Enable JavaScript

On install, the extension opens an external welcome page at js-manager.freebusinessapps.net/welcome and registers an uninstall URL at /uninstall. The uninstall callback allows the publisher to record extension uninstall events on their server, a common low-grade tracking pattern. The extension ID is implicitly conveyed via the request, enabling install/uninstall analytics on the publisher domain.

class WelcomePage {  constructor() {    let homepage = chrome.runtime.getManifest()      .homepage_url;    if (homepage.endsWith("/")) {      homepage = homepage.substr(0, homepage.length - 1);    }    chrome.runtime.onInstalled.addListener(details => this.onInstalled(details, homepage));    this.setUninstallURL(homepage);  }  onInstalled(details, homepage) {    if (details.reason != "install" || !homepage) {      return;    }    chrome.tabs.create({      url: homepage + "/welcome",    });  }  setUninstallURL(homepage) {    chrome.runtime.setUninstallURL(homepage + "/uninstall");  }}new WelcomePage();

The options page assigns translated message strings directly into innerHTML rather than textContent. The values come from chrome.i18n.getMessage which is controlled by the extension's _locales bundle, so this is not exploitable by remote attackers, but it is a poor practice that could become an injection vector if locale data were ever sourced externally.

document.querySelectorAll("[data-loc]")  .forEach(el => {    const key = el.getAttribute("data-loc");    el.innerHTML = key.loc();  });

After toggling the JavaScript content setting, the extension reads the active tab URL and forces a reload. This is consistent with the stated functionality (apply allow/block to current page) and uses only activeTab, but it does briefly read tab.url which can include sensitive query parameters. No outbound network traffic is performed with this URL.

const reload = tab => {  chrome.storage.local.get(function(d) {    if (d.re && !d.state)      return    if (d.rd && d.state)      return    var url = tab.url ? tab.url : '';    var arr = url.split("/");    if (arr[0] === 'https:' || arr[0] === 'http:')      chrome.tabs.reload();  });};