股票提醒助手

The manifest requests `*://*/` (access to all URLs on all schemes) in addition to the 5 specific financial-API origins it actually needs. For a stock-alert tool that only fetches data from sina/xueqiu/gtimg, universal host access is completely unnecessary. This broad permission grants the extension the ability to make credentialed cross-origin requests to any website the user visits, which could be exploited for data exfiltration or tracking without the user's knowledge.

{  "host_permissions": [    "http://finance.sina.com.cn/",    "https://xueqiu.com/",    "http://image.sinajs.cn/",    "https://stock.xueqiu.com/",    "http://qt.gtimg.cn/",    "*://*/"  ]}

The function `isOperation()` unconditionally returns `true` on line 6, making all the market-hours logic below it permanently dead code. The intent of this function was clearly to restrict stock-data polling to Chinese trading hours (weekdays 9:20–11:35 and 12:55–15:05), but the hardcoded `return true` bypasses that, causing the extension to make continuous network requests 24 hours a day, 7 days a week. This behavioral change from the original design is suspicious and increases the attack surface and potential for tracking.

function isOperation() {  return true;  var today = new Date();  var day = today.getDay();  if (day == 0 || day == 6)    return false;  var hour = today.getHours();  var minute = today.getMinutes();  var time = hour * 100 + minute;  if ((time > 920 && time < 1135) || (time > 1255 && time < 1505)) {    return true;  }  return false;}

Two alarms are created with extremely aggressive periods: `refreshStockTimesInit` at 0.005 minutes (~0.3 s, Chrome will clamp to its minimum ~1 min) and `refreshStockTimes` at 0.12 minutes (~7 seconds). Combined with `isOperation()` always returning `true`, this causes the extension to poll external financial APIs continuously at the fastest rate Chrome permits. Aggressive background polling that ignores market hours is a behavioural anti-pattern that also provides a persistent keep-alive mechanism, keeping the service worker alive indefinitely.

function intervalUpdateFunction() {  chrome.alarms.create("initStockTimes", {    when: Date.now() + 1,  });  chrome.alarms.create("refreshStockTimesInit", {    delayInMinutes: 0,    periodInMinutes: 0.005,  });  chrome.alarms.create("refreshStockTimes", {    delayInMinutes: 0.05,    periodInMinutes: 0.12,  });  console.log("create alarm refreshStockTimes");}

The `storage.onChanged` listener applies any unrecognised storage key directly to the `Settings` object via `Settings[key] = newValue`. Any extension page, options page, or popup that can write to `chrome.storage.local` can therefore inject arbitrary properties into the background page's `Settings` object. While the visible code does not exploit this, the pattern is an unsafe dynamic property assignment that could be weaponised if another part of the extension (or a future update) writes attacker-controlled keys to storage.

chrome.storage.onChanged.addListener(function(changes, namespace) {  for (let [key, {      oldValue,      newValue    }] of Object.entries(changes)) {    try {      if (key == "stockListStocks") {        console.log("stockListStocks changed");        loadStocks();      } else if (key == "stockAlertState") {        stockAlertState = {};        console.log("stockAlertState changed");      } else {        console.log(          `Storage key "${key}" in namespace "${namespace}" changed.`,          `Old value was "${oldValue}", new value is "${newValue}".`        );        Settings[key] = newValue;        refreshStocks();      }    } catch (e) {      console.log("change config error.");    }  }});

All HTML files in this extension (popup.html, options.html, background.html) have systematic whitespace inserted between every token (`< html >`, `< head >`, `< /script>`), which does not match any standard formatter or minifier output. This unusual tokenisation makes the HTML difficult to read and may be an attempt to evade static-analysis tools that scan for recognisable tag patterns. While the files still parse and execute correctly in browsers, the deliberately obfuscated formatting is a suspicious obfuscation indicator.

< html>  < head>    < style type="text/css">      html {      position: relative;      width: 390 px;      } < /style>        < link href="styles/popup.css" rel="stylesheet" type="text/css" />          < script type="text/javascript" src="js/libs/jquery-1.7.min.js">            < /script>