Is Safety Redirector Pro safe?
Safety Redirector Pro is medium risk. Code analysis shows the background worker checks every page you navigate to against a rule list fetched from the vendor's server, and on a host match, redirects your tab to whatever URL that rule specifies, on any site.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension redirects any page you load per a remotely fetched rule list
Code analysis shows the background worker checks every page you navigate to against a rule list fetched from the vendor's server, and on a host match, redirects your tab to whatever URL that rule specifies, on any site.
You type or click a link to any http:// or https:// site.
The worker matches the host against a remotely supplied rule list and redirects your tab to that rule's target URL instead of the page you requested.
The redirect target, and whether it fires at all, is decided by whatever the vendor's server last returned, not by a fixed known-bad-site list.
The navigation hook and the redirect logic
chrome.webNavigation.onBeforeNavigate.addListener((tab) => {
ruleExists(tab, tab.url);
});
setTimeout(refreshRules, 2 * 86400000); // Refresh rules every 2 daysfunction ruleExists(tab, url) {
let testURL = prepareUrl(url);
chrome.storage.local.get(['rules', 'freq_track'], (result) => {
let rules = result.rules || {};
let freqTracks = result.freq_track ? JSON.parse(result.freq_track) : {};
for (const i in rules) {
let ruleData = JSON.parse(rules[i]);
let from = i.substr(0, i.indexOf('_'));
let regx = new RegExp('^' + from.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
if (regx.test(testURL)) {
let checkRule = true;
if (ruleData[3] === 'once' && freqTracks[i] !== undefined) checkRule = false;
if (ruleData[3] === 'per24') {
let checkDate = new Date();
checkDate.setHours(checkDate.getHours() - 24);
if ((new Date(freqTracks[i])) > checkDate) checkRule = false;
}
if (checkRule) {
let newUrl = (/^https?:\/\//.test(ruleData[0]) ? '' : 'http://') + ruleData[0];
chrome.tabs.update(tab.tabId, { url: newUrl });
}
break;
}
}
});
}| Field | Value | Why it matters | |
|---|---|---|---|
Site pattern | test.com | The host pattern this rule matches against, turned into a wildcard regex. | |
Redirect target | https://safe-test.com | The full URL your tab is sent to instead of the page you requested. | |
Frequency | per24 | How often this rule can fire again for the same host: once, or once per 24 hours. |
Refetches the rule list from the vendor's server every 2 days, in addition to on every browser startup.
Recreates the extension's rule-matching logic against a sample rule list so you can see which hosts would trigger a redirect.
// rule-match-demo.js
// Recreates ruleExists() from js/main.js so you can test which hosts a
// fetched rule list would redirect, without installing the extension.
const fs = require('fs');
function prepareUrl(url) {
return url
? url.replace(/\/$/, '').replace(/^http:\/\/|https:\/\//, '').replace(/^www\./, '')
: '';
}
function matchRule(rules, url) {
const testURL = prepareUrl(url);
for (const key in rules) {
const ruleData = JSON.parse(rules[key]);
const from = key.substr(0, key.indexOf('_'));
const regx = new RegExp('^' + from.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
if (regx.test(testURL)) {
const target = (/^https?:\/\//.test(ruleData[0]) ? '' : 'http://') + ruleData[0];
return { matchedPattern: from, frequency: ruleData[3], redirectTo: target };
}
}
return null;
}
const rulesPath = process.argv[2];
const url = process.argv[3];
const rules = JSON.parse(fs.readFileSync(rulesPath, 'utf8'));
const result = matchRule(rules, url);
console.log(result ? `MATCH: ${JSON.stringify(result)}` : 'No rule matches this URL.');
- 1Save as rule-match-demo.js.
- 2Run node rule-match-demo.js rules.json https://example.com.
- 3It prints whether a rule matches and where the tab would be sent.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.