d":"grappling-hook","version":"1.4.0","category":"vault_access","severity":"info","filePath":"src/commands/bookmark-cycler.ts","lineNumber":8,"codeSnippet":" 5 | async function readBookmarksJson(app: App): Promise {\n 6 | \tlet rawStr = \"\";\n 7 | \ttry {\n> 8 | \t\trawStr = await app.vault.adapter.read(app.vault.configDir + \"/bookmarks.json\");\n 9 | \t} catch (_error) {\n 10 | \t\t// errors if file does not exist\n 11 | \t\treturn [];","explanation":"Reads bookmark data from a file stored in the vault's configuration folder","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/chrisgrieser/grappling-hook/blob/1.4.0/src/commands/bookmark-cycler.ts#L8"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"grappling-hook","fromVersion":"1.3.0","toVersion":"1.4.0","files":[{"path":"src/commands/altfile.ts","hunks":"@@ -5,7 +5,7 @@ import { getRootLeaves } from \"src/utils\";\n function getAlternateNote(plugin: GrapplingHook): TFile | null {\n \tconst recentFiles = plugin.app.workspace.getLastOpenFiles();\n \tconst currentFile = plugin.app.workspace.getActiveViewOfType(FileView)?.file?.path;\n-\tconst openableExtensions = [\"md\", \"png\", \"pdf\", \"jpeg\", \"jpg\"];\n+\tconst openableExtensions = [\"md\", \"canvas\", \"base\", \"png\", \"pdf\", \"jpeg\", \"jpg\"];\n \n \tfor (const filePath of recentFiles) {\n \t\tconst altTFile = plugin.app.vault.getFileByPath(filePath);\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"1.3.0","initialDiffTo":"1.4.0","summary":"The plugin reads bookmark metadata from the vault's .obsidian configuration folder to provide fast navigation to frequently-used files. It does not perform any network operations or external data transmission.","dependencyVulnerabilities":[{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":">=4.0.0 <4.0.4","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","advisoryUrl":"https://github.com/advisories/GHSA-3v7f-55p6-f55p","ghsaId":"GHSA-3v7f-55p6-f55p","cveId":null,"vulnerableRange":">=4.0.0 <4.0.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":"<2.3.2","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":"<2.3.2","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":">=4.0.0 <4.0.4","severity":"high","title":"Picomatch has a ReDoS vulnerability via extglob quantifiers","advisoryUrl":"https://github.com/advisories/GHSA-c2c7-rcm5-vvqj","ghsaId":"GHSA-c2c7-rcm5-vvqj","cveId":null,"vulnerableRange":">=4.0.0 <4.0.4","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"smol-toml","packageVersion":"<1.6.1","severity":"moderate","title":"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines","advisoryUrl":"https://github.com/advisories/GHSA-v3rj-xjv7-4jmq","ghsaId":"GHSA-v3rj-xjv7-4jmq","cveId":null,"vulnerableRange":"<1.6.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null}],"auditMeta":{"source":"npm-audit","totalDeps":8,"directDeps":0,"transitiveDeps":0}}]]}]

Grappling Hook