Paul Spenke
84b3dd69f1
* Replace /api/v1/resources with /api/v1/attachments for image uploads
* Upload attachments as JSON with base64-encoded content field
* After memo creation, link each attachment via PATCH /api/v1/attachments/{id}
* Rewrite markdown image URLs to use /file/attachments/{id} pattern
* Fix XSS: sanitize marked.parse output with a DOM-based allowlist sanitizer
* Fix SSRF: validate img.src scheme (http/https only) before fetching
* Fix stack overflow: use chunked base64 encoding for large images
* Update CLAUDE.md to document new attachment flow
Memos Clipper — Chrome Extension
Clip any web page or selection as Markdown directly to your usememos instance. Images are uploaded as attachments. Preview and edit before sending.
Features
- Full page or selection — clip the whole article (auto-extracted) or just what you've selected
- Markdown preview — live rendered preview with syntax highlighting
- Edit before send — tweak the Markdown in the built-in editor
- Image attachments — images found on the page are uploaded as resources; toggle per-image
- Visibility control — Private / Protected / Public per memo
- Source attribution — automatically prepends a blockquote with the source URL and title
Installation
- Open Chrome and go to
chrome://extensions/ - Enable Developer mode (top right toggle)
- Click Load unpacked
- Select this folder (
memos-extension/)
Configuration
- Click the extension icon → ⚙ settings gear (or right-click → Options)
- Enter your Memos instance URL, e.g.
https://memos.example.com - Generate an access token in Memos: Settings → Account → Access Tokens
- Paste the token and click Save Settings
- Click Test Connection to verify
Usage
- Navigate to any web page
- (Optional) Select text you want to clip
- Click the Memos Clipper icon in the toolbar
- The page (or selection) is extracted as Markdown
- Edit if needed, check the Preview tab
- Adjust visibility and image settings
- Click Send to Memos
API compatibility
Tested against usememos v0.22+ (uses /api/v1/memos and /api/v1/resources).
Notes
- Images on cross-origin pages may fail to upload due to CORS restrictions — these will be skipped gracefully
- The extension uses Chrome's
scriptingpermission to inject the content extractor on demand - No data is ever sent anywhere except your own Memos instance