[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

JabRef Browser Extension

Version 2.5 View in Chrome Web Store

Last scanned: about 10 hours ago

Extension Details

Rating: 2.8 ★ (16 ratings)

Users: 10,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 2 high-risk findings.

Findings

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

<all_urls>
activeTab
tabs
storage
nativeMessaging

Content Security Policy:

script-src 'self' https://cdn.tailwindcss.com; object-src 'self'

Embedded URLs (144 total):

https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage	https://github.com/mozilla/webextension-polyfill
http://mozilla.org/MPL/2.0/.	https://bugzilla.mozilla.org/show_bug.cgi?id=1454760
http://fsf.org/	http://www.gnu.org/licenses/
https://clients2.google.com/service/update2/crx	https://cdn.tailwindcss.com
http://www.jabref.org/	https://github.com/JabRef/JabRef-Browser-Extension.git
https://www.jabref.org/	https://github.com/JabRef/JabRef-Browser-Extension/issues
https://github.com/JabRef/JabRef-Browser-Extension#readme	https://addons.mozilla.org/en-US/firefox/addon/jabref/?src=external-github
https://chrome.google.com/webstore/detail/jabref-browser-extension/bifehkofibaamoeaopjglfkddgkijdlh	https://microsoftedge.microsoft.com/addons/detail/pgkajmkfgbehiomipedjhoddkejohfna
https://www.zotero.org/support/translators	https://docs.jabref.org/import-export/import/jabref-browser-extension
http://arxiv.org/list/gr-qc/pastweek?skip=0&show=5	https://github.com/zotero/translators
https://developer.mozilla.org/en-US/Add-ons/WebExtensions	https://nodejs.org
https://gulpjs.com/	https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Getting_started_with_web-ext
https://help.github.com/articles/fork-a-repo/	https://guides.github.com/activities/contributing-to-open-source/#contributing
https://docs.npmjs.com/cli/outdated	https://github.com/zotero/zotero-connectors.git
https://github.com/zotero/zotero.git	https://github.com/zotero/translate.git
https://github.com/zotero/utilities.git	https://github.com/MaxKuehn/zotero-scholar-citations.git
https://addons.mozilla.org/en-US/developers/addon/jabref/versions/submit/	https://chrome.google.com/u/2/webstore/devconsole/26c4c347-9aa1-48d8-8a22-1c79fd3a597e/bifehkofibaamoeaopjglfkddgkijdlh/edit/package
https://addons.opera.com/developer/upload/	https://developer.apple.com/app-store-connect/
https://partner.microsoft.com/en-us/dashboard/microsoftedge/2045cdc1-808f-43c4-8091-43e2dcaff53d/packages	https://stackoverflow.com/questions/40084398/is-onclose-always-called-after-onerror-for-websocket
https://html.spec.whatwg.org/multipage/web-sockets.html	https://ieeexplore.ieee.org/abstract/document/893874
https://arxiv.org/a/diez_t_1.html	https://docs.jabref.org/collect/jabref-browser-extension#installation-and-configuration
https://bugzilla.mozilla.org/show_bug.cgi?id=1751611	http://purl.org/dc/elements/1.1/
http://creativecommons.org/ns#	http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://www.w3.org/2000/svg	http://www.w3.org/1999/xlink
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	http://www.inkscape.org/namespaces/inkscape
http://purl.org/dc/dcmitype/StillImage	https://scholar.google.com/scholar?q=google
http://zotero.org	https://bugzilla.mozilla.org/show_bug.cgi?id=719905
https://www.zotero.org/download	https://github.com/zotero/zotero-connectors/issues/156
https://bugs.chromium.org/p/chromium/issues/detail?id=137681	https://bugzilla.mozilla.org/show_bug.cgi?id=1402110
https://bugs.chromium.org/p/chromium/issues/detail?id=1213925	http://snipplr.com/view/10290/javascript-parse-relative-date/
https://stackoverflow.com/a/27125580	https://www.zotero.org/repo/report
https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Content_scripts#XHR_and_Fetch	https://www.zotero.org/support/adding_items_to_zotero
https://www.zotero.org/download/	https://www.zotero.org/support/kb/connector_zotero_unavailable
https://bugs.chromium.org/p/chromium/issues/detail?id=248548	https://github.com/mozilla/webextension-polyfill/pull/97
https://developer.chrome.com/extensions/storage#property-local	http://alcme.oclc.org/openurl/servlet/OAIHandler/extension?verb=GetMetadata&metadataPrefix=mtx&identifier=info:ofi/fmt:kev:mtx:dc
https://%h.proxy.edu/%p	http://%h.proxy.edu/%p
https://github.com/zotero/zotero-schema/blob/master/schema.json	https://developer.mozilla.org/en-US/docs/Web/API/DOMParser
https://github.com/zotero/translators/issues/1353	http://www.example.com/
http://www.w3.org/1999/02/22-rdf-syntax-ns#_	https://github.com/zotero/zotero-schema
https://api.zotero.org/schema	https://github.com/zotero/zotero/issues/670

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAimiMLZZCsf+p92UUzQRWYljtoUk0a9AuN+D3TJTFcm1BEDXKIDVmWG20S4yLQyYs8kWao3eTSdYykgsZLPtay1pFKtoM4csGB6sEOO+h25Nv/AU7pN5yH5PqcTIGkuH6AsQQQTPS1Y+vDfz+548oVXzK033l6ernhKRj4dngueZyQX89U38zkorq0/PPWfE8ppPzXiWo1Pn5C5scgzaHSfavIkbBpWuiJw6moSoYw4UxzmU6FmzjM/c8Ags/QPU/8M3BeC1eigStifBDkuIIDQtMtiTXEgCqHjIacB3uB7SJKL+0wsoREqoz3cX7uNLnB+DKu+s0OZKVah8gkliBLQIDAQAB",
  "name": "JabRef Browser Extension",
  "icons": {
    "48": "data/JabRef-icon-48.png",
    "96": "data/JabRef-icon-96.png"
  },
  "author": "JabRef",
  "version": "2.5",
  "commands": {
    "_execute_page_action": {
      "suggested_key": {
        "default": "Alt+Shift+J"
      }
    }
  },
  "developer": {
    "url": "http://www.jabref.org/",
    "name": "JabRef"
  },
  "background": {
    "scripts": [
      "browser-polyfill.min.js",
      "external-scripts/zotero_config.js",
      "external-scripts/zotero.js",
      "external-scripts/promise.js",
      "external-scripts/date.js",
      "external-scripts/openurl.js",
      "external-scripts/prefs.js",
      "external-scripts/errors_webkit.js",
      "external-scripts/http.js",
      "external-scripts/proxy.js",
      "connector.js",
      "external-scripts/debug.js",
      "external-scripts/xregexp-all.js",
      "external-scripts/xregexp-unicode-zotero.js",
      "external-scripts/zoteroTypeSchemaData.js",
      "external-scripts/cachedTypes.js",
      "external-scripts/repo.js",
      "external-scripts/translate.js",
      "external-scripts/translate_inject.js",
      "external-scripts/tlds.js",
      "external-scripts/translator.js",
      "external-scripts/translators.js",
      "external-scripts/connectorTypeSchemaData.js",
      "external-scripts/utilities.js",
      "external-scripts/utilities_item.js",
      "external-scripts/utilities_translate.js",
      "external-scripts/messages.js",
      "external-scripts/messaging.js",
      "external-scripts/background.js",
      "zsc_misc_pre.js",
      "external-scripts/zsc/zsc.js",
      "wsClient.js",
      "background.js"
    ]
  },
  "options_ui": {
    "page": "data/options.html",
    "chrome_style": true,
    "browser_style": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "The JabRef browser extension imports new bibliographic information directly from the browser into JabRef.",
  "page_action": {
    "default_icon": {
      "48": "data/JabRef-icon-48.png"
    },
    "default_popup": "data/progressPanel.html",
    "default_title": "Import references into JabRef"
  },
  "permissions": [
    "<all_urls>",
    "activeTab",
    "tabs",
    "storage",
    "nativeMessaging"
  ],
  "homepage_url": "http://www.jabref.org/",
  "content_scripts": [
    {
      "js": [
        "browser-polyfill.min.js",
        "external-scripts/zotero_config.js",
        "external-scripts/zotero.js",
        "external-scripts/promise.js",
        "external-scripts/http.js",
        "external-scripts/proxy.js",
        "external-scripts/date.js",
        "external-scripts/debug.js",
        "external-scripts/utilities-schema.js",
        "external-scripts/openurl.js",
        "external-scripts/xregexp-all.js",
        "external-scripts/xregexp-unicode-zotero.js",
        "external-scripts/zoteroTypeSchemaData.js",
        "external-scripts/cachedTypes.js",
        "external-scripts/schema.js",
        "external-scripts/rdf/init.js",
        "external-scripts/rdf/uri.js",
        "external-scripts/rdf/term.js",
        "external-scripts/rdf/identity.js",
        "external-scripts/rdf/rdfparser.js",
        "external-scripts/translate.js",
        "external-scripts/translator.js",
        "external-scripts/translate_item.js",
        "external-scripts/connectorTypeSchemaData.js",
        "external-scripts/utilities.js",
        "external-scripts/utilities_item.js",
        "external-scripts/utilities_translate.js",
        "external-scripts/utilities-common.js",
        "external-scripts/http_inject.js",
        "external-scripts/translate_inject.js",
        "external-scripts/messages.js",
        "external-scripts/messaging_inject.js",
        "external-scripts/inject.js",
        "bibtexConverter.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' https://cdn.tailwindcss.com; object-src 'self'",
  "browser_specific_settings": {
    "gecko": {
      "id": "@jabfox"
    }
  }
}

by ✦ Astarte

JabRef Browser Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (144 total):

Raw Manifest

Detections

Manifest Findings