TikBuddy: TikTok Analytics Online Toolkit

Version 1.6.1 View in Chrome Web Store

Last scanned: 1 day ago | force re-scan

Extension Details

Developer: tikbuddy.com

Rating: 4.3 ★ (30 ratings)

Users: 4,000

Context-Aware Verdict

MEDIUM

Overall Risk

Based on 2 total findings, including 1 high-risk finding.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage

Host Permissions:

https://www.tiktok.com/*
https://api.tikbuddy.com/*
https://*.tiktokcdn.com/*
https://*.ttwstatic.com/*
https://httpbin.org/*
https://app.tikbuddy.com/*
https://*.tikbuddy.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (349 total):

https://www.tiktok.com/api/recommend/item_list/	https://clients2.google.com/service/update2/crx
https://tikbuddy.com	https://www.tiktok.com/
https://api.tikbuddy.com/	https://httpbin.org/
https://app.tikbuddy.com/	https://goo.gl/nhQhGp
https://goo.gl/2aRDsh	https://storage.googleapis.com/workbox-cdn/releases/4.3.1/workbox-sw.js
https://goo.gl/S9QRab	https://github.com/bgrins/TinyColor
http://www.w3.org/TR/AERT#color-contrast	http://www.w3.org/TR/2008/REC-WCAG20-20081211/#relativeluminancedef
http://mjijackson.com/2008/02/rgb-to-hsl-and-rgb-to-hsv-color-model-conversion-algorithms-in-javascript	http://www.w3.org/TR/css3-color/
https://github.com/cloudhead/less.js/blob/master/lib/less/functions.js	https://github.com/infusion/jQuery-xcolor/blob/master/jquery.xcolor.js
http://www.w3.org/TR/2008/REC-WCAG20-20081211/#contrast-ratiodef	http://www.w3.org/TR/css3-color/#svg-color
http://stackoverflow.com/questions/7422072/javascript-how-to-detect-number-as-a-decimal-including-1-0	http://www.w3.org/TR/css3-values/#integers
http://www.w3.org/TR/css3-values/#number-value	https://github.com/ant-design/ant-motion/issues/44
https://github.com/ant-design/ant-design/issues/16259	https://github.com/necolas/normalize.css
https://github.com/suitcss/base	https://getbootstrap.com/docs/4.0/content/reboot/#click-delay-optimization-for-touch
http://caniuse.com/#feat=css-touch-action	https://patrickhlauke.github.io/touch/tests/results/#suppressing-300ms-delay
https://bugs.webkit.org/show_bug.cgi?id=139848	https://github.com/twbs/bootstrap/issues/11266
https://github.com/twbs/bootstrap/issues/12359	https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements
https://github.com/twbs/bootstrap/issues/11586.	https://blog.prototypr.io/align-svg-icons-to-text-and-say-goodbye-to-font-icons-d44b3d7b26b4
https://github.com/ant-design/ant-design/issues/7800	https://github.com/ant-design/ant-design/issues/14156
https://gw.alipayobjects.com/zos/rmsportal/DHNpoqfMXSfrSnlZvhsJ.png	https://github.com/ant-design/ant-design/issues/3714
https://github.com/ant-design/ant-design/issues/5754	https://github.com/ant-design/ant-design-pro/issues/139
https://github.com/ant-design/ant-design/issues/12493	https://github.com/ant-design/ant-design/issues/18087
https://github.com/ant-design/ant-design/issues/17414	https://github.com/ant-design/ant-design/pull/17684
https://codesandbox.io/embed/pensive-paper-di2wk	https://codesandbox.io/embed/nifty-benz-gb7ml
https://github.com/ant-design/ant-design/pull/18151	https://codesandbox.io/s/wizardly-sun-u10br
https://github.com/ant-design/ant-design/issues/12978	https://github.com/ant-design/ant-design/issues/20058
https://github.com/ant-design/ant-design/issues/19972	https://github.com/ant-design/ant-design/issues/18107
https://github.com/ant-design/ant-design/issues/13214	https://github.com/ant-design/ant-design/issues/7034
https://github.com/ant-design/ant-design/issues/13924	http://stackoverflow.com/a/21281554/3040605
https://github.com/ant-design/ant-design/issues/12681	http://stackoverflow.com/a/17253457
https://gw.alipayobjects.com/zos/rmsportal/XonYxBikwpgbqIQBeuhk.png	https://stackoverflow.com/a/22429853/3040605
https://github.com/ant-design/ant-design/issues/23294	https://github.com/ant-design/ant-design/issues/16738
https://github.com/ant-design/ant-design/issues/17582	https://github.com/ant-design/ant-design/issues/5078
https://github.com/ant-design/ant-design/pull/12407#issuecomment-424657810	https://github.com/ant-design/ant-design/issues/11857
https://github.com/ant-design/ant-design/issues/12597	https://github.com/twbs/bootstrap/pull/11526
https://github.com/ant-design/ant-design/issues/10914	https://github.com/ant-design/ant-design/issues/14628
https://github.com/ant-design/ant-design/issues/18607	https://github.com/ant-design/ant-design/issues/19264
https://github.com/ant-design/ant-design/issues/4903	https://github.com/ant-design/ant-design/issues/12803
https://github.com/ant-design/ant-design/issues/8220	https://github.com/ant-design/ant-design/issues/19884
https://github.com/ant-design/ant-design/issues/4431	https://github.com/ant-design/ant-design/issues/7854

Page 1 of 5

Raw Manifest

{
  "name": "TikBuddy: TikTok Analytics Online Toolkit",
  "icons": {
    "16": "images/icon.png",
    "48": "images/icon.png",
    "128": "images/icon.png"
  },
  "action": {
    "default_icon": "images/icon_gray.png",
    "default_popup": "index.html",
    "default_title": "TikBuddy"
  },
  "version": "1.6.1",
  "background": {
    "type": "module",
    "service_worker": "static/js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "The analytics extension for TikTok creators and brands.",
  "permissions": [
    "storage"
  ],
  "homepage_url": "https://tikbuddy.com",
  "content_scripts": [
    {
      "js": [
        "static/js/content.js"
      ],
      "css": [
        "static/css/content.css"
      ],
      "run_at": "document_start",
      "matches": [
        "https://www.tiktok.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://www.tiktok.com/*",
    "https://api.tikbuddy.com/*",
    "https://*.tiktokcdn.com/*",
    "https://*.ttwstatic.com/*",
    "https://httpbin.org/*",
    "https://app.tikbuddy.com/*",
    "https://*.tikbuddy.com/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://www.tiktok.com/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "https://www.tiktok.com/*"
      ],
      "resources": [
        "insert.js"
      ]
    }
  ]
}

by ✦ Astarte