};\n 112 | signedHeaders.Authorization = await this.authorization(method, key, signedHeaders);\n> 113 | const response = await requestUrl({\n 114 | url: this.requestUrlForKey(key),\n 115 | method,\n 116 | headers: signedHeaders,","explanation":"Retrieves data from a URL determined at runtime","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/luhui-dev/NotePic-OSS-Obsidian/blob/refs/tags/1.2.0/src/core/uploader.ts#L113"},{"id":1147737,"pluginId":"notepic-oss","version":"1.2.0","category":"permissions_scope","severity":"info","filePath":"src/main.ts","lineNumber":55,"codeSnippet":"this.app.workspace.getActiveViewOfType","explanation":"Accesses Obsidian API: app.workspace","taintConfidence":"possible","disclosed":false,"sourceUrl":"https://github.com/luhui-dev/NotePic-OSS-Obsidian/blob/refs/tags/1.2.0/src/main.ts#L55"}],"factors":null,"networkEndpoints":[{"host":"","url":null,"filePath":"src/core/pipeline.ts","lineNumber":71,"codeSnippet":" 68 | \n 69 | async function fetchRemoteBytes(url: string, signal?: AbortSignal): Promise<{ bytes: Uint8Array; ext: string }> {\n 70 | if (signal?.aborted) throw new Error(\"Request cancelled\");\n> 71 | const resp = await requestUrl(url);\n 72 | if (signal?.aborted) throw new Error(\"Request cancelled\");\n 73 | if (resp.status < 200 || resp.status >= 300) throw new Error(`HTTP ${resp.status}`);\n 74 | const ab = resp.arrayBuffer;","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"user-configured"},{"host":"","url":null,"filePath":"src/core/uploader.ts","lineNumber":113,"codeSnippet":" 110 | const date = new Date().toUTCString();\n 111 | const signedHeaders: Record = { ...headers, Date: date };\n 112 | signedHeaders.Authorization = await this.authorization(method, key, signedHeaders);\n> 113 | const response = await requestUrl({\n 114 | url: this.requestUrlForKey(key),\n 115 | method,\n 116 | headers: signedHeaders,","networkType":"active-inbound","sendsData":false,"dataDescription":null,"endpointSource":"unresolved"}],"initialDiff":null,"initialDiffFrom":"1.1.3","initialDiffTo":"1.2.0","summary":"Confirmed: the plugin accesses all files in your vault and reads individual files by path so it can find image links in the current note, compress those images, and rewrite the links in place. It can send the referenced images to Aliyun OSS when that upload feature is used. It can also retrieve data from a configured endpoint and from a URL determined at runtime, depending on how it is configured or triggered.","dependencyVulnerabilities":[{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.1","source":"npm-audit","isDirect":true,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.17","severity":"high","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","advisoryUrl":"https://github.com/advisories/GHSA-r28c-9q8g-f849","ghsaId":"GHSA-r28c-9q8g-f849","cveId":null,"vulnerableRange":"<=8.5.17","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"postcss","packageVersion":"<=8.5.22","severity":"moderate","title":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","advisoryUrl":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","ghsaId":"GHSA-fxqj-rqcc-2cmp","cveId":null,"vulnerableRange":"<=8.5.22","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"vite","packageVersion":"<=6.4.1","severity":"moderate","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","ad

NotePic OSS