bled\n> 582 | \t\t\t\t\t? 'http://localhost:23119/api'\n 583 | \t\t\t\t\t: 'https://api.zotero.org';\n 584 | \t\t\t\tconst fileUrl = `${baseUrl}/users/${this.client.userID}/items/${attKey}/file`;\n 585 | \t\t\t\tconst base64Data = await this.fetchImageAsBase64(fileUrl);","sourceUrl":"https://github.com/frthjf/obsidian-zotero-sync-client/blob/1.4.0/main.ts#L582"}]},{"category":"network_calls","severity":"high","filePath":"main.ts","lineNumber":583,"codeSnippet":" 580 | \t\t\tif (attKey) {\n 581 | \t\t\t\tconst baseUrl = this.settings.local_sync_enabled\n 582 | \t\t\t\t\t? 'http://localhost:23119/api'\n> 583 | \t\t\t\t\t: 'https://api.zotero.org';\n 584 | \t\t\t\tconst fileUrl = `${baseUrl}/users/${this.client.userID}/items/${attKey}/file`;\n 585 | \t\t\t\tconst base64Data = await this.fetchImageAsBase64(fileUrl);\n 586 | \t\t\t\tif (base64Data) {","explanation":"Hardcoded URL found: api.zotero.org (https://api.zotero.org)","networkType":"passive","host":"api.zotero.org","sourceUrl":"https://github.com/frthjf/obsidian-zotero-sync-client/blob/1.4.0/main.ts#L583"}],"resolvedFindings":[{"category":"network_calls","severity":"info","filePath":"main.ts","lineNumber":494,"codeSnippet":" 491 | \n 492 | \tasync fetchImageAsBase64(url: string): Promise {\n 493 | \t\ttry {\n> 494 | \t\t\tconst response = await requestUrl({\n 495 | \t\t\t\t'url': url,\n 496 | \t\t\t\theaders: {\n 497 | \t\t\t\t\t'Accept': 'image/*',","explanation":"Retrieves data from a configured endpoint","networkType":"active-inbound","host":null,"chainLink":2,"findingKind":"capability","context":{"endpointSource":"user-configured"},"sourceUrl":"https://github.com/frthjf/obsidian-zotero-sync-client/blob/1.3.6/main.ts#L494"}],"scoreChange":11}},"initialDiffFrom":"1.3.6","initialDiffTo":"1.4.0","summary":"This plugin reads all files from your vault without verifying they were created by it, potentially exposing any note to unintended processing. While designed to sync with Zotero's API, no explicit network activity was detected in the analysis, though the core functionality would require connecting to Zotero servers to retrieve your library data. The broad file-reading capability combined with undefined privacy controls creates a data access surface that exceeds what a sync tool typically needs.","dependencyVulnerabilities":[{"packageName":"ajv","packageVersion":"<6.14.0","severity":"moderate","title":"ajv has ReDoS when using `$data` option","advisoryUrl":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","ghsaId":"GHSA-2g4f-4pwh-qvx6","cveId":null,"vulnerableRange":"<6.14.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"brace-expansion","packageVersion":"<1.1.13","severity":"moderate","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","advisoryUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","ghsaId":"GHSA-f886-m6hf-6m8v","cveId":null,"vulnerableRange":"<1.1.13","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"esbuild","packageVersion":"<=0.24.2","severity":"moderate","title":"esbuild enables any website to send any requests to the development server and read the response","advisoryUrl":"https://github.com/advisories/GHSA-67mh-4wv8-2f99","ghsaId":"GHSA-67mh-4wv8-2f99","cveId":null,"vulnerableRange":"<=0.24.2","fixAvailable":"0.28.0","source":"npm-audit","isDirect":true,"path":null},{"packageName":"flatted","packageVersion":"<3.4.0","severity":"high","title":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","advisoryUrl":"https://github.com/advisories/GHSA-25h7-pfq9-p65f","ghsaId":"GHSA-25h7-pfq9-p65f","cveId":null,"vulnerableRange":"<3.4.0","fixAvailable":null,"source":"npm-audit","isDirect":false,"path":null},{"packageName":"flatted","packageVersion":"<=3.4.1","severity":"high","title":"Prototype Pollution via parse() in NodeJS flatted","advisoryUrl":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh","ghsaId":"GHSA-rf6f-7fwh-wjgh","cveId":null,"vulnerableRange":"<=3.4.1","fixAv

Zotero Sync