Is Alibaba Search by image safe?
Alibaba Search by image is medium risk. Opening a top-level page, Alibaba Search by image can send the page URL, referrer, browser details, and a persistent user ID to `api.asbipartnerdb.com/check`. Dynamic analysis confirmed this POST for a Reddit navigation.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Browsing URLs sent to ASBI partner API
Opening a top-level page, Alibaba Search by image can send the page URL, referrer, browser details, and a persistent user ID to `api.asbipartnerdb.com/check`.
Dynamic analysis confirmed this POST for a Reddit navigation.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a top-level page in the browser.
The code path is tied to normal page navigation, not only to image-search clicks.
The extension builds a browsing report and posts it to `api.asbipartnerdb.com/check`.
The report includes the page URL, site domain, referring site, browser details, and a stored extension user ID.
Dynamic analysis recorded request body fields for a Reddit navigation: uri included a reddit.com URL with query parameters, domain was www.reddit.com, referer was https://www.reddit.com, and locale, user_agent, and platform were present.
- Content-Type
- application/json
- Page URLhttps://www.reddit.com/?solution=<redacted>&token=<redacted> (observed parameter names; values not republished)
Shows the exact page you opened, including path and query-string fields when they are present.
- Site domainwww.reddit.com (observed during dynamic analysis)
Records which website you visited even when the full path is not needed.
- Referring sitehttps://www.reddit.com (observed during dynamic analysis)
Adds the site context associated with the navigation when the browser provides it.
- Browser profilelocale, user_agent, platform, and vendor fields were recorded during dynamic analysis
Adds details about your browser and device environment to the browsing report.
- Extension user ID9f2f6f88-1f44-4fd2-8f91-2a7a2c5d9e10 (illustrative UUID generated by the extension)
Links separate reports from the same extension install over time.
The background listener that posts navigation details
Readable equivalent of the stored ID setup
background.jslet userId = "";(function initializeUserIdStore() { const request = indexedDB.open("ASBIPARTNERDB", 2); request.onupgradeneeded = (event) => { event.target.result .createObjectStore("ASBIuids", { autoIncrement: true }) .createIndex("uuid", "uuid", { unique: true }); }; request.onerror = () => {}; request.onsuccess = (event) => { const db = event.target.result; const tx = db.transaction("ASBIuids", "readonly"); const getRequest = tx.objectStore("ASBIuids").get(1); getRequest.onsuccess = (event) => { if (!event.target.result) { const uuid = self.crypto.randomUUID(); const writeTx = db.transaction("ASBIuids", "readwrite"); writeTx.objectStore("ASBIuids").put({ uuid }); writeTx.oncomplete = function () { db.close(); }; } }; getRequest.onerror = () => {}; tx.oncomplete = function () { db.close(); }; };})();indexedDB.open("ASBIPARTNERDB", 2).onsuccess = (event) => { const db = event.target.result; const tx = db.transaction("ASBIuids", "readonly"); const getRequest = tx.objectStore("ASBIuids").get(1); getRequest.onsuccess = (event) => { if (event.target.result) { userId = event.target.result.uuid; } }; getRequest.onerror = () => {}; tx.oncomplete = function () { db.close(); };};Readable equivalent of the navigation POST
background.jschrome.webRequest.onBeforeSendHeaders.addListener( function onBeforeSendHeaders(details) { if ( details.documentId || details.method !== "GET" || details.parentFrameId !== -1 || details.type !== "main_frame" ) { return; } const visitedUrl = new URL(details.url); async function postNavigation(details, visitedUrl, endpoint = "", userId = "") { const body = { timestamp: Date().toLocaleString(), uri: details.url, domain: visitedUrl.hostname, title: "", referer: details.initiator, locale: navigator.language, user_agent: navigator.userAgent, platform: navigator.platform, vendor: navigator.vendor, user_id: userId, }; return ( await fetch(endpoint, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body), }) ).json(); } postNavigation( details, visitedUrl, "https://api.asbipartnerdb.com/check", userId, ).then((response) => { if ( response && response.match && response.partner && response.partner.startdate && response.partner.enddate && response.partner.partnertype === "AFFILIATE" ) { const now = new Date(); const startParts = response.partner.startdate.split("-"); const startDate = new Date(startParts[0], startParts[1], startParts[2]); const endParts = response.partner.enddate.split("-"); const endDate = new Date(endParts[0], endParts[1], endParts[2]); if (startDate < now && now < endDate && response.partner.regex) { const urlFilter = "||" + visitedUrl.hostname; chrome.declarativeNetRequest.updateSessionRules( { addRules: [ { id: 4, priority: 1, action: { type: "redirect", redirect: { regexSubstitution: response.partner.regex }, }, condition: { urlFilter, resourceTypes: ["main_frame"], }, }, ], removeRuleIds: [id], }, function () {}, ); } } }); }, { urls: ["<all_urls>"] },);- api.asbipartnerdb.com
Receives the navigation report posted by the background service worker.
What it can do
Permissions this extension asks for, as declared in version 1.4.19. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Add items to the right-click menu
contextMenus
Watch every request your browser makes
webRequest
See the address and title of every tab you have open
tabs
Block and redirect the requests your browser makes
declarativeNetRequest