed relative segments with no user-controlled or external input. This is a test-file pattern for loading a browser-oriented script that is not packaged as a Node module. No network destination, no credential access, no persistence, and no obfuscation are present. The capability is proportionate to the stated test purpose.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-edit-entity.js:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that loads the project's own code file so it can check that the code's functions exist and work correctly. It only uses files already in the repository, not anything from users or the internet, so it is not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs in a test file that reads a local repository source file via fs.readFileSync and evaluates it to expose module functions onto the global object for unit testing. The evaluated content is a committed local source file, not user-controlled or network-derived input. This is a common hobbyist test harness pattern and poses no runtime security risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-char-editor.js:69