Is ebay Sold History, Offer History - Average High Mid Low Price - eBextractor safe?
eBextractor sends eBay purchase-history page HTML and page cookies to wcawasa.pythonanywhere.com when local parsing fails.
On supported eBay item and search pages, eBextractor analyzes sold and offer history in the page. If its local sold-history parser reports errors, it posts the purchase-history HTML and attempted page cookies to wcawasa.pythonanywhere.com; it also sends eBay search page URLs to the same service as the sidebar loads.
Who publishes iteBex - no other listings under this identity
eBex - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
eBay purchase-history fallback posts page HTML remotely
Analyze sold history fetches eBay's purchase-history page for the item and parses it client-side.
On a parse error, the fallback posts that HTML to wcawasa.pythonanywhere.com/api/sold-history with document.cookie in a Cookie header.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You ask the extension to analyze sold history for an eBay item.
The shipped content scripts run this feature on supported eBay search, item, and purchase-history pages.
If the local sold-history parser reports an error, the extension sends the fetched purchase-history HTML to its fallback API.
The same fallback request is constructed with the eBay page's cookie string in a `Cookie` header.
The code treats a successful response as JSON containing sold-history and offer-history results.
- Cookie
- document.cookie
- Content-Type
- application/json
- Purchase-history page HTML<html><body><div class="app-table fixed-price"><table class="app-table__table"></table></div></body></html> (illustrative)
This is the eBay page content for the item you asked the extension to analyze.
- eBay page cookie stringebay=%5Ejs%3D1%5Esbf%3D0%5E (illustrative)
This can identify your browser's eBay page context if the browser allows that header to be sent.
- Selected item's history URLhttps://www.ebay.com/bin/purchaseHistory?item=325680123456 (illustrative)
This ties the fallback processing to the specific eBay item you chose to inspect.
Shipped fallback path for sold-history parsing errors
Remote sold-history fallback request
content-search-ui/index.iife.jsstatic async getItemHistoryByIdViaApi(html) { const pageCookies = document.cookie; try { const response = await fetch(this.BASE_API + "/sold-history", { method: "POST", headers: { "Content-Type": "application/json", Cookie: pageCookies, }, body: JSON.stringify({ htmlContent: html }), }); return response.ok ? { data: await response.json(), success: true, message: "Success", error: null, errorDescription: null, status: 200, } : { data: null, success: false, message: "Error Occured", error: "Error Type: sold-history/local", type: "captcha", errorDescription: "Error fetching sold history - if this persists you can try Clicking `Go to sold history page` as ebay implements captcha", status: 500, }; } catch { return { data: null, success: false, message: "Error Occured", error: "Error Type: sold-history/local", type: "eBextractor api", errorDescription: "Error fetching sold history", status: 500, }; }}Local parse, then fallback when errors are present
content-search-ui/index.iife.jsstatic async fetchSoldAndOfferHistory(origin, itemId) { try { const pageCookies = document.cookie; const historyResponse = await fetch(`${origin}/bin/purchaseHistory?item=${itemId}`, { method: "GET", headers: { Cookie: pageCookies }, }); const html = await historyResponse.text(); if (historyResponse.ok) { console.log("fetching---sold-history--locally"); const parsed = iE(html); if (parsed.errors.length > 0) { console.group("๐ Fetching --- Analysis --- Locally --- Error"); console.table(parsed.errors); console.groupEnd(); console.group("fetching---sold-history--via-api as it failed locally"); const fallback = await this.getItemHistoryByIdViaApi(html); console.log(fallback); console.groupEnd(); return fallback; } fetch(this.BASE_API + "/traffic", { method: "POST", keepalive: true, headers: { "Content-Type": "application/json", path: "/api/sold-history", }, body: JSON.stringify({ url: window.location.href }), }); const localResult = { data: parsed, success: true, message: "Success", error: null, errorDescription: null, status: 200, }; console.log(localResult); console.groupEnd(); return localResult; } console.log("getting htmlContent for sold-history failed,, it might be because of sign-in or captcha"); return { data: null, success: false, message: "Error Occured", type: "sign-in", error: "Error Type: sign-in", errorDescription: "You need to sign-in on ebay", status: 500, }; } catch { return { data: null, success: false, message: "Error Occured", type: "sign-in", error: "Error Type: sign-in", errorDescription: "You need to sign-in on ebay", status: 500, }; }}Fallback API base host
content-search-ui/index.iife.jsAd.BASE_API = "https://wcawasa.pythonanywhere.com/api";Parser errors are the condition that triggers the remote fallback
function parseSoldAndOfferHistory(html) { const errors = []; try { if (!html) { return { sold_history: [], offer_history: [], item_details: {}, errors }; } const documentHtml = new DOMParser().parseFromString(html, "text/html"); const itemDetails = {}; const details = documentHtml.querySelector("dl.app-item-card__details"); if (details) { const labels = details.querySelectorAll("dt"); const values = details.querySelectorAll("dd"); labels.forEach((label, index) => { const key = label.textContent?.trim(); const value = values[index]?.textContent?.trim(); if (key && value) itemDetails[key] = value; }); } const soldTable = documentHtml.querySelector("div.app-table.fixed-price table.app-table__table"); const offerTable = documentHtml.querySelector("div.app-table.offer table.app-table__table"); if (!soldTable && !offerTable) { errors.push("Offer or sold history table not found | Maybe the page structure has changed"); } const soldHistory = d0(soldTable); const offerHistory = d0(offerTable); return { sold_history: soldHistory, offer_history: offerHistory, item_details: itemDetails, errors }; } catch (error) { console.error("Error processing item history:", error); errors.push(`Unexpected error: ${error instanceof Error ? error.message : String(error)}`); return { sold_history: [], offer_history: [], item_details: {}, errors }; }}- wcawasa.pythonanywhere.com
Receives the `/api/sold-history` fallback POST for remote parsing of eBay purchase-history HTML.
Where it sends data
Destinations our analysis observed ebay Sold History, Offer History - Average High Mid Low Price - eBextractor contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- wcawasa.pythonanywhere.com
ebay Sold History, Offer History - Average High Mid Low Price - eBextractor sends data to wcawasa.pythonanywhere.com. No other extension we have analysed sends data here.