Is uAutoPagerize safe?
uAutoPagerize is medium risk. On every startup, uAutoPagerize fetches XPath/CSS pagination rules as JSON from Griever/databases on GitHub via jsDelivr, confirmed by dynamic analysis. No integrity check runs, so a repo or CDN compromise could inject attacker selectors.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Unverified remote rule fetch injects XPath/CSS selectors on all pages
On every startup, uAutoPagerize fetches XPath/CSS pagination rules as JSON from Griever/databases on GitHub via jsDelivr, confirmed by dynamic analysis.
No integrity check runs, so a repo or CDN compromise could inject attacker selectors.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You start your browser.
uAutoPagerize fetches a JSON file from cdn.jsdelivr.net containing CSS/XPath pagination rules and stores them locally without verifying their integrity.
Fires on chrome.runtime.onStartup and chrome.runtime.onInstalled. No user interaction is required.
HTTP 200. JSON body containing TOP_SITEINFO, MIDDLE_SITEINFO, and SITE_SETTINGS arrays with url/nextLink/pageElement XPath and CSS selector rules. Captured at browser startup (dynamic analysis, 2026-06-05T23:59:20Z).
- Pragma
- no-cache
- Cache-Control
- no-cache
Remote fetch with no integrity check (siteinfoManager.js:225-248)
async requestUAPItems() { // ... let items = null; try { if (siteinfoManager.items1FromStorage) { let { items1JsonString } = await getStorage(`items1JsonString`); items = JSON.parse(items1JsonString); } } catch (error) { console.log(`Error: items1 from Storage`, error); } try { if (!items) { const fetched = await fetch(this.items1URL, { headers: { 'Pragma': 'no-cache', 'Cache-Control': 'no-cache', }, }); items = await fetched.json(); // no integrity check } items.TOP_SITEINFO.forEach(func); items.MIDDLE_SITEINFO.forEach(func); items.TOP_SITEINFO = this.generageList2d(items.TOP_SITEINFO); items.MIDDLE_SITEINFO = this.generageList2d(items.MIDDLE_SITEINFO); items.SITE_SETTINGS = this.generageList2d(items.SITE_SETTINGS); Object.assign(storageCache, items); await setStorage(items); // written to chrome.storage.local } catch (error) { console.error(error); } }- cdn.jsdelivr.net
jsDelivr CDN, proxies content from the Griever/databases GitHub repository. Serves items1.json containing the pagination rule sets.
- raw.githubusercontent.com
Upstream source for jsDelivr's cache. The Griever/databases repository at path u/items1.json is the authoritative rule store.
XPath and CSS selectors in the fetched JSON are passed directly to `document.evaluate()` and `querySelector()` calls in the content scripts. The current rule set controls only pagination behavior. An attacker who modified the upstream repository or poisoned the CDN cache could supply selectors that target sensitive page elements. The extension's `<all_urls>` content script scope means modified rules would run on every HTTP/HTTPS page, including banking and webmail. We did not observe any use of fetched selectors to extract page content in our test session.