Is DashBlox safe?

Question

Is DashBlox safe?

Accepted Answer

DashBlox is medium risk. When you open the DashBlox settings Privacy Policy on Roblox, the extension fetches markdown from a GitHub dev branch and renders it into the Roblox page. The fetched DOM content is converted to HTML and inserted without a sanitizer or allowlist, so the page depends on mutable remote content from raw.githubusercontent.com. When you open the DashBlox settings page on Roblox, the extension fetches its Privacy Policy Markdown from raw.githubusercontent.com and converts it into HTML inside the settings DOM. The content comes from a GitHub branch URL rather than from files packaged with the installed extension.

Is DashBlox - Improving Roblox safe?

Findings