Is QR Code Reader safe?
QR Code Reader is medium risk. Each popup open, the extension requests JSON config from dsnetx.web.app. The server can return arbitrary HTML, rendered via jQuery notify or alert(), unsanitized. A fallback fires if the primary fails; version is sent as a URL parameter.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension fetches remotely-controlled notification config on every popup open
Each popup open, the extension requests JSON config from dsnetx.web.app.
The server can return arbitrary HTML, rendered via jQuery notify or alert(), unsanitized.
A fallback fires if the primary fails; version is sent as a URL parameter.
You open the QR Code Reader popup.
No QR code scanning action is required, the fetch fires on popup load.
The extension fetches a notification config from a remote server and renders any returned HTML content directly in the popup.
The response is parsed as JSON and displayed via jQuery notify or browser alert() with no validation of content or server identity.
Notification fetch and render logic in scripts/shared.js
const NOTIFICATION_ENDPOINTS = [
"https://dsnetx.web.app/apps/firelinks/msg.json",
"https://dsnet.bitbucket.io/apps/ext/msg/msg.json"
];
function fetchNotificationConfig() {
const url = `${NOTIFICATION_ENDPOINTS[endpointIndex]}?ref=${APP_ID}&r=${Math.random()}`;
fetch(url, { cache: "no-store" })
.then(res => res.json())
.then(data => {
if (isEmpty(data)) {
endpointIndex++;
if (endpointIndex < NOTIFICATION_ENDPOINTS.length) setTimeout(fetchNotificationConfig, 100);
} else {
endpointIndex = 0;
processMessages(data);
}
})
.catch(err => { /* retry fallback */ });
}function displayNotification(msg) {
const type = msg.typeNotif || "WEBUI";
if (type === "WEBALERT") {
alert(`${msg.title}: ${msg.msg}`);
} else {
// Renders msg.msg as HTML in the popup via jQuery notify
// No sanitization, no signature check
$.notify(msg.msg, { autoHide: !msg.autoclose, style: "bootstrap-html" });
}
}- dsnetx.web.app
Primary notification config endpoint hosted on Google Firebase. Returns JSON controlling what messages are shown to users. Developer-operated.
- dsnet.bitbucket.io
Fallback notification config endpoint hosted on Atlassian Bitbucket Pages. Queried if the primary Firebase endpoint fails.
Config fetch fires automatically every time the popup opens, no user interaction beyond opening the extension is required. Time-gating restricts display to hours 7-22 local time, but the network request itself occurs regardless of time.