[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Twitter Block Chain

Version 1.8.3 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Rating: 2.7 ★ (425 ratings)

Users: 10,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 7 total findings, including 4 high-risk findings.

Findings

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe JavaScript Evaluation

This extension's Content Security Policy allows 'unsafe-eval', which permits dynamic JavaScript code execution using eval() and similar functions. This is a significant security risk as it could allow execution of malicious code.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

storage
activeTab
webRequest
webRequestBlocking
*://*.twimg.com/
https://api.twitter.com/
https://mobile.twitter.com/
https://twitter.com/

Content Security Policy:

script-src 'self' 'unsafe-eval'; object-src 'self'

Embedded URLs (25 total):

https://twitter.com	https://twitter.com/i/user/block
https://api.twitter.com/1.1/	https://discourse.mozilla.org/t/webextension-xmlhttprequest-issues-no-cookies-or-referrer-solved/11224/9
https://twitter.com/	http://mozilla.org/MPL/2.0/.
https://github.com/mozilla/webextension-polyfill/issues/16#issuecomment-284904252	https://developer.chrome.com/extensions/tabs#method-query
https://developer.chrome.com/extensions/tabs#type-Tab	https://mobile.twitter.com
https://github.com/satsukitv/twitter-block-chain	https://clients2.google.com/service/update2/crx
https://api.twitter.com/	https://mobile.twitter.com/
https://chrome.google.com/webstore/detail/twitter-block-chain/dkkfampndkdnjffkleokegfnibnnjfah?hl=en	https://addons.mozilla.org/en-US/firefox/addon/twitter-block-chain/
http://angularjs.org	http://errors.angularjs.org/1.7.8/
http://getbootstrap.com	https://github.com/twbs/bootstrap/blob/master/LICENSE
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	https://github.com/l-lin/angular-datatables
https://datatables.net/reference/option/columnDefs.targets	https://l-lin.github.com/angular-datatables/#/manipulatingDTInstances
http://datatables.net/tn/

Raw Manifest

{
  "name": "Twitter Block Chain",
  "icons": {
    "16": "images/icon16.png",
    "48": "images/icon48.png",
    "128": "images/icon128.png"
  },
  "version": "1.8.3",
  "background": {
    "scripts": [
      "js/background.js"
    ],
    "persistent": true
  },
  "options_ui": {
    "page": "options.html",
    "open_in_tab": true,
    "browser_style": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Blocks all users on a following/followers page.",
  "permissions": [
    "storage",
    "activeTab",
    "webRequest",
    "webRequestBlocking",
    "*://*.twimg.com/",
    "https://api.twitter.com/",
    "https://mobile.twitter.com/",
    "https://twitter.com/"
  ],
  "browser_action": {
    "default_icon": "images/icon.png",
    "default_popup": "popup.html"
  },
  "content_scripts": [
    {
      "js": [
        "js/browser-polyfill.min.js",
        "js/Queue.js",
        "js/ExtensionStorage.js",
        "bower_components/jquery/dist/jquery.min.js",
        "js/blockchain.js"
      ],
      "css": [
        "css/content.css"
      ],
      "matches": [
        "https://mobile.twitter.com/*",
        "https://twitter.com/*"
      ]
    }
  ],
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"
}

by ✦ Astarte

Twitter Block Chain

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (25 total):

Raw Manifest

Detections

Manifest Findings