OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This code runs JavaScript that the user wrote themselves in the extension's settings. That is exactly what the extension is designed to do, so it is not hidden or unexpected behavior.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The candidate uses the Function constructor to execute a JavaScript string. The string comes from script.javascript, which is user-authored configuration managed through the extension's settings UI. Executing arbitrary user-configured JavaScript is the extension's core documented purpose, as stated in the project README, and the model can only select among preconfigured scripts rather than supply its own code. The supplied evidence shows no hidden data flow, obfuscation, or external destination beyond the intended local execution of user-defined scripts.
Impact: low · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- production
- Source
- main.js:103