OpenGrep reported tavernkeeper.dynamic-execution.javascript-eval
Expected behavior · high confidence
This is test code that runs the project's own parser logic in a sandbox to verify it works correctly. It only uses files already in the project and does not process any user or network input, so it poses no security risk.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.dynamic-execution.javascript-eval in this repository.
Contextual assessment: The flagged code is in a test file that uses node:vm to load a local project source file for unit testing. The executed source is read from the project's own committed files, not from user input, network data, or chat content. The sandbox context provides only stubbed logger and context objects. This is a standard test-harness pattern for exercising parser logic in isolation and does not ship to end users.
Impact: none · Exploitability: unlikely
Developer action: none
- Scanner
- opengrep 1.26.0
- Rule
- tavernkeeper.dynamic-execution.javascript-eval
- File role
- test
- Source
- tests/directives-runtime.test.js:23-27