Is QR Code Reader safe?
QR Code Reader is medium risk. Each popup open, the extension requests JSON config from dsnetx.web.app. The server can return arbitrary HTML, rendered via jQuery notify or alert(), unsanitized. A fallback fires if the primary fails; version is sent as a URL parameter.
Who publishes itQRExt - 7 other listings from the same operator, 4 of them carrying a finding
QRExt - 7 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 70k+ users between them, none of them carrying a finding.
Same operator - 6 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension fetches remotely-controlled notification config on every popup open
Each popup open, the extension requests JSON config from dsnetx.web.app.
The server can return arbitrary HTML, rendered via jQuery notify or alert(), unsanitized.
A fallback fires if the primary fails; version is sent as a URL parameter.
You open the QR Code Reader popup.
No QR code scanning action is required, the fetch fires on popup load.
The extension fetches a notification config from a remote server and renders any returned HTML content directly in the popup.
The response is parsed as JSON and displayed via jQuery notify or browser alert() with no validation of content or server identity.
Notification fetch and render logic in scripts/shared.js
const NOTIFICATION_ENDPOINTS = [
"https://dsnetx.web.app/apps/firelinks/msg.json",
"https://dsnet.bitbucket.io/apps/ext/msg/msg.json"
];
function fetchNotificationConfig() {
const url = `${NOTIFICATION_ENDPOINTS[endpointIndex]}?ref=${APP_ID}&r=${Math.random()}`;
fetch(url, { cache: "no-store" })
.then(res => res.json())
.then(data => {
if (isEmpty(data)) {
endpointIndex++;
if (endpointIndex < NOTIFICATION_ENDPOINTS.length) setTimeout(fetchNotificationConfig, 100);
} else {
endpointIndex = 0;
processMessages(data);
}
})
.catch(err => { /* retry fallback */ });
}function displayNotification(msg) {
const type = msg.typeNotif || "WEBUI";
if (type === "WEBALERT") {
alert(`${msg.title}: ${msg.msg}`);
} else {
// Renders msg.msg as HTML in the popup via jQuery notify
// No sanitization, no signature check
$.notify(msg.msg, { autoHide: !msg.autoclose, style: "bootstrap-html" });
}
}- dsnetx.web.app
Primary notification config endpoint hosted on Google Firebase. Returns JSON controlling what messages are shown to users. Developer-operated.
- dsnet.bitbucket.io
Fallback notification config endpoint hosted on Atlassian Bitbucket Pages. Queried if the primary Firebase endpoint fails.
Config fetch fires automatically every time the popup opens, no user interaction beyond opening the extension is required. Time-gating restricts display to hours 7-22 local time, but the network request itself occurs regardless of time.
What it can do
Permissions this extension asks for, as declared in version 2.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Store an unlimited amount of data in your browser
unlimitedStorage
Store data in your browser
storage
Add items to the right-click menu
contextMenus
Run its own code inside the pages you visit
scripting