Is 学术资源全网搜索 safe?

Clean risk

学术资源全网搜索 sends selected page text or URLs to configured search and AI services when you use its selection tools.

The extension runs on all sites and reads text, links, or image URLs you select after mouse or drag actions. It fetches engine configuration from files.xiaolvji.com and uses the selected content to open or fill configured services such as DeepSeek, Doubao, and ChatGPT.

TianWangLiJingv37.829.67.8Chrome Web Store
4Risk
Who publishes it

TianWangLiJing - 4 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
TianWangLiJing

Same store account

4 other listings published from this account, 11k+ users between them. 1 of them carries a finding.

网盘资源全网搜10k+Medium划词搜索668Low电影视频全网搜119Low「百度搜索」一键直达116Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search queries sent to xiaolvji.com in plaintext URL parameter

Dynamic analysis captured the extension sending your search query to xiaolvji.com in a plaintext URL, verbatim in `key=` on a GET to xiaolvji.com/link.php, confirmed twice with a canary.

Five code paths route the same way.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You type a search term in the extension popup and click a search engine button configured as `router_url` type.

The extension supports multiple search engine types; the `router_url` type routes the query through xiaolvji.com instead of navigating directly to the target engine.

The extension did this

The extension opens a new tab to www.xiaolvji.com with your full search keyword in the URL as a plaintext `key=` parameter.

A session signature (`ssid`) is computed from a base64 slice of the URL-encoded keyword; it is not a random token and does not obscure the query.

Captured request
GEThttps://www.xiaolvji.com/link.php?sid=2&tips=1rt44of&ssid=CSSFkQRTNbIuu97sczhg04vPCp8SfhxwpEw6AkiJ3DvNtyfGjXe&tn=1780865802611&key=<planted marker>

HTTP 200. Our dynamic analysis planted a canary keyword in the popup textarea and observed it returned verbatim in the key= URL parameter in two independent sessions (request IDs C62517269C4A4DE7EB1E6F0214A776C4 and 669FCF061FD132FBE56C04C4BBE7950F).

URL parameters sent to www.xiaolvji.com on every router_url search
  • Search keyword
    artificial+intelligence+research

    Your full search term, URL-encoded. Sent in plaintext, readable by the server and any network observer.

  • Engine ID
    sid=2

    Identifies which search engine entry you clicked. Associates your query with a specific configured engine on the developer's server.

  • Timestamp
    tn=1780865802611

    Millisecond-precision client-side timestamp, allowing the server to sequence queries per session.

  • Session signature (ssid)
    ssid=cmVzZWFyY2g

    Derived from the last 8 characters of the base64-encoded keyword, not a random token. Contains encoded keyword data.

The code that does this

router_url search path in js/15.js, keyword routed to xiaolvji.com

Readable version
else if ("router_url" == o[5]) {  chrome.tabs.query({ active: true, currentWindow: true }, function(tabs) {    let keyword = searchTerm;    if ("" === searchTerm) keyword = "typenosearchkeyword";    var encoded = encodeURIComponent(keyword),        timestamp = (new Date).getTime(),        // ssid = last 8 chars of btoa(encodedKeyword) — not random        signature = re(encoded, timestamp, 8),        url = "https://www.xiaolvji.com/linkaddon.php?sid=" + engineId              + "&key=" + encoded              + "&ssid=" + signature              + "&tn=" + timestamp;    chrome.tabs.create({ url: url, index: tabs[0].index + 1, active: isActive });  });}
Destination receiving search queries
    • www.xiaolvji.com

    Developer-operated server (xiaolvji.com is the extension's domain). Receives search queries via key= on every router_url search; hosts the config endpoint at files.xiaolvji.com.

What it can do

Permissions this extension asks for, as declared in version 37.829.67.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Add items to the right-click menu

    contextMenus

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed %E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A2 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chatgpt.comwidely used

    %E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A2 sends data to chatgpt.com. A widely used service: 37 other extensions we have analysed send data here.

  • files.xiaolvji.com

    %E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A2 sends data to files.xiaolvji.com. 8 other extensions we have analysed send data here.

  • chat.deepseek.com

    %E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A2 sends data to chat.deepseek.com. 6 other extensions we have analysed send data here.

  • www.doubao.com

    %E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A2 sends data to www.doubao.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026foidhijnndaakamhcnckjldopopionod