Is Maps & Driving Directions safe?

Medium risk

Maps & Driving Directions fetches remote HTML from its own server and injects it into the new tab page without sanitization.

On each new tab open, the extension requests HTML content from mapsdrivingdirections.net and renders it directly into the DOM via React's dangerouslySetInnerHTML, allowing the server to inject arbitrary markup or scripts. Additionally, every character typed into the extension's search bar is transmitted to the vendor's autosuggest endpoint in real time, with no debounce delay. Submitted search queries are also routed through the vendor's redirect endpoint when local storage has been cleared.

Maps & Driving Directionsv1.0.9Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Search input sent to autosuggest on each change

Typing in Maps & Driving Directions' new-tab search box updates search state and fires an autosuggest GET to mapsdrivingdirections.net, with the typed text as the q parameter, so partial terms are sent before you submit.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You type a search term into the extension's new-tab search UI.

This applies to both the header search box and the larger main search box.

The extension did this

The extension sends the current text to its autosuggest endpoint as the q parameter.

The code path runs when the search value changes and skips only the empty-string case.

02EvidenceFIELD TABLE
Fields in the autosuggest request
FieldValueWhy it matters
Current search text
coffee near union stationThe words you are typing can reveal a destination, address fragment, business name, or other search interest before you press Enter.
Autosuggest query parameter
q=coffee%20near%20union%20stationThe current text is placed into the web address sent to the suggestion service.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://mapsdrivingdirections.net/extension/public/autosuggest?q=coffee%20near%20union%20station
04EvidenceCODE COMPARE
The code that does this

The search inputs feed state that immediately drives autosuggest requests

What it actually does
Header search state and autosuggest requeststatic/js/main.1e7c191f.chunk.js
var C = function (e) {
  var t = Object(c.useState)(""),
    n = Object(o.a)(t, 2),
    s = n[0],
    A = n[1];

  Object(c.useEffect)(
    function () {
      de();
    },
    [s]
  );

  var de = function () {
    countTop = 0;
    0 !== s.length
      ? r.a.getJSON("https://mapsdrivingdirections.net/extension/public/autosuggest?q=" + encodeURIComponent(s), function (e) {
        var t;
        e.gossip.results.length > 0 && r()("#topbarsearch").val() ? r()(".search-border1").addClass("expand-search1") : r()(".search-border1").removeClass("expand-search1"),
          r()("#topbarsearch").blur(function () {
            r()(".search-border1").removeClass("expand-search1");
          }),
          ee(e.gossip.results);
        r()("#topbarsearch").keydown(function (e) {
          var n = r()(".pointerCursor");
          if (40 === e.which)
            if (t) {
              t.removeClass("active");
              var c = t.next();
              c.length > 0
                ? ((t = c.addClass("active")), (document.getElementById("topbarsearch").value = 0 === document.getElementById("topbarsearch").value.length ? "" : t[0].innerText))
                : ((t = n.first().addClass("active"))[0] && (document.getElementById("topbarsearch").value = 0 === document.getElementById("topbarsearch").value.length ? "" : t[0].innerText));
            } else (t = n.first().addClass("active"))[0] && (document.getElementById("topbarsearch").value = 0 === document.getElementById("topbarsearch").value.length ? "" : t[0].innerText);
          else if (38 === e.which)
            if (t) {
              t.removeClass("active");
              var s = t.prev();
              s.length > 0
                ? ((t = s.addClass("active")), (document.getElementById("topbarsearch").value = 0 === document.getElementById("topbarsearch").value.length ? "" : t[0].innerText))
                : ((t = n.last().addClass("active"))[0] && (document.getElementById("topbarsearch").value = 0 === document.getElementById("topbarsearch").value.length ? "" : t[0].innerText));
            } else (t = n.last().addClass("active"))[0] && (document.getElementById("topbarsearch").value = 0 === document.getElementById("topbarsearch").value.length ? "" : t[0].innerText);
          else if (13 === e.which) {
            if (countTop == 0) {
              return;
            } else {
              countTop++;
            }
            const topSearch = document.getElementById("topbarsearch").value;
            if (topSearch) {
              chrome.storage.local.get(['date'], results => {
                if (results && results.date) {
                  executeSearch(topSearch, 'chrome');
                } else {
                  handlesuggestions(e, topSearch);
                }
              });
            }
          }
        });
      })
      : ee([]);
  };
};
Header input assigns typed text to that statestatic/js/main.1e7c191f.chunk.js
Object(b.jsx)("input", {
  list: "topbar_autosearch",
  id: "topbarsearch",
  autoComplete: "off",
  type: "search",
  placeholder: "Search",
  "aria-label": "Search",
  onChange: (function () {
    var e = Object(d.a)(
      h.a.mark(function e(t) {
        return h.a.wrap(function (e) {
          for (; ;)
            switch ((e.prev = e.next)) {
              case 0:
                A(t.target.value);
              case 1:
              case "end":
                return e.stop();
            }
        }, e);
      })
    );
    return function (t) {
      return e.apply(this, arguments);
    };
  })()
})
Main search state and autosuggest requeststatic/js/main.1e7c191f.chunk.js
var y = function (e) {
  var t = Object(c.useState)(""),
    n = Object(o.a)(t, 2),
    s = n[0],
    A = n[1];

  Object(c.useEffect)(
    function () {
      count = 0;
      !(function () {
        var e;
        0 !== s.length
          ? m.a
            .get("https://mapsdrivingdirections.net/extension/public/autosuggest?q=" + encodeURIComponent(s))
            .then(function (t) {
              var n,
                c = t.data;
              c.toString().includes("Server Error:") ||
                (c.gossip.results.length > 0 && r()("#mainsearch").val() ? r()(".search-border").addClass("expand-search") : r()(".search-border").removeClass("expand-search"),
                  r()("#mainsearch").blur(function () {
                    r()(".search-border").removeClass("expand-search");
                  }),
                  M(c.gossip.results),
                  r()("#mainsearch").keydown(function (t) {
                    var e = r()(".main_search_autocomplete_item")
                    if (40 === t.which)
                      if (n) {
                        n.removeClass("active");
                        var c = n.next();
                        c.length > 0
                          ? (n = c.addClass("active"))[0] && (document.getElementById("mainsearch").value = 0 === document.getElementById("mainsearch").value.length ? "" : n[0].innerText)
                          : (n = e.first().addClass("active"))[0] && (document.getElementById("mainsearch").value = 0 === document.getElementById("mainsearch").value.length ? "" : n[0].innerText);
                      } else (n = e.first().addClass("active"))[0] && (document.getElementById("mainsearch").value = 0 === document.getElementById("mainsearch").value.length ? "" : n[0].innerText);
                    else if (38 === t.which)
                      if (n) {
                        n.removeClass("active");
                        var s = n.prev();
                        s.length > 0
                          ? (n = s.addClass("active"))[0] && (document.getElementById("mainsearch").value = 0 === document.getElementById("mainsearch").value.length ? "" : n[0].innerText)
                          : (n = e.last().addClass("active"))[0] && (document.getElementById("mainsearch").value = 0 === document.getElementById("mainsearch").value.length ? "" : n[0].innerText);
                      } else (n = e.last().addClass("active"))[0] && (document.getElementById("mainsearch").value = 0 === document.getElementById("mainsearch").value.length ? "" : n[0].innerText);
                    else if (13 === t.which) {
                      if (count === 0) {
                        return;
                      } else {
                        count++;
                      }
                      const mainsearch = document.getElementById("mainsearch").value;
                      if (mainsearch) {
                        chrome.storage.local.get(['date'], results => {
                          if (results && results.date) {
                            executeSearch(mainsearch, 'chrome');
                          } else {
                            handlesuggestions(e, mainsearch);
                          }
                        });
                      }
                    }
                  }));
            })
            .catch(function (e) {
              return console.log(e);
            })
          : M([]);
      })();
    },
    [s]
  );
};
Main input assigns typed text to that statestatic/js/main.1e7c191f.chunk.js
Object(b.jsx)("input", {
  id: "mainsearch",
  type: "search",
  placeholder: "Search or type a URL",
  ref: g,
  autoFocus: !0,
  autoComplete: "off",
  "aria-label": "Search or type a URL",
  onChange: (function () {
    var e = Object(d.a)(
      h.a.mark(function e(t) {
        return h.a.wrap(function (e) {
          for (; ;)
            switch ((e.prev = e.next)) {
              case 0:
                A(t.target.value);
              case 1:
              case "end":
                return e.stop();
            }
        }, e);
      })
    );
    return function (t) {
      return e.apply(this, arguments);
    };
  })()
})
05EvidenceTHIRD PARTY LIST
Destination for the autosuggest request
  • mapsdrivingdirections.net

    Receives the search-box text as the q parameter and returns autocomplete suggestions consumed by the extension UI.

Data recipients

mapsdrivingdirections.net
Updated 17 September 2026hjfiefolgakpndodphcgjllcojieoaak