Is Pretty HTML | CSS | XML safe?
Pretty HTML | CSS | XML loads links and banners from linangdata.com into its popup and opens them in new tabs.
Each time the popup opens, the extension requests link and banner content from linangdata.com and inserts the responses into the popup as HTML without sanitising it. Clicking the server-supplied links opens destination URLs chosen by that server in new tabs. The extension's manifest blocks inline scripts, which limits what injected content can do.
Who publishes itLinangData - 18 other listings from the same operator, 4 of them carrying a finding
LinangData - 18 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 232k+ users between them. 4 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Pretty HTML popup inserts linangdata.com HTML and opens server-chosen tabs
Code analysis shows the popup fetches HTML from linangdata.com on every open, inserts it unsanitised, and opens any link in it in a new tab.
The server decides what appears and where tabs go.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open the extension popup.
It requests HTML from linangdata.com and inserts it into the popup.
Clicking a link in that HTML opens its address in a new tab.
Remote HTML is written into the popup and its links open as tabs
Links request and tab handler
app.js $.get("https://linangdata.com/servedcontent/dynamiclinks.php?source=html-pretty", function (data) { if (data) { $("#links").html(data); // $(".moretools").addClass("d-block"); $(".moretools").removeClass("d-none"); $(".navopentab").unbind().on("click", function (e) { e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({ url: link }); }) } else { // $(".moretools").addClass("d-none"); }- dynamiclinks.phphttps://linangdata.com/servedcontent/dynamiclinks.php?source=html-pretty
Fills the links area of the popup with server-chosen markup.
- bannertop.phphttps://linangdata.com/servedcontent/bannertop.php?source=html-pretty
Fills the top banner area with server-chosen markup.
- bannerbottom.phphttps://linangdata.com/servedcontent/bannerbottom.php?source=html-pretty
Fills the bottom banner area with server-chosen markup.
- Tab destinationchrome.tabs.create({url: link})
The address of any .navopentab link in the response is opened in a new tab.
Manifest V3 with no custom CSP blocks inline script in the injected markup. Impact is limited to injected links, banner content and server-chosen tab navigation.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read whatever you have copied to your clipboard
clipboardRead
Write to your clipboard
clipboardWrite
Where it sends data
Destinations our analysis observed Pretty HTML contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- linangdata.comwidely used
Pretty HTML sends data to linangdata.com. A widely used service: 28 other extensions we have analysed send data here.