Is Helper Tools for ASOS: price checker safe?
Helper Tools for ASOS fetches affiliate settings from getrates.su and appends them to clicked ASOS links by default.
On ASOS pages, the extension downloads an affiliate parameter from getrates.su and adds it to banner and product links when the user clicks them unless the hidden helpus setting is off. It also reads the ASOS product ID from product pages, compares prices across regional ASOS API responses, and sends the product ID plus computed percentage spread to getrates.su when the spread is above 40%.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ASOS Links Get a Remote-Configured Affiliate Tag by Default
Clicking certain ASOS links or banners appends an affiliate string to the URL, fetched from getrates.su/rates.php and cached.
On by default; the off toggle is commented out.
A seeded marker confirmed the append.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You click a promotional link on an ASOS page, such as the homepage banner or the '.srMPwPy' module.
The extension appends an affiliate query string, fetched earlier from getrates.su and cached locally, to the link's destination URL before the browser navigates.
This runs for every matching click by default. The popup's opt-out toggle is commented out in the shipped HTML, so there is no visible way to disable it.
- Affiliate publisher IDpubref=wizKxmN8no4
Identifies which affiliate account is credited for the resulting ASOS visit or purchase.
- Affiliate network IDAFFID=26430
A second tracking identifier appended alongside the publisher ID.
- Promo codepromo=1257641
A promotional/campaign code bundled into the same query string.
- Destination URLhttps://www.asos.com/women/new-in/cat/?cid=27108&ctaref=10offnewcustomer|globalbanner|ww
The ASOS page the click was already headed to; the affiliate string is appended to whatever query string this URL already has.
The code that fetches the remote affiliate config and rewrites outbound link clicks.
Periodic config fetch
function update() { chrome.storage.local.get('last_update', function (result) { const lastUpdate = result.last_update; const now = Math.floor(Date.now() / 1000); const effectiveLastUpdate = (lastUpdate === undefined) ? now - 14000 : lastUpdate; // Refresh at most once per ~3.7 hours (13200s) if (effectiveLastUpdate < now - 13200) { getJSON('https://getrates.su/rates.php', function (err, response) { if (err === null) { console.log('Updated'); chrome.storage.local.set({ last_update: now }); chrome.storage.local.set({ rates: response }); // response.phref is the affiliate string } }); } });}update();setInterval(update, 10000000); // polls every ~2.8 hoursLink-click href rewrite
$(function () { chrome.storage.local.get('rates', function (result) { let phref; if (result.rates === undefined || result.rates.phref === undefined) { phref = ''; console.log('used old'); } else { phref = result.rates.phref; } if (window.location.href.indexOf('asos') + 1) { chrome.storage.local.get('helpus', function (result) { // helpus defaults to true whenever it has never been explicitly set const helpus = (result.helpus === undefined) || result.helpus; if (!helpus) phref = ''; // Rewrite the destination href on click, before default navigation happens $('#globalBannerComponent').on('click', 'a', function () { this.href += (this.href.indexOf('?') + 1 ? '&' : '?') + phref; }); $('.srMPwPy').on('click', 'a', function () { this.href += (this.href.indexOf('?') + 1 ? '&' : '?') + phref; }); }); } });});- getrates.su
Serves the affiliate string (publisher ID, network ID, promo code) merged into ASOS link clicks. Cached and reused until refresh, so the credited ID can change remotely.
Paste into the extension's service worker console to see the currently cached affiliate string and opt-out flag, then click a banner link on asos.com and compare the link's href before and after the click.
- Chrome with Developer mode enabled
// asos-affiliate-tag-inspector.js// Paste into the extension's service worker DevTools console// (chrome://extensions -> Developer mode -> service worker link for this extension).chrome.storage.local.get(['rates', 'helpus'], (result) => { console.log('[ASOS_HELPER] cached rates.phref:', result.rates && result.rates.phref); console.log('[ASOS_HELPER] helpus (opt-out flag) raw value:', result.helpus); console.log('[ASOS_HELPER] effective helpus (true = rewrite enabled):', result.helpus === undefined || result.helpus);});- 1Install and visit asos.com once.
- 2Open chrome://extensions, enable Developer mode, click the service worker link.
- 3Paste the script into the console; note the phref.
- 4Compare a banner link's href to the navigated URL.
What it can do
Permissions this extension asks for, as declared in version 2.5.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on asos.com
*://*.asos.com/*
Read and change your data on asos.de
*://*.asos.de/*
Read and change your data on asos.su
*://*.asos.su/*
Read and change your data on asos.fr
*://*.asos.fr/*
Read and change your data on getrates.su
https://*.getrates.su/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Helper Tools for ASOS: price checker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- getrates.su
Helper Tools for ASOS: price checker sends data to getrates.su. No other extension we have analysed sends data here.