Is 购物比价原站全网搜 safe?
The extension fetches remote rules and URLs from files.xiaolvji.com and applies them while running price-comparison searches.
On each multi-site search, the extension contacts files.xiaolvji.com and installs network rules supplied by that server as temporary dynamic rules, which can apply on any site. It also opens time-limited URLs from the same server in an extra background tab. Neither the rule contents nor the URLs are restricted by an allowlist in the code.
Who publishes itTianWangLiJing - 10 other listings from the same operator, 6 of them carrying a finding
TianWangLiJing - 10 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 20k+ users between them. 6 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Search add-on installs redirect and header rules supplied by its remote server
Code analysis shows the add-on fetches rule definitions from files.xiaolvji.com and installs them as browser network rules without checking what they do or which sites they cover.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You run a multi-engine search from the popup or keyboard shortcut.
The add-on installs network rules defined by a remote server before opening the search tabs.
Rule action and condition are taken from the server reply.
Remote rules are copied into the rule list
Only id and priority are overwritten
js/15.jsconst R = () => { se(function(e) { var t = e.userConfigData.zdy; let n = []; var i, a, o = [], s = []; let r = 1; // csl comes from the remote config reply; entries are used as-is for (i of n = void 0 !== e.userConfigData.csl ? e.userConfigData.csl : n) { var c = i; c.id = r, c.priority = 1; // only id and priority are overwritten s.push(c), r++ }Rules applied to every site
js/15.jschrome.declarativeNetRequest.getDynamicRules(e => { e = e.map(e => e.id); chrome.declarativeNetRequest.updateDynamicRules({ addRules: E.ruleList, removeRuleIds: e }, () => { p(n, i, a), f = t + 2e4, O() })})- files.xiaolvji.com
Config endpoint addonUpdateLast.php; its csl field supplies the network rules.
- Rule actionaction.type: redirect
Can redirect, block or change headers on matching requests.
- Rule conditioncondition.urlFilter: example.com
Chooses which sites and request types are affected.
- Lifetimef = t + 2e4
Rules are removed about 20 seconds after install, then re-added on the next search.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Search add-on opens an extra background tab to a URL chosen by its remote server
Code analysis shows each multi-search can open one more inactive tab, to a URL and time window set by the add-on's remote config, with no check on which site it is.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You run a multi-engine search and the add-on opens its search tabs.
If the remote config holds a live entry, one more tab opens in the background to its URL.
The tab is then discarded and moved to the end.
Stored remote key is used to open a tab
Config reply stores glj
js/15.jsvoid 0 !== n.glj ? ae.set({ glj: n.glj }) : ae.remove("glj") // n = reply from addonUpdateLast.phpTime-gated tab creation
js/15.jsae.get(["glj"], function(e) { var t, n = (new Date).getTime(); if (e.glj !== undefined && Array.isArray(e.glj[V]) && e.glj[V].length > 0) { t = e.glj[V].length; e = e.glj[V][n % t]; // pick an entry by current time if (e && e.data && n >= e.st && n < e.et) { chrome.tabs.create({ windowId: f.id, url: e.data, // URL from the server, no allowlist active: false, index: u.length }) } }})- files.xiaolvji.com
Config endpoint addonUpdateLast.php; its glj field supplies the URL and time window.
- datahttps://example.com/landing
The address that opens in the extra tab.
- st1760000000000
Start of the window in which the tab may open.
- et1762600000000
End of the window in which the tab may open.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 15.829.67.10. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Act on the current tab, but only after you click the extension
activeTab
See the address and title of every tab you have open
tabs
Add items to the right-click menu
contextMenus
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed 购物比价原站全网搜 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- files.xiaolvji.comwidely used
购物比价原站全网搜 sends data to files.xiaolvji.com. A widely used service: 25 other extensions we have analysed send data here.