Is Pague Menos Be!Tech safe?

// isFlowActive(pageHtml, flow) - decides whether this page matches a
// server-defined "flow" and, if so, resolves its fields.
async function isFlowActive(pageHtml, flow) {
  if (!flow.ativo) return null;                    // server can toggle a flow on/off
  const urlPattern = new RegExp(flow.url, "i");
  return urlPattern.test(pageHtml) ? await resolveFields(flow) : null;
}

// resolveFields(flow) - walks every field the server listed, retrying up
// to 5 times (module-level counter) if under half resolve.
async function resolveFields(flow) {
  const fields = flow.data || [];
  const resolved = {};
  let total = 0, hits = 0;
  for (const field of fields) {
    total++;
    const value = await resolveOneField(field);
    resolved[field.nome] = value;
    if (value) hits++;
  }
  return (hits * 100 / total < 50 && retriesLeft) ? retryAfterDelay(flow) : resolved;
}

// resolveOneField(field) - the extraction dispatcher. `field` is an object
// the server sent in retrieve-store-data; exactly one of these four keys
// selects the method.
async function resolveOneField(field) {
  let value = null;
  if (field.script_selector) value = await readScriptTagJson(field);  // JSON in a <script> tag
  if (field.script_var)      value = await readPageGlobal(field);     // window[name], via the page bridge
  if (field.selector)        value = await readSelectorText(field);  // jQuery/Sizzle text
  if (field.regex)           value = await readRegexMatch(field);    // raw HTML regex match
  // value_regex / value_remove_rule / value_cast post-processing omitted here
  return value;
}

const readRegexMatch = (field) => runRegexTemplate(null, field.regex, field.regex_output);

// readScriptTagJson(field) - parses a <script> tag's JSON body located by
// a server-supplied CSS selector, then walks a server-supplied key path.
async function readScriptTagJson(field) {
  try {
    const tag = document.querySelector(field.script_selector);
    const json = JSON.parse(tag?.textContent || "");
    return getByPath(json, field.script_path);
  } catch { return null; }
}

// readPageGlobal(field) - asks the page-context bridge for window[name],
// where `name` is the server-supplied `script_var` string. Not limited to
// data the extension itself put there.
async function readPageGlobal(field) {
  const mode = field.script_btc_anatam;  // e.g. "find|key=value"
  let record = {};
  if (mode) {
    const [op, filter] = mode.split("|");
    if (op === "find") {
      const [key, expected] = filter.split("=");
      const candidates = await callPageBridge({ variableName: field.script_var });
      record = candidates.find(c => expected === undefined ? c[key] : c[key] == expected) || {};
    }
  }
  return getByPath(record, field.script_path);
}

// readSelectorText(field) - jQuery/Sizzle text extraction from any element.
async function readSelectorText(field) {
  const el = $(field.selector);
  return el.length ? el.first().text() : null;
}

// The page-side bridge listens for <ev> elements the content script
// appends to a hidden <evlist> node, keyed by a command name.
const commandTable = {
  clickElement:      simulateClick,
  scrollToElement:   scrollIntoView,
  readPageGlobal:    readWindowVariable,   // reads window[name]
  readCookieByName:  readCookieByName,     // reads document.cookie
  waitForElement:    waitForSelector
};

const handler = commandTable[command.name];

if (handler) {
  const args = JSON.parse(command.argsJson);
  handler(args).then(result => {
    const payload = (result && result.value) ? JSON.stringify(result.value) : 1;
    commandElement.setAttribute('result', payload);   // content script reads this back
  });
}

// Reads an arbitrary global off the real page `window` object - not
// scoped to anything the extension itself defined.
function readWindowVariable({ name }) {
  return new Promise(resolve => {
    const value = window[name];
    resolve(value ? { value } : null);
  });
}

// Reads one cookie by name from the live page's document.cookie.
function readCookieByName({ name }) {
  return new Promise(resolve => {
    const pieces = `; ${document.cookie}`.split(`; ${name}=`);
    const value = pieces.length === 2 ? pieces.pop().split(';').shift() : null;
    resolve(value ? { value } : null);
  });
}

// Monkey-patches XMLHttpRequest on every page so that every request body
// sent by the PAGE (not the extension) is cached in a page-global object,
// keyed by the request URL, for later retrieval.
function installXhrBodyCapture() {
  const originalOpen = XMLHttpRequest.prototype.open;
  const originalSend = XMLHttpRequest.prototype.send;

  window.__capturedXhrBodies = {};

  XMLHttpRequest.prototype.open = function(method, url) {
    this.__requestUrl = url;
    originalOpen.apply(this, arguments);
  };

  XMLHttpRequest.prototype.send = function(body) {
    if (body) {
      window.__capturedXhrBodies[this.__requestUrl] = body;
    }
    originalSend.apply(this, arguments);
  };
}
installXhrBodyCapture();