[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

NotionX ( for Notion )

Version 2.1.4 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: scarsu.cn

Rating: 4.8 ★ (15 ratings)

Users: 3,000

Context-Aware Verdict

LOW

Overall Risk

Based on 1 total findings.

Findings

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

https://*.notion.so/*

Content Security Policy:

script-src 'self' ; object-src 'self'

Embedded URLs (162 total):

https://jquery.com/	https://jquery.org/license
https://lodash.com/	https://openjsf.org/
https://lodash.com/license	http://underscorejs.org/LICENSE
https://npms.io/search?q=ponyfill.	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
http://www.scarsu.cn/notionx/index.html	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	http://www.w3.org/1998/Math/MathML
https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE	https://github.com/scarsu/NotionX
https://www.notion.so/Learn-the-shortcuts-66e28cec810548c3a4061513126766b0#5c679ece35ee4e81b1217333a4cf35b3	http://www.scarsu.cn/notionx
https://github.com/scarsu/NotionX/discussions/4	https://www.scarsu.com
https://www.notion.so/product	http://www.scarsu.cn/notionx/privacy.html
https://github.com/whatwg/html/issues/2369	https://html.spec.whatwg.org/#nonce-attributes
https://drafts.csswg.org/cssom/#common-serializing-idioms	https://www.w3.org/TR/css-syntax-3/#ident-token-diagram
https://www.w3.org/TR/selectors/#attribute-selectors	https://www.w3.org/TR/CSS21/syndata.html#escaped-characters
https://bugs.jquery.com/ticket/13393	https://github.com/jquery/sizzle/issues/157
https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled	https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled
https://html.spec.whatwg.org/multipage/forms.html#category-listed	https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled
https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled	https://bugs.webkit.org/show_bug.cgi?id=136851
https://drafts.csswg.org/selectors/#relational	https://github.com/jquery/sizzle/pull/225
https://www.w3.org/TR/selectors/#pseudo-classes	https://github.com/jquery/sizzle/issues/299
https://www.w3.org/TR/selectors/#lang-pseudo	https://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked
https://www.w3.org/TR/selectors/#empty-pseudo	https://promisesaplus.com/#point-59
https://promisesaplus.com/#point-48	https://promisesaplus.com/#point-54
https://promisesaplus.com/#point-75	https://promisesaplus.com/#point-64
https://promisesaplus.com/#point-61	https://promisesaplus.com/#point-57
https://bugs.chromium.org/p/chromium/issues/detail?id=378607	https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click
https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html	https://bugzilla.mozilla.org/show_bug.cgi?id=687787
http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order	https://bugs.chromium.org/p/chromium/issues/detail?id=449857
https://bugs.chromium.org/p/chromium/issues/detail?id=470258	https://connect.microsoft.com/IE/feedback/details/1736512/
https://jsperf.com/getall-vs-sizzle/2	https://www.w3.org/TR/css-syntax-3/#input-preprocessing
https://drafts.csswg.org/cssom/#resolved-values	https://developer.mozilla.org/en-US/docs/CSS/display
https://html.spec.whatwg.org/multipage/syntax.html#attributes-2	https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	http://example.com:80x/
https://bugs.webkit.org/show_bug.cgi?id=137337	https://bugs.webkit.org/show_bug.cgi?id=29084
https://bugs.chromium.org/p/chromium/issues/detail?id=589347	https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
https://github.com/jquery/jquery/pull/557	http://ecma-international.org/ecma-262/7.0/#sec-patterns
http://ecma-international.org/ecma-262/7.0/#sec-template-literal-lexical-components	https://en.wikipedia.org/wiki/Combining_Diacritical_Marks
https://en.wikipedia.org/wiki/Combining_Diacritical_Marks_for_Symbols	https://mathiasbynens.be/notes/javascript-unicode
http://eev.ee/blog/2015/09/12/dark-corners-of-unicode/	http://ecma-international.org/ecma-262/7.0/#sec-object.prototype.tostring
http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero	https://bugs.webkit.org/show_bug.cgi?id=156034
https://en.wikipedia.org/wiki/Exponentiation_by_squaring	https://mdn.io/clearTimeout

Page 1 of 3

Raw Manifest

{
  "name": "NotionX ( for Notion )",
  "icons": {
    "16": "icons/notionx-white.png",
    "48": "icons/notionx-white.png",
    "128": "icons/notionx-white.png"
  },
  "version": "2.1.4",
  "background": {
    "scripts": [
      "js/background.js"
    ],
    "persistent": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "A Browser Extension that enhances Notion experience.",
  "permissions": [
    "https://*.notion.so/*"
  ],
  "homepage_url": "http://scarsu.cn/notionx/",
  "browser_action": {
    "default_icon": {
      "19": "icons/notionx-white.png",
      "38": "icons/notionx-white.png"
    },
    "default_popup": "popup.html",
    "default_title": "NotionX ( for Notion )"
  },
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/content-script.js"
      ],
      "css": [
        "css/content-script.css"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://*.notion.so/*"
      ]
    }
  ],
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' ; object-src 'self'"
}

by ✦ Astarte