Add Remote Torrent Chrome extension security report

A browser extension for power users who manage remote file-transfer clients. This tool streamlines the process of adding new transfers (via magnet links or file URLs) to various client WebUIs. It supports managing multiple server profiles, offering a centralized experience for transfer management directly from your browser. The extension is designed with privacy and security in mind. All server configurations are stored locally on your device and are never transmitted to external servers. It also works seamlessly with private trackers by fetching the file content before adding it to your client's WebUI. Reporting Issues If you encounter a bug, please open an issue on our GitHub page. To help us resolve the issue quickly, please include the following information: The version of the extension you are using. The name and version of your torrent client (e.g., qBittorrent v4.4.2). A clear description of the problem. What did you do? What did you expect to happen? What actually happened? The exact error message you received. You can find this in the extension's popup under "Last Action". Enable debugging to get more detailed error logs: Go to the extension's Options page. At the bottom, find the "Debug & Log Settings" section. Enable all checkboxes for both "content-script" and "background-script". Reproduce the error. Open the browser's developer console (Right-click anywhere on the options page -> Inspect -> Console tab). Copy and paste any relevant error messages from the console into your GitHub issue. Please review the logs and remove any sensitive information like passwords or IP addresses before posting. We are working on a feature to make this process easier by allowing you to report issues directly from the extension. *Changelog* v0.3.21 Fix: Resolved a critical "Extension context invalidated" error that occurred during extension reloads. The content script now handles this expected error gracefully, preventing console errors on every page load and improving overall stability. v0.3.20 Fix: Corrected a regression where the "URL-to-Server Mappings" feature was being ignored. The server selection logic now correctly prioritizes URL-based rules over context menu selections, restoring the expected automatic routing behavior. v0.3.19 Feature: Overhauled the "Custom Link Catching Patterns" setting. It now features a user-friendly UI for adding, editing, and deleting individual regex patterns, replacing the old, single-string input. Feature: Added two default patterns to catch common .torrent file links and torrents.php download links, improving out-of-the-box functionality. Feature: Added Porla & BiglyBT Migration: Implemented a seamless, one-time migration for existing users. The old linkmatches tilde-separated string is automatically converted into the new array-based format, preserving all user-defined patterns. v0.3.18 Feature: Added a new option to show download directories in the context menu. This allows for adding torrents to specific directories. Fix: Corrected a bug where the context menu would fail to update if a server had no download directories defined. Fix: Added error handling to the content script to prevent "context invalidated" errors on dynamic pages. v0.3.17 Fix: Implemented a comprehensive fix for uTorrent connectivity. The handler now correctly uses a user-configurable "Relative Path" for all API requests (including token fetching and connection testing), resolving errors for non-standard WebUI paths. The connection test now uses a more reliable getsettings check. UX: The options page now auto-detects and separates the relative path if it's included in the main server URL for uTorrent clients, and the "Open WebUI" button in both the options page and the popup correctly constructs the URL using this path. v0.3.16 Fix: Implemented a comprehensive fix for uTorrent connectivity. The handler now correctly uses a user-configurable "Relative Path" for all API requests (including token fetching and connection testing), resolving errors for non-standard WebUI paths. The connection test now uses a more reliable getsettings check. UX: The options page now auto-detects and separates the relative path if it's included in the main server URL for uTorrent clients, and the "Open WebUI" button correctly constructs the URL using this pat v0.3.15 Fix: Implemented a robust fix for uTorrent connectivity by allowing users to specify a custom "Relative Path" in the server settings. This resolves CSRF token errors for non-standard WebUI paths (e.g., / or /webui/). v0.3.14 Fix: Implemented a more robust CSRF token fetching mechanism for the uTorrent handler. It now tries multiple common paths (/gui/token.html and /token.html) to improve compatibility with different WebUI setups and versions. v0.3.13 Fix: Corrected the uTorrent handler to fetch the CSRF token from /gui/ instead of /gui/token.html, resolving connection errors for modern WebUI versions. v0.3.12 Fixed: Qbitorrent Handler, an issue where Automatic Torrent Management (ATM) was not being triggered when adding a torrent with a category. The `autoTMM` parameter is now correctly sent to the API. v0.3.11 Feature: Added an accessibility option to enable/disable text-based (visual) notifications for success or failure, providing an alternative to sound-based feedback. v0.3.10 Security: Fixed multiple cross-site scripting (XSS) vulnerabilities in the options page where user-provided data was not properly sanitized before being rendered. This hardens the extension against malicious data injection in the URL mapping and tracker rules lists. v0.3.9 Fixed: Resolved an issue where torrent links on a page were not being detected or intercepted due to a `ReferenceError` in the content script. On-page link catching should now work correctly again. v0.3.8 Feature: Added the ability to specify a list of download directories per server and select one from a dropdown in the "Add Torrent" dialog. Version 0.3.7 Fixed :**ruTorrent:** Improved torrent file handling by always attempting to download the `.torrent` file content, even with incorrect `Content-Type` headers. This resolves upload issues with clients like ruTorrent that cannot access torrent URLs directly. Version 0.3.6 Feature: Added a "Report Issue" button in the popup to streamline bug reporting. Fixed: ruTorrent: Corrected URL construction logic to prevent 404 errors. uTorrent (Old): Modified the API handler to support very old, token-less clients. Docs: Added a "Reporting Issues" section to the README with instructions for debugging. Updated troubleshooting guide for ruTorrent and old uTorrent versions. Version 0.3.5 - ruTorrent: Corrected an issue where the server URL was not being constructed properly, causing connection failures. -uTorrent: Added a new "uTorrent (Old)" client type to support older versions of the uTorrent WebUI (e.g., v2.0.4) that do not support modern API features like setting labels or download directories. Version 0.3.4: - Added a clickable link to the server's WebUI in the popup. - Updated project dependencies to their latest versions. - Improved documentation with a Troubleshooting/FAQ section. Version 0.3.3: - Added support for Hadouken, Tixati, Torrentflux, Vuze (HTML WebUI), Flood, Tribler, and BiglyBT. - Fixed an issue with the ruTorrent handler to improve reliability. Version 0.3.2: - Added client-specific feature enhancements for qBittorrent, Transmission, Deluge, rTorrent, ruTorrent, and uTorrent/BitTorrent. Version 0.3.1: - Fixed several bugs related to qBittorrent, Deluge, and rTorrent. - Added support for ruTorrent. - Added the ability to add a torrent by clicking the extension icon. - Added a button to open the server's WebUI from the options page. Version 0.3.0: - Initial release with support for qBittorrent, Transmission, and Deluge. Version 0.2.9: - Added dynamic link monitoring, server-specific context menus, and debug settings. - Fixed issues with click handling, sound notifications, and JSON syntax.