Secure authored JavaScript text segments

[BenCodez]

Summary

• identify operator-authored [Javascript=...] segments before any custom-placeholder or PlaceholderAPI replacement
• evaluate only JavaScript segments present in the original configured text
• neutralize marker-looking output generated later by placeholders or JavaScript results so it remains ordinary text
• keep existing authored marker syntax and ordinary JavaScript configurations unchanged
• resolve placeholders inside known JavaScript blocks automatically, using engine bindings for executable-expression values
• use Rhino's AST to distinguish strings, template text, regex literals, comments, and executable expressions instead of maintaining a handwritten JavaScript fallback lexer
• preserve custom placeholder precedence, {name} compatibility, and custom-placeholder -> PlaceholderAPI chaining
• fail closed when placeholder-bearing JavaScript cannot be parsed safely

Security boundary

Only JavaScript explicitly authored in the original configuration is executable. Placeholder output and JavaScript return values cannot create a second executable [Javascript=...] marker.

For example:

Messages:
  Player: "Hello %player_name%! Level: [Javascript=Player.getLevel()]"

is segmented before replacement into literal text plus one authored JavaScript block. If %player_name% returns [Javascript=Bukkit.shutdown()], that value stays text and is never evaluated.

Compatibility

Existing configurations remain automatic, including:

Player.hasPermission("someper") == true
%permission_result% == true
'%player_name%' == 'Ben'
`Hello %player_name%`
/^%player_name%$/.test(value)
{count} > 0

Plain JavaScript without placeholders bypasses AST processing. Placeholder-bearing JavaScript is parsed with Rhino 1.9.1 for source-context classification, while execution continues through AdvancedCore's existing configured JavaScript engine.

Tests

• authored marker segmentation before replacement
• placeholder-generated and result-generated marker neutralization
• bare expression bindings and primitive coercion
• quoted, template, regex, comment, and optional-chaining contexts
• custom placeholder precedence and PlaceholderAPI chaining
• exact injection-boundary regressions
• compact modulo, whitespace tokens, overlapping candidates, and escape parity
• concurrent shared-engine binding isolation
• disabled-mode PlaceholderAPI compatibility

This supersedes #302 with a smaller, structured boundary-first implementation and no handwritten modern-JavaScript fallback scanner.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[BenCodez]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed18691460

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed18691460

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T03:13:29.108442Z	fb003af	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab0be58879

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6769caa2e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a36da3e06a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".