Is Spaulding Computer Web Defender safe?
Spaulding Computer Web Defender is medium risk. Code analysis shows the background service worker redirects your active tab to a URL supplied by the vendor's server on any page matching a served pattern, with no local check limiting the destination to a vetted category of site.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Safety Redirector redirects your browsing to server-picked URLs, no allowlist
Code analysis shows the background service worker redirects your active tab to a URL supplied by the vendor's server on any page matching a served pattern, with no local check limiting the destination to a vetted category of site.
You navigate to any HTTP or HTTPS page while this extension is installed.
The listener applies everywhere because host_permissions covers http://*/* and https://*/*.
The service worker checks the page against a rule list from the vendor's server and redirects your tab on a match.
The redirect destination is taken directly from the fetched rule, with no local check restricting it to a vetted category of site.
The navigation listener and its redirect handler
chrome.webNavigation.onBeforeNavigate.addListener((tab) => {
ruleExists(tab, tab.url);
});
setTimeout(refreshRules, 2 * 86400000); // Refresh rules every 2 daysfunction ruleExists(tab, url) {
let testURL = prepareUrl(url);
chrome.storage.local.get(['rules', 'freq_track'], (result) => {
let rules = result.rules || {};
let freqTracks = result.freq_track ? JSON.parse(result.freq_track) : {};
for (const i in rules) {
let ruleData = JSON.parse(rules[i]);
let from = i.substr(0, i.indexOf('_'));
let regx = new RegExp('^' + from.replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
if (regx.test(testURL)) {
let checkRule = true;
if (ruleData[3] === 'once' && freqTracks[i] !== undefined) checkRule = false;
if (ruleData[3] === 'per24') {
let checkDate = new Date();
checkDate.setHours(checkDate.getHours() - 24);
if ((new Date(freqTracks[i])) > checkDate) checkRule = false;
}
if (checkRule) {
let newUrl = (/^https?:\/\//.test(ruleData[0]) ? '' : 'http://') + ruleData[0];
chrome.tabs.update(tab.tabId, { url: newUrl });
}
break;
}
}
});
}| Field | Value | Why it matters | |
|---|---|---|---|
Pattern to match | 123.com (illustrative) | The site-address pattern that has to match before a redirect fires. | |
Redirect destination | https://yahoo.com (illustrative) | Where your active tab is sent once the pattern matches. No category or safety check applies. | |
Frequency limit | once (illustrative) | How often this one rule is allowed to fire: once ever, once per 24 hours, or unlimited. |
- www.rules.safetyredirector.com
Serves the redirect-rule feed that decides where matching navigations get sent; no allowlist restricts destinations to a vetted category of host.
Fetches the vendor's live redirect-rule feed and prints every pattern-to-destination pair it currently serves.
// check_live_rules.js
// Fetches the extension's live redirect-rule feed and prints every
// pattern -> destination pair it currently serves.
const RULES_URL = "http://www.rules.safetyredirector.com/url_redirect3.php";
async function main() {
const res = await fetch(RULES_URL);
if (!res.ok) {
console.error(`Fetch failed: HTTP ${res.status}`);
process.exit(1);
}
const rules = await res.json();
const keys = Object.keys(rules);
console.log(`Server returned ${keys.length} rule(s).`);
for (const key of keys) {
const parsed = JSON.parse(rules[key]);
const redirectTo = parsed[0];
const frequency = parsed[3];
const pattern = key.split("_")[0];
console.log(`pattern="${pattern}" -> redirect="${redirectTo}" frequency="${frequency}"`);
}
}
main().catch((err) => {
console.error(err);
process.exit(1);
});
- 1Run node check_live_rules.js (Node 18+).
- 2Review the printed pattern and redirect pairs.
- 3Confirm none are scoped to a vetted destination allowlist.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.