Is DocsWork Editor for documents DOC & DOCX safe?
DocsWork Editor sends every http(s) URL you visit, hex-encoded with a persistent ID, to stream.redcoolmedia.net.
On each tab activation or update, the background script reads the tab's full URL, including query strings, and sends it to stream.redcoolmedia.net along with a random 10-character ID stored locally. The hex encoding is plain character-code conversion and is trivially reversible. The only setting is an options checkbox labelled 'Edit Online', which does not mention URL reporting.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension sends the hex-encoded address of each page visited to redcoolmedia.net
Code analysis shows the background script sends each visited http(s) URL, hex-encoded with a persistent random ID, to stream.redcoolmedia.net on tab changes.
The only opt-out is an unrelated-sounding option.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You switch to or load any web page in the browser.
The extension requests stream.redcoolmedia.net with the page address hex-encoded and your install ID.
Pages whose address contains 'redco' and repeats of the last address are skipped.
- Visited page address6874747073...3d74657374 (hex of https://example.com/?q=test)
The full URL including any query string, in the l parameter.
- Install IDk3x9qa7mzt
A random 10-character ID kept in local storage and sent on every request.
- Encoding flaghex=1
Marks the address as hex, which is a reversible encoding, not encryption.
Request construction and encoding
URL filter
web.jsif ( ( tab.url.indexOf("redco") == -1 ) && ( tab.url.indexOf("http") !== -1 ) && ( lasiee != tab.url) ) { exx(tab.url); lasiee = tab.url;}Encoding
web.jsfunction bin2hex (bin) { var i = 0, l = bin.length, chr, hex = ''; for (i; i < l; ++i) { chr = bin.charCodeAt(i).toString(16) hex += chr.length < 2 ? '0' + chr : chr } return hex}- Default settingredcoolonline = "1"
redcoolonline defaults to 1, so reporting is on unless changed.
- Options checkboxEdit Online
The only opt-out is labelled 'Edit Online', which does not mention URL reporting.
- Server reply handlingapp-docwork.php?url=<hex>&u=<id>
A reply containing '302' makes the script try to navigate a tab to www.redcoolmedia.net.
- stream.redcoolmedia.net
Receives hex-encoded visited URLs and the install ID on each tab change.
- www.redcoolmedia.net
Target of the server-triggered navigation carrying the same URL and ID.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.4.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Where it sends data
Destinations our analysis observed DocsWork Editor for documents DOC & DOCX contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.redcoolmedia.net
DocsWork Editor for documents DOC & DOCX sends data to www.redcoolmedia.net. 16 other extensions we have analysed send data here.
- stream.redcoolmedia.net
DocsWork Editor for documents DOC & DOCX sends data to stream.redcoolmedia.net. 10 other extensions we have analysed send data here.