dotEPUB
ID: okpfiebkkmjcnodegbbbiellepfhoglm
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://dotepub.com/View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
Convert any webpage into an e-book
dotEPUB allows you to convert any webpage into an EPUB or Kindle e-book. Download webpages to any device: e-readers, tablets, smartphones, netbooks, desktop computers... Save now and immersively read later (even offline) those long and deep articles you didn't have time to read while browsing. Build a personal library of your favorite blog posts, news articles, etc. Warning: This extension can only be run once on the same webpage unless you reload that page.
On click, the extension serializes the entire current page (HTML body, title, URL, author, copyright metadata) into a hidden form and POSTs it to a third-party server at dotepub.com/api/v1/post. While this is the extension's stated EPUB-conversion purpose, it constitutes wholesale transmission of page content — including any logged-in/private pages the user invokes the action on — to an external endpoint with no opt-in, no preview, and no encryption guarantee beyond the protocol-relative URL.
send: function(e, t, o) { if (0 == window.location.href.indexOf("file") && dotEPUB.links && !confirm(dotEPUB.messages.local[ dotEPUB_lang])) return void dotEPUB.removeStatus(); var n = e.content.length; if (n > 5e5 && 2999999 > n && !confirm(dotEPUB.messages.toolong[dotEPUB_lang])) return void dotEPUB .removeStatus(); if (n > 3e6) return alert(dotEPUB.messages.tootoolong[dotEPUB_lang]), void dotEPUB.removeStatus(); var l = document.createElement("form"); l.setAttribute("action", dotEPUB.path), l.setAttribute("method", "post"), l.setAttribute( "accept-charset", "utf-8"), dotEPUB.field(l, "format", dotEPUB.format), dotEPUB.field(l, "title", e .title), dotEPUB.field(l, "html", e.content), dotEPUB.field(l, "url", "Link" !== dotEPUB.type ? window.location.href : dotEPUB_url), dotEPUB.field(l, "author", t), dotEPUB.field(l, "copy", o), dotEPUB.field(l, "flags", dotEPUB.flags), dotEPUB.field(l, "links", dotEPUB.links), dotEPUB.field(l, "lang", dotEPUB_lang), dotEPUB.field(l, "imgs", dotEPUB.imgs), dotEPUB.field(l, "wlang", dotEPUB .wlang), dotEPUB.field(l, "v", dotEPUB.version + " / " + dotEPUB.type.substring(0, 1) .toLowerCase() + dotEPUB_bookver + " " + (1 === dotEPUB.imgs ? "I" : "") + (1 === dotEPUB.links ? "L" : "")), dotEPUB.field(l, "s", dotEPUB.s([5, 3, 100, 2, 0, 4, 33, 1, 255, document])), window .setTimeout(function() {Deliberately obfuscated routine `dotEPUB.s` paired with `dotEPUB.form` (a switch-by-opcode dispatcher whose cases reference `window.location`, `document.href`, and per-character codes) is invoked with `[5, 3, 100, 2, 0, 4, 33, 1, 255, document]` and the result is appended as a hidden form field `s` alongside the exfiltrated page body. The opaque variable shuffling, chained shadowing of identifiers (`o`, `n`, `d`, `a`, `s`, `l`), and indirect references to location/href make the data being computed and transmitted intentionally hard to audit — characteristic of fingerprinting or anti-tamper signatures rather than benign serialization.
s: function(e) { var t = dotEPUB.form(s, e[4], e[1], d, l, o, n, e[2], e[3], e[4]), o = dotEPUB.form(e[4], t, e[1], d, l, o, n, e[9], e[5], t), n = dotEPUB.form(e[7], t, e[1], d, l, o, n, e[6], e[7], o), a = dotEPUB.form(e[5], t, e[3], d, l, o, n, e[0], e[3], n), r = dotEPUB.form(e[1], t, e[1], d, l, o, n, n / 11, e[7], a), d = dotEPUB.form(e[3], t, e[5], d, l, o, n, e[2], a, r), i = dotEPUB.form(e[4], t, e[1], d, l, o, n, e[8] - e[6] - e[5], e[7], d), s = dotEPUB.form(e[3], t, 6, d, l, o, n, e[2], a, r), l = dotEPUB.form(s, t, e[0], d, l, o, n, e[0], e[7], s), c = dotEPUB.form(s, t, e[4], d, l, o, n, e[0], e[7], s), m = dotEPUB.form(s, t, e[7], d, l, o, n, e[0], e[7], s), g = dotEPUB.form(s, t, e[0], d, l, o, n, e[0], e[7], c), a = dotEPUB.form(s, t, e[7], d, g, o, n, e[0], e[7], s), p = dotEPUB.form(c, l, e[7], d, g - e[5], o, n, e[0], e[7], s), u = dotEPUB.form(s, t, e[0], d, l, o, n, e[0], e[7], 0); return m + i + a + p + u }, ... form: function(e, t, o, n, a, r, d, i, s, l) { switch (o) { case 0: return ((e * t + d + 4) / 3 + 1) / 10 - 1; case 1: return n.charCodeAt(a); case 2: return r.location; case 3: return i; case 4: return s.href; case 5: return n.length + l; case 6: return d * l - t } }Injects a remote stylesheet from `//dotepub.com/s/dotEPUB-favlet.css` into the active page using a protocol-relative URL. While CSS itself is limited in capability, the protocol-relative reference can be fetched over HTTP if the host page is HTTP, and any compromise of the dotepub.com server would let an attacker push styling that overlays/cloaks page content for users of the extension.
s = d.createElement('link'), h = d.getElementsByTagName('head')[0], i = d.createElement('div');s.rel = 'stylesheet';s.href = '//dotepub.com/s/dotEPUB-favlet.css';s.type = 'text/css';s.media = 'screen';h.appendChild(s);Builds dropdown options by string-concatenating `chrome.i18n.getMessage()` values directly into `innerHTML`. The i18n strings are extension-controlled (so this is not directly user-exploitable XSS), but the pattern is fragile and would become an injection sink if locale files were ever loaded from an untrusted source.
switch (lang) { case "es": document.getElementById('la') .innerHTML = "<option value=\"es\">" + chrome.i18n.getMessage("es") + "</option><option value=\"ca\">" + chrome .i18n.getMessage("ca") + "</option><option value=\"en\">" + chrome.i18n.getMessage("en") + "</option>"; break;By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.3.1 | 4 |
Files with findings
2 distinct paths — top paths by unique finding count:
- content_script.js3
- options.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.