Plugins

Obsidian plugin development feels deceptively safe. You are not building a public website. You are writing code for a note-taking app, usually for power users, often for yourself first. That mindset is exactly why XSS bugs slip in. The UI still renders HTML. The app still runs JavaScript. The plugin still touches untrusted content from notes, frontmatter, sync sources, APIs, and other plugins. And because Obsidian sits on Electron, a bad XSS bug can feel worse than the browser kind. Sometimes it is “just” UI injection. Sometimes it is account token theft from a plugin settings panel. Sometimes it becomes local file access or remote code execution territory if the plugin mixes unsafe rendering with privileged APIs. ...

Cross-site scripting in WordPress plugins usually comes down to one boring truth: untrusted data reached HTML, JavaScript, or an attribute without the right escaping. I’ve reviewed a lot of plugin code over the years, and the same patterns keep showing up: $_GET echoed into admin pages option values printed without escaping post meta dropped into attributes localized script data built unsafely AJAX handlers returning HTML stitched together from user input WordPress gives you the tools to avoid this. The hard part is using the right function for the right output context. ...