ring only https:// fails with HTTP 405.',\n 18 | username:\n 19 | 'Only for manual sign-in — \"Log in via browser\" fills this for you. Must equal the segment in the Server URL path: your Nextcloud user ID, usually not your email.',","explanation":"URL property targets https:///remote.php/dav/files//. (https:///remote.php/dav/files//.)","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/siosig/obsidian-nextcloudsync/blob/refs/tags/0.7.37/src/settings/tooltips.ts#L16"},{"id":1143081,"pluginId":"nextcloud-sync","version":"0.7.37","category":"filesystem_access","severity":"high","filePath":"src/settings/tooltips.ts","lineNumber":17,"codeSnippet":"'Full WebDAV endpoint, not just the host. Format: https:///remote.php/dav/files//. You may append a subfolder (e.g. ...//Documents) to sync there. Entering only https:// fails with HTTP 405.'","explanation":"Filesystem access with path traversal pattern detected: \"Full WebDAV endpoint, not just the host. Format: https:///remote.php/dav/files//. You may append a subfolder (e.g. ...//Documents) to sync there. Entering only https:// fails with HTTP 405.\". This plugin constructs paths that navigate outside its expected directory.","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/siosig/obsidian-nextcloudsync/blob/refs/tags/0.7.37/src/settings/tooltips.ts#L17"},{"id":1143082,"pluginId":"nextcloud-sync","version":"0.7.37","category":"vault_access","severity":"info","filePath":"src/sync/SyncEngine.ts","lineNumber":738,"codeSnippet":" 735 | } else {\n 736 | if (choice === 'remote') {\n 737 | // Remote absence is correct: let the deletion proceed locally.\n> 738 | const folder = this.opts.app.vault.getAbstractFileByPath(path);\n 739 | if (folder instanceof TFolder) await this.opts.app.fileManager.trashFile(folder);\n 740 | this.opts.stateDB.deleteDir(path);\n 741 | } else {","explanation":"Reads a single vault file by path","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/siosig/obsidian-nextcloudsync/blob/refs/tags/0.7.37/src/sync/SyncEngine.ts#L738"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"src/auth/LoginFlowV2.ts","lineNumber":28,"codeSnippet":" 25 | */\n 26 | static async start(serverBaseUrl: string): Promise {\n 27 | const base = serverBaseUrl.replace(/\\/$/, '');\n> 28 | const res = await requestUrl({\n 29 | url: `${base}/index.php/login/v2`,\n 30 | method: 'POST',\n 31 | headers: { 'User-Agent': 'Obsidian Nextcloud Sync' },","networkType":"active-outbound","sendsData":true,"dataDescription":"Makes network requests","endpointSource":"user-configured"},{"host":"","url":null,"filePath":"src/auth/LoginFlowV2.ts","lineNumber":50,"codeSnippet":" 47 | * @returns Polling result (discriminated union)\n 48 | */\n 49 | static async pollOnce(init: LoginFlowInit): Promise {\n> 50 | const res = await requestUrl({\n 51 | url: init.pollEndpoint,\n 52 | method: 'POST',\n 53 | headers: { 'Content-Type': 'application/x-www-form-urlencoded' },","networkType":"active-outbound","sendsData":true,"dataDescription":"Makes network requests","endpointSource":"user-configured"},{"host":"","url":null,"filePath":"src/network/requestWithTimeout.ts","lineNumber":22,"codeSnippet":" 19 | * escape hatch, never the default (the default is `networkTimeoutSeconds` = 30s).\n 20 | */\n 21 | export function requestUrlWithTimeout(params: RequestUrlParam, timeoutMs: number): Promise {\n> 22 | if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return requestUrl(params);\n 23 | return new Promise((resolve, reject) => {\n 24 | let settled = false;\n 25 | const timer = window.setTimeout(() => {","networkType":"active-inbound","sendsData":false,"dataDesc