nse based on content type\n 273 | const contentType = response.headers[''content-type''];","explanation":"Retrieves data from a URL determined at runtime","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/qf3l3k/obsidian-data-fetcher/blob/1.1.4/src/queryEngine.ts#L270"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"src/queryEngine.ts","lineNumber":270,"codeSnippet":" 267 | }\n 268 | }\n 269 | \n> 270 | const response = await requestUrl(requestParams);\n 271 | \n 272 | // Parse response based on content type\n 273 | const contentType = response.headers[''content-type''];","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"unresolved"}],"initialDiff":{"pluginId":"data-fetcher","fromVersion":"1.1.3","toVersion":"1.1.4","files":[{"path":"main.ts","hunks":"$21","securityAnnotations":[]},{"path":"src/cacheManager.ts","hunks":"$22","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":5}},"initialDiffFrom":"1.1.3","initialDiffTo":"1.1.4","summary":"The plugin reads vault file contents (cached locally) and makes outbound network requests to fetch data from URLs specified at runtime through REST APIs, RPC, gRPC, or GraphQL endpoints. It then inserts the retrieved data into notes without obfuscation. The plugin can fetch from any endpoint configured or referenced during use; the data sources are not hardcoded or validated against an allowlist.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","ghsaId":"GHSA-mh29-5h37-fv8m","cveId":null,"vulnerableRange":">=4.0.0 <4.1.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":nul

Data Fetcher