Is Rain Alarm Extension safe?
Rain Alarm is medium risk. Dynamic analysis confirmed Rain Alarm's service worker polls app.rain-alarm.com and shows any non-empty "message" field verbatim as a persistent notification until dismissed. No length check; a server change could push arbitrary text.
Who publishes itMichael Diener - Software - no other listings under this identity, 9 shared hostnames
Michael Diener - Software - no other listings under this identity, 9 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 9 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Rain Alarm API response controls persistent desktop notification text
Dynamic analysis confirmed Rain Alarm's service worker polls app.rain-alarm.com and shows any non-empty "message" field verbatim as a persistent notification until dismissed.
No length check; a server change could push arbitrary text.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
The rain-alarm.com API returns a JSON response containing a non-empty `message` field.
The message field is set server-side and delivered to all polling clients in the same response as rain proximity data.
The extension displays the server-supplied text verbatim as a persistent Chrome notification that stays on screen until dismissed.
chrome.notifications.create('rainalarmmessage', { message: serverMessage, requireInteraction: true }) is called with no modification to the server string.
JSON body includes proximity, area, strength, state, and optionally `message`. Our DA replay injected `message: 'SERVER_INJECTED_MSG_PROOF_TEST_12345'` and observed the extension call chrome.notifications.create with that exact string.
- Content-Type
- application/x-www-form-urlencoded
Server message rendered verbatim as persistent notification
// background3.js : 282-301var lastServerMessage = storage["lastServerMessage"];if (typeof lastServerMessage == "undefined") lastServerMessage = null;if ( serverMessage != null && serverMessage.length > 0 && ( lastServerMessage == null || lastServerMessage.length == 0 || serverMessage != lastServerMessage) ) { chrome.storage.local.set({lastServerMessage: serverMessage}); var time24 = getBoolean(storage["time24"], true); var opt = { type: "basic", title: i18n_app + " (" + getTime(new Date(), time24) + ")", message: serverMessage, // verbatim server string — no validation iconUrl: "/launcher.png", requireInteraction: true // pinned until user dismisses }; chrome.notifications.create("rainalarmmessage", opt);}Every 30 minutes
The RainProxy poll fires periodically via a chrome.alarms alarm named 'runService'. Default interval is 30 minutes (searchInterval setting × 10 minutes). Each poll cycle checks for a new server message and triggers a notification if the message field is populated and differs from the cached value.
- app.rain-alarm.com
Rain Alarm backend run by Martin Diener. Returns rain proximity data and an optional "message" field shown verbatim in Chrome notifications on every user's device.