Is Calculator safe?
Calculator is medium risk. Opening the Calculator popup makes three GET requests to linangdata.com and inserts each response into the popup with jQuery .html(). The package ships no fixed menu/banner HTML, so the server response controls the markup shown.
Who publishes itLinangData - 6 other listings from the same operator, 1 of them carrying a finding
LinangData - 6 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 101k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup replaces three areas with remote HTML
Opening the Calculator popup makes three GET requests to linangdata.com and inserts each response into the popup with jQuery .html().
The package ships no fixed menu/banner HTML, so the server response controls the markup shown.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open the Calculator popup from the browser toolbar.
The popup downloads menu and banner markup from linangdata.com and inserts it into the page.
Click handlers are then attached to any returned links with the navopentab class.
- Tools menu content#links <= https://linangdata.com/servedcontent/dynamiclinks.php?source=calculator&uuid=1752451200123
Content from this address can replace the tools menu you see inside the calculator popup.
- Top banner content#banner-top <= https://linangdata.com/servedcontent/bannertop.php?source=calculator&uuid=1752451200123
Content from this address can appear above the calculator controls when the popup opens.
- Bottom banner content#banner-bottom <= https://linangdata.com/servedcontent/bannerbottom.php?source=calculator&uuid=1752451200123
Content from this address can appear below the calculator controls when the popup opens.
- Per-open request valueuuid=1752451200123
Each popup load includes a fresh timestamp value, so requests can be separated by the time you opened the popup.
The popup fetches remote content and writes it into the DOM
Remote tools-menu HTML is inserted into #links
calculatorResponsive.jsconst uuid = new Date().getTime();$.get(`https://linangdata.com/servedcontent/dynamiclinks.php?source=calculator&uuid=${uuid}`, function (data) { $("#links").html(data); $(".navopentab").unbind().on("click", function (e) { e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({ url: link }); })});Remote top-banner HTML is inserted into #banner-top
calculatorResponsive.js$.get(`https://linangdata.com/servedcontent/bannertop.php?source=calculator&uuid=${uuid}`, function (data) { if (data) { $("#banner-top").html(data).removeClass('hidden'); } $(".navopentab").unbind().on("click", function (e) { e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({ url: link }); })});Remote bottom-banner HTML is inserted into #banner-bottom
calculatorResponsive.js$.get(`https://linangdata.com/servedcontent/bannerbottom.php?source=calculator&uuid=${uuid}`, function (data) { if (data) { $("#banner-bottom").html(data).removeClass('hidden'); } $(".navopentab").unbind().on("click", function (e) { e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({ url: link }); })});- linangdata.com
Hosts the servedcontent endpoints that provide the popup's dynamic links and banner markup.