"id":732076,"pluginId":"compress","version":"1.2.5","category":"permissions_scope","severity":"info","filePath":"main.ts","lineNumber":50,"codeSnippet":"this.app.vault.read","explanation":"Accesses Obsidian API: app.vault","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/networkmastered/obsidian-compress/blob/1.2.5/main.ts#L50"},{"id":732077,"pluginId":"compress","version":"1.2.5","category":"vault_access","severity":"info","filePath":"main.ts","lineNumber":50,"codeSnippet":" 47 | \t\t\t\t\t\t\thook.canAcceptExtension(\"\")\n 48 | \t\t\t\t\t\t\thook.editor.refresh = () => { }\n 49 | \t\t\t\t\t\t\tglobalLeafs.push([\"ctxt\", file.path, hook])\n> 50 | \t\t\t\t\t\t\tthis.app.vault.read(file).then((data) => {\n 51 | \t\t\t\t\t\t\t\t// if (file && data && (!data.includes(\"\\\\n\") && !data.includes(\" \"))) {\n 52 | \t\t\t\t\t\t\t\tif (file && data && checkCompFile(data)) {\n 53 | \t\t\t\t\t\t\t\t\tnew Notice(\"Attempting to load.\")","explanation":"Reads a file from the vault and checks whether it meets certain criteria.","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/networkmastered/obsidian-compress/blob/1.2.5/main.ts#L50"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"compress","fromVersion":"1.2.2","toVersion":"1.2.5","files":[{"path":"archive/testchecks.js","hunks":"$21","securityAnnotations":[]},{"path":"main.ts","hunks":"$22","securityAnnotations":[]},{"path":"util/networkmastercompression.js","hunks":"$23","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.2.2","initialDiffTo":"1.2.5","summary":"The compress plugin reads files from your vault and evaluates them against specified criteria to determine which files should be compressed. It operates entirely locally with no network communication or obfuscation, keeping all file processing within your vault. Based on the criteria evaluation, the plugin compresses eligible files to reduce their size on disk.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/

File Compressor