No material or immediate-danger item was identified.
Expected scanner matches (18)
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It uses an older, less tidy method to do so, but the content being loaded is a local file belonging to the project itself, not anything from outside or from a user.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call is inside a test file that reads a local project source file from the repository's own static directory and evaluates it in a Node test harness. This is a common hobbyist pattern for loading browser-oriented scripts that lack module exports. The input is a fixed local path constructed from __dirname, not user-controlled or network-sourced data. There is no exfiltration, persistence, or external destination involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-edit-message.js:101
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
The test file loads one of the project's own JavaScript files so it can test it in a simulated browser environment. The file path is fixed and points only to code inside the project itself, so there is no way for outside input to influence what gets run. This is a normal, if informal, testing approach.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local project source file via a path built from the test directory and fixed relative components. No external or attacker-controlled input reaches the file path or the evaluated content. This is a test harness loading its own module into a mock DOM environment, a common pattern in hobbyist Node test setups without a bundler. No network, credentials, persistence, or obfuscation are involved.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-scroll-manager.js:44
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code runs only in the project's test suite. It loads one of the project's own files so the tests can check its functions. It does not run when the app is used normally and does not process any outside or user-supplied data.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs inside a test file that reads a local project source file via fs.readFileSync and evaluates it to expose bare functions for unit testing. The evaluated content is a committed project file from a fixed relative path, not user input, network data, or external content. This is a common hobbyist test-loading pattern and poses no runtime risk to end users since it only executes during the test suite.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-status-panel.js:72
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads another project file by reading it from disk and running it, so the tests can use it. The file being loaded is part of the project itself, not something a user or attacker controls. This is a normal, if informal, way to test browser-style code in Node.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a local repository source file via a relative path and evaluates it to load the StateManager into the test's global scope. This is a common hobbyist pattern for loading browser-oriented JS modules in a Node test harness without module exports. The input is a fixed local file within the repository, not user-controlled or network-sourced. No external destinations, persistence, or obfuscation are involved. The capability matches the stated test file role.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-state-manager.js:28
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own JavaScript code by reading it from disk and running it, so the tests can check how it behaves. The code being run is a local project file with a fixed path, not anything from outside or from a user. This is normal for tests and not a security problem.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a hardcoded local source file relative to the test directory and executes it to load the module under test into a mocked browser-global environment. No external or attacker-controlled input reaches the eval. This is a common hobbyist test-harness pattern for loading browser-oriented JS modules in Node without a bundler. It runs only during tests and does not touch credentials, network, or persistence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-list-manager.js:24
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that loads one of the project's own files to test it. It only uses files already in the repository and does not accept outside input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs in a test file that reads a local source file from the repository and evaluates it to load module functions for unit testing. The input to eval is a file read from the repository itself plus a static string assigning exports. No user-controlled or network-derived data reaches eval. This is a common hobbyist test harness pattern for loading browser-oriented modules in a Node environment.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-lightbox.js:78
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own code files so it can run unit tests against it. The code being loaded is a local file that ships with the project, not anything a user or attacker can control. This is a common shortcut in hobbyist test setups and poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local, committed project source file from a fixed relative path and executes it to load the module under test. No external, user-controlled, or network-sourced input reaches the eval. This is a test-only harness pattern used to load a browser-oriented module that is not packaged as a Node module. The evaluated content is the project's own source code, not attacker-controlled data.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-extract-data.js:23
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads another file from the project itself so it can run tests on it. It only reads a local file that ships with the project and does not take input from users or the internet.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local project source file via a relative path computed from the test file's own directory and executes it to load the module under test into the Node test environment. This is a common hobbyist test-loading pattern. The input is a fixed local file within the repository, not user-controlled or network-sourced data. There is no exfiltration, persistence, or external destination.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-message-renderer.js:46
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code is part of a test script. It loads one of the project's own JavaScript files so the tests can run it. It does not use any outside or user-controlled input, so there is no security danger here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a test file and reads a local repository source file via a path built from __dirname and fixed relative components, then evaluates it to load a browser-oriented IIFE module into the Node test environment. No external or attacker-controlled input reaches the path or evaluated content. This is a common hobbyist test-harness pattern and poses no runtime risk to users of the application.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-message-pruner.js:84
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. It only reads files already included in the repository and does not run anything provided by users or the internet, so there is no security danger.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval reads a committed project source file via a relative path constructed from __dirname within the repository. No external or attacker-controlled input reaches the evaluated content; the file is a local browser-oriented module loaded into the Node test environment because it lacks CommonJS exports. This is a common hobbyist test-harness pattern and poses no runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-reasoning-visibility.js:24
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test script that loads one of the project's own code files to check that its URL paths are correct. It only reads files already included in the repository and does not accept outside input, so there is no security danger.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The matched eval call is inside a unit test file. It reads a committed local source file via a relative path built from __dirname and executes it so the test can assert on the resulting api object. The file path is not influenced by external or user input, and the evaluated content is repository source code intended for browser use without module exports. This is a common test harness pattern and poses no runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-api-paths.js:7
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This test file loads one of the project's own JavaScript files and runs it so the tests can exercise it. The code being run comes from inside the project itself, not from anything a user or attacker can control, so there is no security risk here.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call executes source code read from a local project file via fs.readFileSync, using a path constructed from __dirname and fixed relative segments. No external or user-controlled input reaches the eval. This is a test-file pattern to load a browser-oriented UI module into a Node test harness that lacks a module export. The evaluated content is committed project source, not network data or attacker input.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-notifications.js:58
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own theme code so the tests can check individual functions. It only runs code that is already part of the project, not anything from users or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call executes a local project source file read from the repository's own static UI directory, then appends a fixed string to expose internal functions for unit testing. No external, user-controlled, or network-sourced input reaches the eval. This is a test-only harness pattern with no runtime reachability in shipped application code.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-theme-manager.js:83
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. The file path is fixed and points only to a local project file, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local project source file via a relative path and executes it to load the module under test into the test harness scope. The path is hardcoded and not derived from user input or external data. This is a common hobbyist pattern for loading non-module browser JS into a Node test environment. No network exfiltration, credential access, persistence, or obfuscation is present.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-delete-mode.js:74
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads one of the project's own JavaScript files so it can be tested. The code being loaded is a fixed local file from the project itself, not anything a user or attacker can control. This is a normal, if old-fashioned, way to test browser code outside a browser and is not a security problem.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged eval call is inside a test file and reads a known, local project source file from disk, then evaluates it so the test harness can exercise a browser-oriented IIFE module under Node.js. No external, user-controlled, or network-sourced data reaches the eval. The input is a hardcoded relative path to a committed project file. This is a common hobbyist test pattern for loading frontend modules without a bundler and poses no runtime security risk in production because the code does not ship to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-file-staging.js:83
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads a local script from the project itself so the tests can run. It only reads files already inside the repository and does not accept any outside input, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local repository JavaScript file via a hardcoded relative path and executes it to load the module under test. This is a test-file convenience pattern for loading a non-module script into the test harness. No external or attacker-controlled input reaches the eval; the path is constructed from __dirname and fixed string segments within the repository.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-edit-entity.js:47
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that loads a local project file to test it. It does not run anything from the internet or from user input, so it is not a security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call reads a local, repository-bundled JavaScript file via a relative path and executes it to load the module under test in a Node-based test harness. No external or attacker-controlled input reaches eval; the path is constructed from __dirname and fixed string segments. This is a common hobbyist test-loading pattern and poses no runtime risk to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-backup-manager.js:35
OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is a test file that loads the project's own JavaScript code into memory so the tests can check it. It only reads a file that is already part of the project, not anything from users or the internet, so there is no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The eval call occurs in a test file that reads a local project source file via fs.readFileSync and evaluates it to load module-level definitions into the test harness scope. The input is a fixed path within the repository, not external or user-controlled data. This is a common hobbyist pattern for testing browser-oriented JavaScript in Node without a module bundler. No network input, untrusted data, or runtime user control reaches the eval argument.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/frontend/test-char-editor.js:69