Is 电子书全网搜 safe?
电子书全网搜 fetches config from files.xiaolvji.com that sets network rules on all sites and opens extra tabs.
The extension is an e-book search tool that periodically requests a configuration from files.xiaolvji.com. That server reply supplies declarativeNetRequest rules the extension installs as dynamic rules across all sites during searches, without an action-type allowlist. It also supplies time-gated URL templates that the extension opens as extra background tabs, filled with the search keyword, when a multi-search runs.
Who publishes itTianWangLiJing - 10 other listings from the same operator, 6 of them carrying a finding
TianWangLiJing - 10 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 12k+ users between them. 6 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension installs network rules for all sites from a remote server reply
Code analysis shows the extension fetches rule lists from files.xiaolvji.com and installs them as browser network rules without checking what they do.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You run a multi-engine search from the extension popup.
The extension installs network rules that came from a remote server, covering every site.
The rules are cleared again shortly afterwards.
Config fetch and storage of server reply
Same code as shipped in the readable build
js/15.js })), void 0 !== n.news ? oe.set({ news: n.news }) : oe.remove("news"), void 0 !== n.ll ? oe.set({ ll: n.ll }) : oe.remove("ll"), void 0 !== n.xl ? oe.set({ xl: n.xl }) : oe.remove("xl"), void 0 !== n.glj ? oe.set({ glj: n.glj }) : oe.remove("glj"), void 0 !== n.di && n.di && chrome.storage.local.set({Rule list built from server data, no allowlist
Rules copied from csl and networkRules, only id and priority set
js/15.js const R = () => { re(function(e) { var t = e.userConfigData.zdy; let n = []; var i, a, o = [], s = []; let r = 1; for (i of n = void 0 !== e.userConfigData.csl ? e.userConfigData.csl : n) { var c = i; if (c.id = r, c.priority = 1, void 0 !== i.condition.urlFilter && "" !== i.condition.urlFilter) { let e = !1; for (var g of o) if (g === i.condition.urlFilter) { e = !0; break } e || o.push(i.condition.urlFilter) } s.push(c), r++ } for (a of t) if ("executeScript" === a[5] && void 0 !== a[6].networkRules && Array.isArray(a[6].networkRules) && 0 < a[6].networkRules.length) for (var f of a[6].networkRules) { var u, l = f; l.id = r; let e = !(l.priority = 1); for (u of o) if (void 0 !== f.condition.urlFilter && u === f.condition.urlFilter) { e = !0; breakRules passed to declarativeNetRequest
updateDynamicRules receives E.ruleList as is
js/15.js chrome.declarativeNetRequest.getDynamicRules(e => { e = e.map(e => e.id); chrome.declarativeNetRequest.updateDynamicRules({ addRules: E.ruleList, removeRuleIds: e }) }) } catch (e) {} } }); const O = () => { if (!U) try { var t = setTimeout(() => { var e = (new Date).getTime(); f <= e - 1e4 ? chrome.declarativeNetRequest.getDynamicRules(e => { e = e.map(e => e.id); chrome.declarativeNetRequest.updateDynamicRules({ addRules: [], removeRuleIds: e- files.xiaolvji.com
Serves addonUpdateLast.php, whose reply supplies the rule lists the extension installs.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Extension opens extra background tabs to URLs chosen by a remote server
Code analysis shows a server-supplied list can make the extension open extra tabs after a multi-search, with your search keyword placed in the URL.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You run a multi-engine search for a keyword.
If the server list has a live entry, a new background tab opens to its URL with your keyword inserted.
Tab opened from the glj entry
Entry picked by time modulo list length, keyword substituted for %s and %ds
js/15.js oe.get(["glj"], function(e) { var t, n = (new Date).getTime(); void 0 !== e.glj && void 0 !== e.glj[V] && Array.isArray(e.glj[V]) && 0 < e.glj[V].length && (t = e.glj[V].length, e = e.glj[V][n % t]) && void 0 !== e.data && void 0 !== e.st && void 0 !== e.et && e.data && n >= e.st && n < e.et && (t = encodeURIComponent(a), n = encodeURIComponent(t), e = e.data.replaceAll("%ds", n).replaceAll("%s", t), chrome.tabs.create({ windowId: f.id, url: e, active: !1, index: u.length }))- datahttps://example.com/s?q=%s (illustrative)
URL template the extension opens; the server decides the destination.
- st / et1767225600000 / 1769904000000 (illustrative)
Start and end times (ms) during which the entry is used.
- Search keywordrunning shoes (illustrative)
Your search words are placed into the URL when the tab opens.
- files.xiaolvji.com
Serves addonUpdateLast.php, whose glj field supplies the URL templates.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed 电子书全网搜 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- files.xiaolvji.comwidely used
电子书全网搜 sends data to files.xiaolvji.com. A widely used service: 25 other extensions we have analysed send data here.