TavernKeeper Scan Report

RivelleDays/SillyTavern-MoonlitEchoesTheme

Commit a84cfeb Reviewed

No material or immediate-danger concern was identified in this review.

This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.

0 immediate danger 0 material 8 low

What this review found

No material or immediate-danger item was identified.

Minor cautions

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

This file uses a regular expression to read colors. The pattern might be slow if someone uses a very long or tricky color string, which could cause your browser to freeze momentarily. It's a minor issue since it only affects that one page and can be fixed by refreshing.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex /rgba?\((\d+),\s*(\d+),\s*(\d+)(?:,\s*([\d.]+))?\)/ at line 19 is used to parse RGBA color strings. While not clearly vulnerable to catastrophic backtracking (ReDoS) due to its simple structure, it contains no input length or complexity guards. If an attacker supplies a crafted, long input, a JavaScript engine might exhibit performance degradation. In a client-side SillyTavern theme extension, this would result in a temporary UI freeze (self-denial of service), which is recoverable by reloading the page. The scanner flag is a static heuristic without demonstrated exploit; no actual vulnerability has been proven.

Impact: low · Exploitability: plausible

Developer action: Consider validating the input string length before applying the regex (e.g., reject strings longer than 50 characters). Alternatively, use a non-regex parser (splitting on commas and parentheses) for safer RGBA parsing.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/utils/color.js:19

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

Another function uses the same color-reading pattern. As before, it's a minor performance worry, not a real security threat.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The same regex as candidate 0187a1831a0427b115d4b91d95b1bb581f56909f0a3fbdd3b87498af94bf1a6b appears at line 130 in getRgbPartFromRgba. The assessment is identical: a potential performance concern under crafted input, but no demonstrated exploit and only self-dos impact.

Impact: low · Exploitability: plausible

Developer action: Apply the same input length check or switch to a simpler parsing method for consistency across all functions.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/utils/color.js:130

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

Yet another place in the same file uses the same color pattern. It's the same mild concern—nothing to worry about for typical use.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The same regex appears at line 103 in parseColorValue. Identical assessment: a static scanner flag indicating a potential but unconfirmed ReDoS risk. Input is user-supplied color strings; impact is limited to client-side freeze.

Impact: low · Exploitability: plausible

Developer action: Refactor to share a single robust parsing function or add input validation as suggested for the first candidate.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/utils/color.js:103

JavaScript analysis reported javascript.xray.unsafe-regex

Minor caution · medium confidence

Fourth occurrence of the same pattern. All are minor and not a real danger.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The same regex appears at line 47 in getAlphaFromRgba. Assessment mirrors the other three candidates: potential performance issue under crafted input, not demonstrated as exploitable, recoverable self-dos.

Impact: low · Exploitability: plausible

Developer action: Apply the same remediation across all four locations or consolidate the parsing logic into one helper function.

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/utils/color.js:47
Expected scanner matches (3)

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

The scanner flagged a regular expression used in the theme's color picker, but it's only used to read color values the browser has already processed, not to handle raw user input. This is safe and not a security problem.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: The regex /rgba?\(\d+,\d+,\d+(?:,([\d.]+))?\)/ is used on lines 262 and 287 to parse the alpha value from a browser-computed color string (output of getComputedStyle). The input flow: user text is first validated against /^rgba?\([^)]*\)$/ or /^#[0-9A-Fa-f]{6}$/, whitespace is removed, then set as style on a temporary element, then getComputedStyle returns a canonical browser-generated string. The regex is never applied directly to arbitrary user-controlled text; it parses the browser's deterministic output. The pattern lacks nested quantifiers or ambiguous alternations, making ReDoS infeasible in this context. No attacker-controlled data reaches the regex in a way that could cause harmful backtracking.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/ui/settings-factory.js:262

JavaScript analysis reported javascript.xray.obfuscated-code

Expected behavior · high confidence

This file just stores theme settings like colors and styles. It is written in plain, readable code with comments explaining everything. There is nothing hidden or suspicious.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.obfuscated-code in this repository.

Contextual assessment: The file `file` is a clean, well-commented configuration module exporting tab mappings and a theme custom settings array. All code is readable, uses descriptive identifiers, proper comments, and imports only a translation helper. There is no obfuscation, encoded strings, dynamic evaluation, or concealed logic. The JS-X-Ray obfuscated-code signal is a false positive; the scanner confidence was low and the actual source contradicts the signal.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.obfuscated-code
File role
production
Source
src/config/theme-settings.js:1

JavaScript analysis reported javascript.xray.unsafe-regex

Expected behavior · high confidence

This is the same regex used in another place in the color picker. It's still safe because it only reads colors the browser has already produced, not raw user input.

Technical evidence

Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.xray.unsafe-regex in this repository.

Contextual assessment: Identical regex pattern at line 287 in the same code path. Same reasoning as candidate 29e3080f: the regex is applied only after input validation and only to a browser-computed color string. No ReDoS risk exists because the input to the regex is always a normalized, predictable browser-generated string. The scanner finding does not correspond to a real vulnerability.

Impact: none · Exploitability: unlikely

Developer action: none

Scanner
javascript-analysis webcrack-2.16.0_js-x-ray-16.0.0_signatures-1_literals-1
Rule
javascript.xray.unsafe-regex
File role
production
Source
src/ui/settings-factory.js:287

Related contextual observations

Repeated unsafe-regex pattern across four functions

low risk · medium confidence

The same color-reading code appears four times. This isn't dangerous, but fixing it in one place instead of four is easier and cleaner.

Technical assessment

The same regex /rgba?\((\d+),\s*(\d+),\s*(\d+)(?:,\s*([\d.]+))?\)/ is used in four separate functions (rgbaToHex, getAlphaFromRgba, parseColorValue, getRgbPartFromRgba). Each occurrence is flagged identically by the scanner. While no exploit is demonstrated, duplication increases the maintenance burden and the surface for potential performance issues. Centralizing parsing logic would reduce risk and improve consistency.

Impact: low · Exploitability: plausible

Developer action: Consolidate all RGBA parsing into a single helper function (e.g., parseRgbaString) and call it from each of the four functions. Then apply input validation in that central function.

Sources:

Coverage and limitations

JavaScript coverage

Tools

Limitations

Technical scan identity