No material or immediate-danger item was identified.
Expected scanner matches (18)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It only reads a fixed local file from the repository and does not accept outside input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local, repository-relative static JavaScript file into the Node test environment. This is a common hobbyist pattern for loading browser-oriented scripts that rely on global window/document shims without a module system. The path is hardcoded and not attacker-controlled, the file role is test, and no network or credential data flow is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-edit-message.js:101
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It only reads files already inside the project and does not contact the internet or handle secrets. This is a normal, if unconventional, way to test browser code outside a browser.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a project-local JavaScript file from the repository's own static assets directory and evaluates it to load the module under test within a Node test harness. The path is constructed from __dirname and fixed relative segments, with no external or user-controlled input. This is a test-only mechanism for importing a browser-oriented module into a mocked DOM environment. No network access, credential handling, persistence, or obfuscation is involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-scroll-manager.js:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own code to test it. It only reads files already in the repository and does not accept outside input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs inside a test file that reads a local source file from the same repository and evaluates it to expose functions for unit testing. The input is a trusted local file path constructed from the test directory, not user-controlled or network-sourced data. This is a common hobbyist test harness pattern and poses no runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-status-panel.js:72
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test file loads one of the project's own JavaScript files so it can test it. It only reads files already in the repository, not anything from users or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a committed local source file via a relative repository path and executes it to load a browser-oriented module into the test scope. No untrusted or remote input reaches the eval argument; the content is a first-party file under version control. This is a common hobbyist test harness pattern for loading scripts that lack module exports.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-state-manager.js:28
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own JavaScript code into the test environment so it can be tested. It only reads files that are already part of the project, not anything from users or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a source file from a fixed relative path within the repository itself and executes it to load the module under test in a Node-based test harness that mocks browser globals. No external or attacker-controlled data reaches the eval; the path is constructed from __dirname and static repository-relative components. This is a common hobbyist pattern for loading browser-oriented modules in Node tests.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-list-manager.js:24
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code is inside a test file. It reads another file that ships with the project and runs it in a test environment so the tests can call its functions. No outside or user-controlled data is involved, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call operates on source read from a local, repository-bundled file via fs.readFileSync using a path relative to __dirname. No external, user-controlled, or network-derived input reaches the eval argument. This is a test-harness pattern to load a non-module source file and expose its functions for unit testing. There is no runtime reachability for an attacker to influence the evaluated string.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-lightbox.js:78
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads a local source file to test it. The content being executed comes from a file already in the project, not from any user or network input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local, repository-bundled source file via a path constructed from __dirname and fixed relative components, then executes it to load the module under test. No external or attacker-controlled input reaches the eval argument. This is a test-file convenience for loading a browser-oriented module that is not packaged as a Node module. The data flow is entirely local and developer-controlled.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-extract-data.js:23
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads another file from the same project so it can run tests on it. It only reads files already in the repository and does not touch anything external or user-controlled. This is normal for test code.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a test file and reads a local source file from the same repository to load the module under test into the test harness. The file path is constructed from the test directory and a fixed relative path within the project. No external or attacker-controlled input reaches the eval. This is a common hobbyist pattern for loading browser-oriented modules that are not packaged as require-able CommonJS modules. There is no network access, credential handling, persistence, or obfuscation involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-message-renderer.js:46
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It only reads a file that is already part of the project, not anything from users or the internet, and it only runs during testing.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local, committed project source file via fs.readFileSync and evaluates it so the test harness can load an IIFE module that attaches exports to the global window object. The input is a fixed relative path within the repository, not user-controlled or network-sourced data. This is a test-only mechanism with no runtime reachability in the shipped frontend.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-message-pruner.js:84
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code is part of a test file. It loads one of the project's own source files so the tests can run against it. It does not use any external or user-controlled data, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a unit test file. It reads a local, repository-relative source file using a path built from __dirname and static path.join components, then evaluates it so the module under test can register functions on a mocked global window object. No untrusted or remote input reaches the eval argument; the file content is committed project source. This is a common hobbyist test-loading pattern and poses no runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-reasoning-visibility.js:24
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own source files to check that its URL-building functions work correctly. The code being loaded is a local file from the same project, not anything from the internet or from user input. Using eval here is just a simple way to get the code into the test environment.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a unit test file. It reads a local, committed source file from the same repository using a relative path and evaluates it so the test can assert on the route-builder functions defined in that file. No network data, user input, or external content reaches the eval. The file path is hardcoded and points to a sibling source file within the project. This is a common hobbyist pattern for loading browser-oriented JS modules that lack Node module exports into a test scope.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-api-paths.js:7
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own notification code so it can be tested. The code being run comes from a fixed file inside the project, not from anything a user or attacker can control. This is normal for a test setup.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call executes source code read from a local project file (static/js/ui/notifications.js) within a test harness. The test file constructs mock DOM elements, deterministic timers, and stubs before evaluating the module under test. No external or user-controlled input reaches the eval argument; the path is hardcoded relative to the test directory. This is a common hobbyist pattern for loading browser-oriented modules into a Node test context without a module bundler.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-notifications.js:58
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code is part of a test. It loads one of the project's own source files into the test runner so the tests can check individual functions. It does not use any outside or user-provided input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a test file. It reads a local repository source file via fs.readFileSync and evaluates it in the test process to expose internal functions for unit testing. The input to eval is a committed local file path, not user-controlled or network-derived data. There is no external input, no network destination, no persistence, and no obfuscation. This is a common hobbyist test harness pattern.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-theme-manager.js:83
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads another project file by reading it and running it, which is a common shortcut in hobbyist tests. It only uses files already inside the project and does not accept outside input, so it poses no danger to users.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local source file via a relative path within the repository and executes it to load the module under test. This is a test-file harness pattern used when the target script is not exported as a require-able module. No external or attacker-controlled input reaches the eval; the path is hardcoded and the content is committed repository code. There is no runtime reachability for end users because this file only runs during testing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-delete-mode.js:74
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own front-end code into a fake browser environment so the tests can run. It only reads files that are part of the project itself, not anything supplied by users or the internet, so there is no security danger.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local project source file via a hardcoded relative path and executes it to load a frontend IIFE module into a Node.js test harness that simulates browser globals. No external or attacker-controlled input reaches the eval argument; the file content is committed project source. This is a common test-time pattern for hobbyist frontend projects and poses no runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-file-staging.js:83
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files to test it. The file being loaded is part of the project itself, not anything from outside or from a user, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a committed project source file via a hardcoded relative path and evaluates it in the test process. This is a common pattern for loading browser-oriented JavaScript modules that lack Node.js exports into a test harness's global scope. The evaluated content is a local committed file, not user input, network data, or attacker-controlled content. No external data flow reaches the eval.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-edit-entity.js:47
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. The code being run is part of the project itself, not anything supplied by a user or downloaded from the internet. This is a normal, harmless way to test browser-style code outside of a browser.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a unit test file. It reads a local, committed project source file from the repository and evaluates it so the test harness can exercise a browser-oriented module in a Node.js environment. The input is a fixed relative path to a first-party file, not user-controlled or network-sourced data. This is a common hobbyist test-loading pattern and poses no runtime risk to end users, since the code only runs during local testing.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-backup-manager.js:35
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own JavaScript code so it can be tested. It uses eval to run code that already belongs to the project, not anything from outside users or the internet. There is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs in a test file that reads a local project source file from disk and evaluates it to load module-level definitions into the test harness scope. The input to eval is a fixed local file path within the repository combined with static assignment strings; no user-controlled or external data reaches eval. This is a test-time pattern for loading a browser-oriented script in a Node environment without a module bundler.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-char-editor.js:69