Post #4377633

2026-08-04 13:03 UTC

@gnyman@infosec.exchange Web Clipper uses Obsidian URI (the obsidian:// protocol) to open Obsidian and create the note, but there is no way for Obsidian to know if that was intentionally triggered by you. So it's asking to confirm that you want to create that note. It's directly related to the question you asked. https://obsidian.md/help/uri

Replies (1)

@gnyman@infosec.exchange 2026-08-04 14:38

@kepano@mastodon.social @kepano@mastodon.social ok, so there is no security risk from accepting this, it will just create a new note? Or is it here where a webpage could inject code (by having it in the webpage?) and do something bad? I think it’s the simultaneous clipboard issue which is causing a lot of the confusion. It does not ask "Do you want to create a new note with ”? It shows some error about the clipboard. I understand the problem with URI’s not being authenticated, I think it’s wrong allow all "new" commands, it should be per app. If the clipper would generate a private key it could sign the requests and then you approve "Web Clipper" to always do this but other apps would not be able to do it? Thoughts?

Open ##4377632