OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This extension lets the user paste their own JavaScript to customize how the tracker works, and it runs that code when the user types it in. That is a normal feature for this kind of customization tool, and there is no sign it sends data anywhere or hides what it does.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The code uses new Function to evaluate extensionSettings.mesTrackerJavascript, which is user-supplied JavaScript entered through the extension's settings UI. This is an intentional customization feature for defining tracker init, cleanup, and processing logic. The input originates from the local user's own settings, not from remote or untrusted data, and the execution is visible and directly tied to the stated purpose of the extension. No exfiltration, obfuscation, or hidden destination is present in the supplied evidence.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- src/settings/settings.js:613