dotEPUB

dotEPUB

ID: okpfiebkkmjcnodegbbbiellepfhoglm

Supported Languages

🇪🇸Catalan
🇺🇸English
🇪🇸Spanish

Extension Info & Metadata

Status
Active
Version
1.3.1
Size
0.03 MB
Rating
3.9/5
Reviews
282
Users
30,000
Type
Extension
Updated
Aug 30, 2024
Category
Workflow & planning
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
https://dotepub.com/View Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Website
Visit
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
30,000
Screenshot 1
Screenshot 2

Convert any webpage into an e-book

dotEPUB allows you to convert any webpage into an EPUB or Kindle e-book. Download webpages to any device: e-readers, tablets, smartphones, netbooks, desktop computers... Save now and immersively read later (even offline) those long and deep articles you didn't have time to read while browsing. Build a personal library of your favorite blog posts, news articles, etc. Warning: This extension can only be run once on the same webpage unless you reload that page.

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.

On click, the extension serializes the entire current page (HTML body, title, URL, author, copyright metadata) into a hidden form and POSTs it to a third-party server at dotepub.com/api/v1/post. While this is the extension's stated EPUB-conversion purpose, it constitutes wholesale transmission of page content — including any logged-in/private pages the user invokes the action on — to an external endpoint with no opt-in, no preview, and no encryption guarantee beyond the protocol-relative URL.

content_script.js (Line 192)
send: function(e, t, o) {    if (0 == window.location.href.indexOf("file") && dotEPUB.links && !confirm(dotEPUB.messages.local[        dotEPUB_lang])) return void dotEPUB.removeStatus();    var n = e.content.length;    if (n > 5e5 && 2999999 > n && !confirm(dotEPUB.messages.toolong[dotEPUB_lang])) return void dotEPUB      .removeStatus();    if (n > 3e6) return alert(dotEPUB.messages.tootoolong[dotEPUB_lang]), void dotEPUB.removeStatus();    var l = document.createElement("form");    l.setAttribute("action", dotEPUB.path), l.setAttribute("method", "post"), l.setAttribute(        "accept-charset", "utf-8"), dotEPUB.field(l, "format", dotEPUB.format), dotEPUB.field(l, "title", e        .title), dotEPUB.field(l, "html", e.content), dotEPUB.field(l, "url", "Link" !== dotEPUB.type ?        window.location.href : dotEPUB_url), dotEPUB.field(l, "author", t), dotEPUB.field(l, "copy", o),      dotEPUB.field(l, "flags", dotEPUB.flags), dotEPUB.field(l, "links", dotEPUB.links), dotEPUB.field(l,        "lang", dotEPUB_lang), dotEPUB.field(l, "imgs", dotEPUB.imgs), dotEPUB.field(l, "wlang", dotEPUB        .wlang), dotEPUB.field(l, "v", dotEPUB.version + " / " + dotEPUB.type.substring(0, 1)        .toLowerCase() + dotEPUB_bookver + " " + (1 === dotEPUB.imgs ? "I" : "") + (1 === dotEPUB.links ?          "L" : "")), dotEPUB.field(l, "s", dotEPUB.s([5, 3, 100, 2, 0, 4, 33, 1, 255, document])), window      .setTimeout(function() {

Deliberately obfuscated routine `dotEPUB.s` paired with `dotEPUB.form` (a switch-by-opcode dispatcher whose cases reference `window.location`, `document.href`, and per-character codes) is invoked with `[5, 3, 100, 2, 0, 4, 33, 1, 255, document]` and the result is appended as a hidden form field `s` alongside the exfiltrated page body. The opaque variable shuffling, chained shadowing of identifiers (`o`, `n`, `d`, `a`, `s`, `l`), and indirect references to location/href make the data being computed and transmitted intentionally hard to audit — characteristic of fingerprinting or anti-tamper signatures rather than benign serialization.

content_script.js (Line 232)
s: function(e) {    var t = dotEPUB.form(s, e[4], e[1], d, l, o, n, e[2], e[3], e[4]),      o = dotEPUB.form(e[4], t, e[1], d, l, o, n, e[9], e[5], t),      n = dotEPUB.form(e[7], t, e[1], d, l, o, n, e[6], e[7], o),      a = dotEPUB.form(e[5], t, e[3], d, l, o, n, e[0], e[3], n),      r = dotEPUB.form(e[1], t, e[1], d, l, o, n, n / 11, e[7], a),      d = dotEPUB.form(e[3], t, e[5], d, l, o, n, e[2], a, r),      i = dotEPUB.form(e[4], t, e[1], d, l, o, n, e[8] - e[6] - e[5], e[7], d),      s = dotEPUB.form(e[3], t, 6, d, l, o, n, e[2], a, r),      l = dotEPUB.form(s, t, e[0], d, l, o, n, e[0], e[7], s),      c = dotEPUB.form(s, t, e[4], d, l, o, n, e[0], e[7], s),      m = dotEPUB.form(s, t, e[7], d, l, o, n, e[0], e[7], s),      g = dotEPUB.form(s, t, e[0], d, l, o, n, e[0], e[7], c),      a = dotEPUB.form(s, t, e[7], d, g, o, n, e[0], e[7], s),      p = dotEPUB.form(c, l, e[7], d, g - e[5], o, n, e[0], e[7], s),      u = dotEPUB.form(s, t, e[0], d, l, o, n, e[0], e[7], 0);    return m + i + a + p + u  },  ...  form: function(e, t, o, n, a, r, d, i, s, l) {    switch (o) {      case 0:        return ((e * t + d + 4) / 3 + 1) / 10 - 1;      case 1:        return n.charCodeAt(a);      case 2:        return r.location;      case 3:        return i;      case 4:        return s.href;      case 5:        return n.length + l;      case 6:        return d * l - t    }  }

Injects a remote stylesheet from `//dotepub.com/s/dotEPUB-favlet.css` into the active page using a protocol-relative URL. While CSS itself is limited in capability, the protocol-relative reference can be fetched over HTTP if the host page is HTTP, and any compromise of the dotepub.com server would let an attacker push styling that overlays/cloaks page content for users of the extension.

content_script.js (Line 33)
s = d.createElement('link'),  h = d.getElementsByTagName('head')[0],  i = d.createElement('div');s.rel = 'stylesheet';s.href = '//dotepub.com/s/dotEPUB-favlet.css';s.type = 'text/css';s.media = 'screen';h.appendChild(s);

Builds dropdown options by string-concatenating `chrome.i18n.getMessage()` values directly into `innerHTML`. The i18n strings are extension-controlled (so this is not directly user-exploitable XSS), but the pattern is fragile and would become an injection sink if locale files were ever loaded from an untrusted source.

options.js (Line 34)
switch (lang) {  case "es":    document.getElementById('la')      .innerHTML = "<option value=\"es\">" + chrome.i18n.getMessage("es") + "</option><option value=\"ca\">" + chrome      .i18n.getMessage("ca") + "</option><option value=\"en\">" + chrome.i18n.getMessage("en") + "</option>";    break;

By severity

Critical0
High0
Medium2
Low2

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.3.14

Files with findings

2 distinct paths — top paths by unique finding count:

  • content_script.js3
  • options.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
medium
content_script.js (line 192)On click, the extension serializes the entire current page (HTML body, title, URL, author, copyright metadata) into a hidden form and POSTs it to a third-party server at dotepub.com/api/v1/post. While this is the exte…
2Obfuscation
medium
content_script.js (line 232)Deliberately obfuscated routine `dotEPUB.s` paired with `dotEPUB.form` (a switch-by-opcode dispatcher whose cases reference `window.location`, `document.href`, and per-character codes) is invoked with `[5, 3, 100, 2, …
3Code Injection
low
options.js (line 34)Builds dropdown options by string-concatenating `chrome.i18n.getMessage()` values directly into `innerHTML`. The i18n strings are extension-controlled (so this is not directly user-exploitable XSS), but the pattern is…
4Remote Code Loading
low
content_script.js (line 33)Injects a remote stylesheet from `//dotepub.com/s/dotEPUB-favlet.css` into the active page using a protocol-relative URL. While CSS itself is limited in capability, the protocol-relative reference can be fetched over …
URLs
3
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
dotepub.com-http://dotepub.com
xavierbadosa.com-http://xavierbadosa.com

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 2 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.