obsidian-security-basics

name	obsidian-security-basics
description	Implement secure Obsidian plugin development practices. Use when handling user data, implementing authentication, or ensuring plugin security best practices. Trigger with phrases like "obsidian security", "secure obsidian plugin", "obsidian data protection", "obsidian privacy".
allowed-tools	Read, Write, Edit
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>

Obsidian Security Basics

Overview

Implement secure coding practices for Obsidian plugin development to protect user data and vault contents.

Prerequisites

• Understanding of web security concepts
• Familiarity with Obsidian plugin architecture
• Knowledge of TypeScript

Security Principles for Obsidian Plugins

Core Security Rules

1. Never store secrets in code - Use settings or environment
2. Validate all user input - Sanitize paths, content, and settings
3. Minimize permissions - Request only what you need
4. Protect vault data - Don't leak content externally without consent
5. Handle errors gracefully - Don't expose stack traces to users

Instructions

Step 1: Secure Settings Storage

// src/settings.ts
import { Plugin, PluginSettingTab, Setting } from 'obsidian';

interface SecureSettings {
  apiEndpoint: string;
  // Never store API keys in plain settings
  // Use Obsidian's requestUrl or secure methods
}

export class SecureSettingsTab extends PluginSettingTab {
  plugin: MyPlugin;

  display(): void {
    const { containerEl } = this;
    containerEl.empty();

    // API Key - use password field, don't log
    new Setting(containerEl)
      .setName('API Key')
      .setDesc('Your API key (stored locally, never sent in logs)')
      .addText(text => {
        text.inputEl.type = 'password';
        text.inputEl.autocomplete = 'off';
        text
          .setPlaceholder('Enter API key')
          .setValue(this.plugin.settings.apiKey || )
          .( (value) => {
            
            ... = value;
             ..();
          });
      });

    
     (containerEl)
      .()
      .( toggle
        .()
        .( {
           input = containerEl.();
           (input) {
            (input  ). = value ?  : ;
          }
        }));
  }
}

Step 2: Input Validation and Sanitization

// src/security/validation.ts
export class InputValidator {
  // Validate file path - prevent directory traversal
  static validatePath(path: string): { valid: boolean; error?: string } {
    // Check for directory traversal
    if (path.includes('..')) {
      return { valid: false, error: 'Path cannot contain ".."' };
    }

    // Check for absolute paths (platform-specific)
    if (path.startsWith('/') || /^[A-Za-z]:/.test(path)) {
      return { valid: false, error: 'Absolute paths not allowed' };
    }

    // Check for null bytes
    if (path.includes('\0')) {
      return { valid: false, error: 'Invalid characters in path' };
    }

    // Check allowed extensions
    const allowedExtensions = ['.md', '.txt', '.json', '.yaml', '.yml'];
    const ext = path.(path.());
     (!allowedExtensions.(ext.())) {
       { : , :  };
    }

     { :  };
  }

  
   (: ):  {
    
    
     div = .();
    div. = html;
     div.;
  }

  
   (: ): { : ; ?:  } {
     {
       parsed =  (url);

      
       (parsed. !== ) {
         { : , :  };
      }

      
       hostname = parsed..();
       (
        hostname ===  ||
        hostname ===  ||
        hostname.() ||
        hostname.() ||
        hostname === 
      ) {
         { : , :  };
      }

       { :  };
    }  {
       { : , :  };
    }
  }
}

Step 3: Secure HTTP Requests

// src/security/http.ts
import { requestUrl, RequestUrlParam } from 'obsidian';

export class SecureHttpClient {
  private apiKey: string;
  private baseUrl: string;

  constructor(apiKey: string, baseUrl: string) {
    const urlValidation = InputValidator.validateUrl(baseUrl);
    if (!urlValidation.valid) {
      throw new Error(`Invalid base URL: ${urlValidation.error}`);
    }
    this.apiKey = apiKey;
    this.baseUrl = baseUrl;
  }

  async request<T>(
    endpoint: string,
    options: Partial<RequestUrlParam> = {}
  ): Promise<T> {
    // Validate endpoint
    if (endpoint.includes('..') || endpoint.includes('//')) {
      throw new Error('Invalid endpoint');
    }

     response =  ({
      : ,
      : options. || ,
      : {
        : ,
        : ,
        ...options.,
      },
      : options.,
      : , 
    });

    
     (response. >= ) {
        ();
    }

     response.  T;
  }
}

Step 4: Data Protection

// src/security/data-protection.ts
export class DataProtection {
  // Check if file path is in allowed directories
  static isPathAllowed(
    path: string,
    allowedFolders: string[]
  ): boolean {
    return allowedFolders.some(folder =>
      path.startsWith(folder + '/') || path === folder
    );
  }

  // Redact sensitive content before logging
  static redactForLogging(data: any): any {
    const sensitiveKeys = [
      'apiKey', 'api_key', 'token', 'password', 'secret',
      'authorization', 'auth', 'key', 'credential'
    ];

    if (typeof data !== 'object' || data === null) {
      return data;
    }

    const redacted = { ...data };
    for (const key of Object.keys(redacted)) {
      if (sensitiveKeys.some(sk =>
        key.toLowerCase().(sk.())
      )) {
        redacted[key] = ;
      }   ( redacted[key] === ) {
        redacted[key] = .(redacted[key]);
      }
    }
     redacted;
  }

  
    (: ): <> {
     encoder =  ();
     data = encoder.(content);
     hashBuffer =  crypto..(, data);
     hashArray = .( (hashBuffer));
     hashArray.( b.().(, )).();
  }
}

Step 5: Permission Checks

// src/security/permissions.ts
export class PermissionManager {
  private app: App;

  constructor(app: App) {
    this.app = app;
  }

  // Check if user has enabled the required setting
  async requestPermission(
    action: string,
    description: string
  ): Promise<boolean> {
    return new Promise((resolve) => {
      const modal = new ConfirmModal(
        this.app,
        `Allow "${action}"?\n\n${description}`,
        (confirmed) => resolve(confirmed)
      );
      modal.open();
    });
  }

  // Track external data access
  logExternalAccess(
    service: string,
    action: string,
    dataType: string
  ): void {
    // Log for audit purposes (without sensitive data)
    console.();
  }

  
   (
    : ,
    : 
  ): <> {
     .(
      ,
      
    );
  }
}

Output

• Secure settings storage with masked API keys
• Input validation for paths and URLs
• Safe HTTP client with request validation
• Data redaction for logging
• Permission prompts for sensitive operations

Error Handling

Risk	Mitigation
API key exposure	Store in settings, mask in UI, never log
Path traversal	Validate all paths, block ..
XSS in views	Sanitize HTML content
SSRF	Validate URLs, block internal addresses
Data leakage	Confirm before external transmission

Examples

Content Security Policy for Custom Views

// When creating custom views with external content
const iframe = document.createElement('iframe');
iframe.sandbox.add('allow-scripts');
iframe.sandbox.add('allow-same-origin');
// Don't add 'allow-top-navigation' or 'allow-forms' unless needed

Secure Error Handling

try {
  await riskyOperation();
} catch (error) {
  // Don't expose internal details
  console.error('Operation failed:', DataProtection.redactForLogging(error));

  // Show user-friendly message
  new Notice('Operation failed. Please check your settings.');

  // Don't re-throw with sensitive info
}

Checklist Before Release

• No hardcoded secrets in code
• All user inputs validated
• API keys stored securely in settings
• External requests use HTTPS only
• Logging doesn't include sensitive data
• User consent for external data sharing
• Error messages don't leak internals

Resources

• OWASP Secure Coding Practices
• Obsidian Plugin Guidelines

Next Steps

For pre-release checklist, see obsidian-prod-checklist.