eval_usage creating false positives on regular function declarations

[MrGavintech]

Summary

The eval_usage rule in hooks/genai_security_check.py is overly broad. Because matches are performed with re.IGNORECASE, the pattern r'Function\s*\(' unintentionally flags normal JavaScript function ( declarations as dynamic code execution.

Impact

False positives in JS/TS files where function ( appears, causing noisy security reports.

Root Cause

• Pattern: r'Function\s*\('
• Matching is done with re.IGNORECASE, so it also matches function (.

Reproduction (regex101)

Visit https://regex101.com/r/pR6yoH/1

• To reproduce the false positive, use the inline case-insensitive flag:
  • (?i)Function\s*\(

Suggested Fix

Narrow the pattern to only match new Function(...) while retaining the other eval-related checks.

# File: 'hooks/genai_security_check.py'
# Replace the 'eval_usage' patterns with:

GENAI_SECURITY_PATTERNS = {
    # ...
    'eval_usage': {
        'patterns': [
            r'\beval\s*\(',
            r'\bnew\s+Function\s*\(',  # only match `new Function(...)`
            r'setTimeout\s*\([^,)]*["\'][^"\']*["\']',
            r'setInterval\s*\([^,)]*["\'][^"\']*["\']',
            r'Script\.eval',
        ],
        'description': 'Dynamic code execution - avoid eval() and similar functions',
        'severity': 'high'
    },
    # ...
}