Is 企业背景信息查询 safe?

Medium risk

企业背景信息查询 fetches a config from files.xiaolvji.com and applies its network rules and tab URLs during searches.

The extension downloads a configuration from files.xiaolvji.com and installs the network rewrite rules it contains across all sites around each company search, then removes them after about 20 seconds. The same configuration can supply a URL that the extension opens in an extra background tab during searches, and it drives scripted input and clicks on search tabs. The rules and URLs are not restricted to an allowlist of domains or action types.

TianWangLiJingv14.829.67.10Chrome Web Store
56Risk
Who publishes it

TianWangLiJing - 10 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
TianWangLiJing

Same store account

10 other listings published from this account, 20k+ users between them. 6 of them carry a finding.

网盘资源全网搜10k+Medium电子书全网搜8k+Medium%E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A21k+Medium划词搜索668Low购物比价原站全网搜193Medium在线译霸「AI inside」119Medium4 more listings in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

webglreport.com
Also called by 2 other listings, including RoAvatar - Roblox Avatar Editor Improved

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search add-on installs network rules supplied by a remote server on every site

Code analysis shows the extension fetches rule definitions from files.xiaolvji.com and installs them as browser-wide network rules around each search.

We did not observe the server returning rules.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You run a multi-engine search from the extension popup.

The extension did this

The extension adds server-supplied network rules that can redirect, block or alter headers on any site.

The code that does this

Rule list built from server config, then installed

Readable version

Rule list built from server config

// ruleList = userConfigData.csl + each engine's networkRules// only id and priority are overwritten; action type and domain are not checkedfor (const rule of userConfigData.csl ?? []) {  rule.id = nextId; rule.priority = 1;  seenUrlFilters.add(rule.condition.urlFilter);  ruleList.push(rule); nextId++;}for (const engine of userConfigData.zdy) {  if (engine[5] === 'executeScript' && Array.isArray(engine[6].networkRules)) {    for (const rule of engine[6].networkRules) {      rule.id = nextId; rule.priority = 1;      if (!seenUrlFilters.has(rule.condition.urlFilter)) { ruleList.push(rule); nextId++; }    }  }}

Rules installed before each search

// replaces all existing dynamic rules with the server-derived listconst ids = (await getDynamicRules()).map(r => r.id);await updateDynamicRules({ addRules: ruleList, removeRuleIds: ids });runSearch(); clearRulesAt = now + 20000;
Config keys that feed the rules
  • Config endpoint
    files.xiaolvji.com/addonUpdateLast.php

    Server the extension asks for its settings.

  • userConfigData.csl
    [{condition:{urlFilter:...}, action:{...}}]

    Rule objects installed as given.

  • engine networkRules
    enginesData[*][6].networkRules

    Per-engine rules, read when the engine type is executeScript.

  • Rule lifetime
    f = t + 2e4

    Rules are cleared about 20 seconds after each search.

Reproduce it yourself

Run in the extension service worker console after a search to list the dynamic rules it installed.

Requires
  • Chrome with the extension installed
check_dnr_rules.js · js
chrome.declarativeNetRequest.getDynamicRules(rules => {  console.log(rules.length + ' dynamic rules');  console.log(JSON.stringify(rules, null, 2));});
How to run it
  1. 1Open chrome://extensions and inspect the service worker.
  2. 2Run a multi-engine search from the popup.
  3. 3Paste the script in the console within 20 seconds and review the rules.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Search add-on opens a server-supplied URL in a background tab during searches

Code analysis shows a URL from the remote config (key glj) is opened in an inactive tab during multi-engine searches when the current time is inside a server-set window.

We did not observe the server returning one.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You run a multi-engine search while a server-set time window is active.

The extension did this

The extension opens a URL chosen by the server in an extra inactive tab in your window.

The code that does this

glj lookup and tab creation

Readable version
const { glj } = await storage.get(['glj']);const now = Date.now();const list = glj?.[lang];if (Array.isArray(list) && list.length) {  const entry = list[now % list.length];  if (entry?.data && now >= entry.st && now < entry.et) {    chrome.tabs.create({ windowId: win.id, url: entry.data, active: false, index: tabs.length });  }}
Fields of a glj entry
  • data
    https://example.com/landing (illustrative)

    The address opened in the extra tab.

  • st
    1767225600000 (illustrative)

    Start of the window, in milliseconds since 1970.

  • et
    1769904000000 (illustrative)

    End of the window; no tab opens after this time.

  • Source
    files.xiaolvji.com/addonUpdateLast.php

    Config endpoint that supplies glj.

Check if you're affected

Run in the extension service worker console to print the stored glj entries and log tabs created during a search.

Requires
  • Chrome with the extension installed
watch_glj_tabs.js · js
chrome.storage.local.get(['glj'], r => console.log(JSON.stringify(r.glj, null, 2)));chrome.tabs.onCreated.addListener(t => console.log('tab created', t.pendingUrl || t.url, 'active=' + t.active));
How to run it
  1. 1Inspect the extension service worker.
  2. 2Paste the script.
  3. 3Run a multi-engine search from the popup and watch the console.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 14.829.67.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Add items to the right-click menu

    contextMenus

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed 企业背景信息查询 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • files.xiaolvji.comwidely used

    企业背景信息查询 sends data to files.xiaolvji.com. A widely used service: 25 other extensions we have analysed send data here.

Updated 15 October 2026nbmanellifpebiiimmpgnbobgmjmmjkm