Is Simple Allow Copy safe?
Simple Allow Copy routes Chrome updates through agency.pictureknow.com and injects server-controlled affiliate links into shopping pages.
The extension sets a PAC proxy that intercepts Chrome's update requests to clients2.google.com and redirects them through agency.pictureknow.com, a server controlled by the extension developer. The proxy server address is stored as AES-encrypted ciphertext in the bundle with a hardcoded key. On Taobao, Tmall, and JD.com product pages, the extension fetches configuration from api.pictureknow.com and uses it to inject DOM elements and affiliate link buttons whose targets can be changed remotely at any time.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server-controlled config drives link injection on Taobao, Tmall, and JD pages
On item.taobao.com, detail.tmall.com, and item.jd.com, the extension fetches a config from api.pictureknow.com and injects a button/link per it.
On JD it added a coupon button to coupons.pictureknow.com; the server controls injection.
You open a product page on Taobao, Tmall, or JD.com.
The content script's componentDidMount fires and requests a page config from api.pictureknow.com/api/v1/page/info with a hardcoded id.
The extension injects a button and link into the page using values from the server's response.
The response's url, selectors, and button HTML template are used to build and insert an anchor whose href is derived from the server-supplied base URL plus the page title.
| Field | Value | Why it matters | |
|---|---|---|---|
Injected link base URL | https://coupons.pictureknow.com?key= | The destination the injected button links to; controlled by the server. | |
Button HTML template | <a coupon_place>优惠券</a> | The HTML inserted into the page; the placeholder is replaced with the link. | |
Container selector | .bottom-btns-root | Where on the page the button is placed. | |
Title selector | .sku-title-name | Element whose text is appended to the injected link URL. | |
Enable flag | valid: 1 | Injection only runs when the server returns this as truthy. |
Fetching the remote config and injecting the server-supplied link
// On a JD product page:
const url = v().host + "api/v1/page/info?id=1152437ca8084e5ab50327ec66fb5662";
sendMessage({ type: "request", params: { url } }).then((resp) => {
const host = resp.url; // server-controlled base, e.g. https://coupons.pictureknow.com?key=
const data = JSON.parse(resp.icon); // server-controlled selectors + button template
if (resp.valid) injectButton();
});
function injectButton() {
const container = $(data.parent); // e.g. .bottom-btns-root
const title = $(data.title).text(); // e.g. .sku-title-name
const href = host + encodeURIComponent(title);
const html = data.button.replace("coupon_place", `href="${href}" target="_blank"`);
container.append(html); // injected into the JD page
}