2.1.10/src/modals/placeholderPropertyModal.ts#L29"},{"id":806903,"pluginId":"note-placeholder","version":"2.1.10","category":"permissions_scope","severity":"info","filePath":"src/modals/placeholderPropertyModal.ts","lineNumber":63,"codeSnippet":"this.app.fileManager.processFrontMatter","explanation":"Accesses Obsidian API: app.fileManager","taintConfidence":null,"disclosed":false,"sourceUrl":"https://github.com/XZSt4nce/note-placeholder/blob/2.1.10/src/modals/placeholderPropertyModal.ts#L63"}],"factors":null,"networkEndpoints":[],"initialDiff":{"pluginId":"note-placeholder","fromVersion":"2.1.9","toVersion":"2.1.10","files":[{"path":"src/replacer.ts","hunks":"@@ -124,10 +124,12 @@ export default class Replacer {\n const placeholder: string | undefined = this.getPlaceholderProperty(note.file);\n \n let view: string;\n- if (placeholder && (noName || namesOff) && !placeholderDisabled) {\n+ if (placeholderDisabled) {\n+ view = fileName;\n+ } else if (placeholder && (noName || namesOff)) {\n view = placeholder;\n } else {\n- view = fileName;\n+ view = linkName.split(' > ')[0];\n }\n \n const { specialHeaders, nonSpecialHeaders }: LinkHeaders = parseHeaders(note.headers);\n","securityAnnotations":[]}],"securityDelta":{"newFindings":[],"resolvedFindings":[],"scoreChange":0}},"initialDiffFrom":"2.1.9","initialDiffTo":"2.1.10","summary":"The plugin loads all markdown files from your vault into memory during initialization to enable its core functionality of replacing note link text with placeholders in view mode. It performs no network requests and uses no obfuscation, keeping all operations entirely local to your system. The plugin has no confirmed or potential capability to access external endpoints or transmit vault data outside your device.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":">=1.0.0 <=1.1.11","severity":"low","title":"brace-expansion Regular Expression Denial of Service vulnerability","advisoryUrl":"https://github.com/advisories/GHSA-v6h2-p8h4-qcjw","ghsaId":"GHSA-v6h2-p8h4-qcjw","cveId":null,"vulnerableRange":">=1.0.0 <=1.1.11","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName"

Note Placeholder