:"info","filePath":"src/helpers.ts","lineNumber":254,"codeSnippet":" 251 | \t\t\t};\n 252 | \t\t\timage.onerror = async () => {\n 253 | \t\t\t\ttry {\n> 254 | \t\t\t\t\tawait requestUrl({ url: image.src });\n 255 | \t\t\t\t\tconst blob = await loadImageBlob(\n 256 | \t\t\t\t\t\t`https://api.allorigins.win/raw?url=${encodeURIComponent(\n 257 | \t\t\t\t\t\t\timgSrc","explanation":"Retrieves data from a URL determined at runtime","networkType":"active-inbound","host":null,"chainLink":2,"findingKind":"capability","context":{"endpointSource":"unresolved"},"sourceUrl":"https://github.com/byfun/obsidian-image-helper/blob/1.0.0/src/helpers.ts#L254"}],"scoreChange":12}},"initialDiffFrom":"1.0.0","initialDiffTo":"1.0.1","summary":"Image-helper reads image files from the vault using file paths to enable format conversion in reading view. The plugin does not make any network requests or attempt to send data outside the vault. No code obfuscation is present, making the functionality transparent and auditable.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"braces","packageVersion":"<3.0.3","severity":"high","title":"Uncontrolled resource consumption in braces","advisoryUrl":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","ghsaId":"GHSA-grv7-fg5c-xmjg","cveId":null,"vulnerableRange":"<3.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"cross-spawn","packageVersion":">=7.0.0 <7.0.5","severity":"high","title":"Regular Expression Denial of Service (ReDoS) in cross-spawn","advisoryUrl":"https://github.com/advisories/GHSA-3xgq-45jj-v275","ghsaId":"GHSA-3xgq-45jj-v275","cveId":null,"vulnerableRange":">=7.0.0 <7.0.5","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"js-yaml","packageVersion":">=4.0.0 <4.1.1","severity":"moderate","title":"js-yaml has prototype pollution in merge (<<)","advisoryUrl":"https://gith

Image Helper