Is XSLT Tester safe?
XSLT Tester loads HTML from linangdata.com into its popup on every open and opens server-chosen links in new tabs.
Each time the popup opens, it requests link and banner content from linangdata.com and inserts the returned HTML into the page. Links in that content can open new browser tabs to addresses the server chooses. The request carries a source label and a timestamp-based ID, and the extension requests no special browser permissions.
Who publishes itLinangData - 18 other listings from the same operator, 4 of them carrying a finding
LinangData - 18 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 235k+ users between them. 4 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
XSLT Tester popup loads server-supplied HTML and opens server-chosen tabs
Code analysis shows the popup fetches HTML from linangdata.com each time it opens, renders it, and opens links from that HTML in new tabs.
No allowlist or integrity check was found.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You click the XSLT Tester icon to open the popup.
It requests HTML from linangdata.com, shows it in the popup, and opens links from it in new tabs.
The content and link targets are set by the server at request time.
- dynamiclinks.phphttps://linangdata.com/servedcontent/dynamiclinks.php?source=xsltTester&uuid=1759312845120
Returns the links list shown in the popup; its links open in new tabs.
- bannertop.phphttps://linangdata.com/servedcontent/bannertop.php?source=xsltTester&uuid=1759312845120
Returns a banner shown above the tool.
- bannerbottom.phphttps://linangdata.com/servedcontent/bannerbottom.php?source=xsltTester&uuid=1759312845120
Returns a banner shown below the tool.
- Timestamp ID1759312845120
A millisecond timestamp sent with each request; the server also sees your IP address.
Server HTML is inserted and its links are opened as tabs
// On popup open, request three HTML fragments from the vendor server.const uuid = new Date().getTime();$.get(`https://linangdata.com/servedcontent/dynamiclinks.php?source=xsltTester&uuid=${uuid}`, function (data) { $("#links").html(data); // server HTML written into the popup DOM $(".navopentab").unbind().on("click", function (e) { e.preventDefault(); chrome.tabs.create({ url: $(this).attr('href') }); // server-chosen destination });});// bannertop.php -> $("#banner-top").html(data) (same click handler)// bannerbottom.php -> $("#banner-bottom").html(data) (same click handler)- linangdata.com
Vendor server that supplies the links list, top banner and bottom banner HTML.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed XSLT contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- linangdata.comwidely used
XSLT sends data to linangdata.com. A widely used service: 28 other extensions we have analysed send data here.