21 | const srcLine = await getSourceLine(this, file, lineNum);\n 22 | if (!srcLine) return;","explanation":"Reads a single vault file by path","chainLink":1,"occurrences":2,"sourceUrl":"https://github.com/dannns/obsidian-table-checkbox-renderer/blob/1.0.2/src/main.ts#L19","additionalLocations":[{"filePath":"src/obsidian-helpers.ts","lineNumber":23,"codeSnippet":" 20 | */\n 21 | export async function getSourceLine(plugin: Plugin, file: TFile, idx: number): Promise {\n 22 | \ttry {\n> 23 | \t\tconst content = await plugin.app.vault.read(file);\n 24 | \t\tconst lines = content.split(/\\r?\\n/);\n 25 | \t\treturn idx >= 0 && idx < lines.length ? lines[idx] : null;\n 26 | \t} catch {","sourceUrl":"https://github.com/dannns/obsidian-table-checkbox-renderer/blob/1.0.2/src/obsidian-helpers.ts#L23"}]}],"resolvedFindings":[{"category":"vault_access","severity":"info","filePath":"src/obsidian-helpers.ts","lineNumber":23,"codeSnippet":" 20 | */\n 21 | export async function getSourceLine(plugin: Plugin, file: TFile, idx: number): Promise {\n 22 | \ttry {\n> 23 | \t\tconst content = await plugin.app.vault.read(file);\n 24 | \t\tconst lines = content.split(/\\r?\\n/);\n 25 | \t\treturn idx >= 0 && idx < lines.length ? lines[idx] : null;\n 26 | \t} catch {","explanation":"Reads a single vault file","chainLink":1,"occurrences":1,"sourceUrl":"https://github.com/dannns/obsidian-table-checkbox-renderer/blob/1.0.1/src/obsidian-helpers.ts#L23"}],"scoreChange":0}},"initialDiffFrom":"1.0.1","initialDiffTo":"1.0.2","summary":"The plugin reads and modifies Markdown files in your vault when you toggle checkboxes in table cells, updating only the specific lines containing those checkboxes. It has no network activity and performs no obfuscation. Data access is limited to the vault files being edited, with no external communication or data transmission.","dependencyVulnerabilities":[{"packageName":"brace-expansion","packageVersion":">=2.0.0 <2.0.3","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":">=2.0.0 <2.0.3","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"glob","packageVersion":">=10.2.0 <10.5.0","severity":"high","title":"glob CLI: Command injection via -c/--cmd executes matches with shell:true","advisoryUrl":"https://github.com/advisories/GHSA-5j98-mcp5-4vw2","ghsaId":"GHSA-5j98-mcp5-4vw2","cveId":null,"vulnerableRange":">=10.2.0 <10.5.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":">=9.0.0 <9.0.6","severity":"high","title":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","advisoryUrl":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","ghsaId":"GHSA-3ppc-4f35-3m26","cveId":null,"vulnerableRange":">=9.0.0 <9.0.6","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":">=9.0.0 <9.0.7","severity":"high","title":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","advisoryUrl":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","ghsaId":"GHSA-7r86-cg39-jmmj","cveId":null,"vulnerableRange":">=9.0.0 <9.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"minimatch","packageVersion":">=9.0.0 <9.0.7","severity":"high","title":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","advisoryUrl":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","ghsaId":"GHSA-23c5-xmqv-rm74","cveId":null,"vulnerableRange":">=9.0.0 <9.0.7","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"picomatch","packageVersion":">=4.0.0 <4.0.4","severity":"moderate","title":"Picomatch: Method Injection in POSIX Character Classes

Table Checkbox Renderer