InsertLearning

InsertLearning

ID: dehajjkfchegiinhcmoclkfbnmpgcahj

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
2.2.0
Size
0.29 MB
Rating
4.3/5
Reviews
60
Users
100,000
Type
Extension
Updated
Jan 19, 2024
Category
Social networking
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
InsertLearning, Inc.View Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Website
Visit
Total Extensions
2
Active
2
Obsolete
0
Listed
2
Unlisted
0
Total Users
103,000
Screenshot 1
Screenshot 2

Insert instructional content on any web page

InsertLearning saves teachers and students time while keeping students engaged. Teachers can insert questions, discussions, and insight directly into any website. When students go to that website, they can respond to those questions and discussions, see that insight, and take their own notes. Use InsertLearning to turn any website into an interactive learning experience! Here are some tips on how to use InsertLearning: - Click on our extension button to make our toolbar appear. This button has our logo and is located at the top right of your window. - To insert a question, click on the question icon on our toolbar and then click on a paragraph. Inserting a question within an article is a good way to assess what your students are learning as they read. - To insert a video, the first step is to insert a sticky note. To do so, click on the sticky note icon on our toolbar and then click on a paragraph. After inserting a sticky note, either paste in a YouTube link or an embed code from another video provider. Inserting a video is a good way to address different learning styles in your classroom. - As the previous tip suggests, you can also insert other interactive items with sticky notes by pasting in an embed code. Again, interactive items are a good way to address different learning styles. - To insert a discussion, click on the discussion icon on our toolbar (looks like two speech bubbles) and then click on a paragraph. Inserting a discussion is a good way to have students learn from each other. - To highlight text, click on the highlight icon on our toolbar (some people think it looks like a pencil) and then select the text you want to highlight. You can add a comment to a highlight by clicking on the plus that appears when you first make a highlight or whenever you click on the highlight. Similarly, you can change the color of a highlight by clicking on the paint brush that appears when you first make a highlight or whenever you click on the highlight. - Students can also highlight text and insert sticky notes. Having them annotate like this can be a good way to assess what they are learning. If there are student annotations available to view, a button will appear at the top left of your screen with an icon that looks like a group of people. Click on this button and then select a student to view their annotations. When you have a student selected, you'll even see what they annotate in real time. - To assign your lesson to a class, click on a our logo on our toolbar and then click on the class you want your lesson assigned to. Once your lesson is assigned to a class, every student enrolled in that class will be able to see the things your inserted into the article. - During the assigning process, you can choose to share your lesson to Google Classroom. Below the list of your classes, is a button that says "Share to Google Classroom." Click on that button, select the classes from Google Classroom you wish to share to, and then click the button that says "Share to these classes." After doing this, a link to your lesson will appear in Google Classroom. Also, if you haven't already imported your class, this process will import your roster from Google Classroom into InsertLearning.

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
webNavigation
Permission
High
This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.

The sendMessage function falls back to posting messages to the parent window with a wildcard '*' origin when the extension version is older than 1.11.0 or on okeebo.com. This allows any parent frame to receive sensitive internal messages including auth tokens, user data, and lesson content, potentially enabling cross-origin data leakage if the bridge iframe is embedded in a malicious page.

lib/js/bridge.js (Line 849)
else {  window.parent.postMessage(JSON.stringify(msg), '*');}

When receiving messages from the extension origin, the bridge reassigns window.parent and forwards the message with wildcard '*' origin. Reassigning window.parent and forwarding all data without validation could enable message relay attacks where the extension's internal messages are leaked to unintended origins.

lib/js/bridge.js (Line 2385)
else if (event.origin == 'chrome-extension://dehajjkfchegiinhcmoclkfbnmpgcahj') {  if (event.source == window.top) {    return;  }  window.parent = event.source.parent;  window.parent.postMessage(event.data, '*');  return;}

User PII (name, email, user ID, role, subscription details) is sent to Intercom third-party service. While Intercom is a legitimate customer messaging platform, this transmits significant user data to a third party including educators' personal information, which may not be clearly disclosed to 700K users.

lib/js/bridge.js (Line 120)
function cacheUserInfo(response) {  window._userInfo = response;  var msg = {    type: 'userType',    userType: response.userType,    relay: true  };  ...  if (window.Intercom) {    Intercom('shutdown');    if (response.userType != 'student' && !response.spoofed) {      Intercom('boot', {        app_id: 'yy1u1uw5',        name: response.userName,        email: response.userEmail,        user_id: response._id.$id,        user_hash: response.intercom_user_hash,        created_at: parseInt(response._id.$id.substr(0, 8), 16),        extension_version: $('body').attr('data-extension-version'),        hide_default_launcher: true,        role: response.role,        subject: JSON.stringify(response.subjectArea) || '',        grade: JSON.stringify(response.gradeLevel) || '',        subscription_plan: response.subscription && response.subscription.plan,        subscription_ends_at: (response.subscription && response.subscription.current_period_end) || null      });

The extension injects a large set of JavaScript files (including jQuery and its own application code) into ANY webpage the user visits when clicked, enabled by the <all_urls> host permission. While this is core to the extension's educational purpose, it grants broad code injection capability across all origins.

background.js (Line 1)
chrome.action.onClicked.addListener(function(tab) {  if (tab.url == 'chrome://newtab/' || tab.url == 'about:newtab' || tab.url == 'about:home') {    chrome.tabs.update(tab.id, {      url: 'https://insertlearning.com/v1/dashboard/'    });  } else {    activateDocentEDU(tab.id, tab.url);  }});...function activateDocentEDU(tabId, url, frameId) {  ...  chrome.scripting.executeScript({    target,    files: [      '/lib/js/jquery.min.js',      '/lib/js/jquery.textHighlighter.min.js',      '/lib/js/md5.js',      '/lib/js/docent.js',      '/lib/js/docent.emoji.js',      '/lib/js/twemoji.min.js'    ]  });

JWT token is sent via postMessage to parent frames matching a hardcoded whitelist that includes non-InsertLearning domains (okeebo.com, chinchilla-ferret-m7hm.squarespace.com, lumpybones.com). If any whitelisted domain is compromised, the JWT could be intercepted and used for unauthorized API access.

lib/js/signin.js (Line 162)
var origin = $('body').attr('data-origin');if (JWT.originWhitelist.indexOf(origin) != -1) {  var msg = {    jwt: res.jwt  };  window.parent.postMessage(msg, origin);}

Video iframe sends postMessage to parent with wildcard '*' origin. While the message content here is benign (resize dimensions), using wildcard origin is a security anti-pattern that could be exploited if message content changes.

lib/video/video.js (Line 22)
function resizeParent() {  var msg = {    type: 'resizeThisIframe',    width: '100%',    height: $('video').height()  };  window.parent.postMessage(JSON.stringify(msg), '*');}

Referral module sends postMessage to parent with wildcard '*' origin. This could allow any embedding page to intercept messages from this iframe component.

lib/referral/referral.js (Line 2)
var statusMessage = window.statusMessage || function(msg, delay) {  delay = delay || 3000;  var msg = {    type: 'news',    news: msg,    duration: delay  };  window.parent.postMessage(JSON.stringify(msg), '*');};

Silently pings HubSpot marketing/CRM integration endpoint when a user creates a new lesson, potentially syncing user activity data to a third-party marketing platform without explicit user awareness.

lib/js/bridge.js (Line 58)
$.post(baseURL.api + 'user/hubspot');

Google Analytics custom dimension set with user type (teacher/student). Combined with extensive ga() event tracking throughout the codebase (toolbar clicks, template views, lesson creation, sharing), this creates a detailed behavioral profile of users across the extension.

lib/js/bridge.js (Line 179)
ga('set', 'dimension1', response.userType);

The background script fetches data from a CloudFront CDN endpoint using a UUID directly from the message request without validation. While this appears to be for ReadWorks integration, the UUID parameter is passed unsanitized and could be manipulated by any content script that can send messages to the background page.

background.js (Line 230)
else if (request.type == 'getReadworksArticle') {  fetch('https://dnmkr7tf85gze.cloudfront.net/data/p/' + request.uuid).then(response => response.json()).then(json => sendResponse(json));  return true;}

Extension storage contents are bulk-copied into the web page's sessionStorage and localStorage when on the bridge page. This exposes extension-internal data to the web context where it could be read by other scripts on the insertlearning.com domain.

version.js (Line 3)
if (location.pathname == '/v1/toolbar/bridge.php') {  window.storagePromise = chrome.storage.local.get().then(storage => {    Object.assign(sessionStorage, storage);    ['docentID', 'docentURL'].forEach(key => {      if (key in storage) {        localStorage[key] = storage[key];      }    });    chrome.storage.local.clear();  });}

By severity

Critical0
High0
Medium5
Low6

Versions scanned

Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.2.011

Files with findings

6 distinct paths — top paths by unique finding count:

  • lib/js/bridge.js5
  • background.js2
  • lib/js/signin.js1
  • lib/referral/referral.js1
  • lib/video/video.js1
  • version.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Code Injection
medium
background.js (line 1)The extension injects a large set of JavaScript files (including jQuery and its own application code) into ANY webpage the user visits when clicked, enabled by the <all_urls> host permission. While this is core to the…
2Credential Theft
medium
lib/js/signin.js (line 162)JWT token is sent via postMessage to parent frames matching a hardcoded whitelist that includes non-InsertLearning domains (okeebo.com, chinchilla-ferret-m7hm.squarespace.com, lumpybones.com). If any whitelisted domai…
3Data Exfiltration
medium
lib/js/bridge.js (line 849)The sendMessage function falls back to posting messages to the parent window with a wildcard '*' origin when the extension version is older than 1.11.0 or on okeebo.com. This allows any parent frame to receive sensiti…
4Data Exfiltration
medium
lib/js/bridge.js (line 2385)When receiving messages from the extension origin, the bridge reassigns window.parent and forwards the message with wildcard '*' origin. Reassigning window.parent and forwarding all data without validation could enabl…
5Tracking
medium
lib/js/bridge.js (line 120)User PII (name, email, user ID, role, subscription details) is sent to Intercom third-party service. While Intercom is a legitimate customer messaging platform, this transmits significant user data to a third party in…
6Data Exfiltration
low
lib/video/video.js (line 22)Video iframe sends postMessage to parent with wildcard '*' origin. While the message content here is benign (resize dimensions), using wildcard origin is a security anti-pattern that could be exploited if message cont…
7Data Exfiltration
low
lib/referral/referral.js (line 2)Referral module sends postMessage to parent with wildcard '*' origin. This could allow any embedding page to intercept messages from this iframe component.
8Remote Code Loading
low
background.js (line 230)The background script fetches data from a CloudFront CDN endpoint using a UUID directly from the message request without validation. While this appears to be for ReadWorks integration, the UUID parameter is passed uns…
9Tracking
low
lib/js/bridge.js (line 58)Silently pings HubSpot marketing/CRM integration endpoint when a user creates a new lesson, potentially syncing user activity data to a third-party marketing platform without explicit user awareness.
10Tracking
low
lib/js/bridge.js (line 179)Google Analytics custom dimension set with user type (teacher/student). Combined with extensive ga() event tracking throughout the codebase (toolbar clicks, template views, lesson creation, sharing), this creates a de…
11Unauthorized Data Collection
low
version.js (line 3)Extension storage contents are bulk-copied into the web page's sessionStorage and localStorage when on the bridge page. This exposes extension-internal data to the web context where it could be read by other scripts o…
URLs
87
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

insertlearning.com/v1/dashboard/https://insertlearning.com/v1/dashboard/
insertlearning.com/v1/toolbar/bridge.phphttps://insertlearning.com/v1/toolbar/bridge.php
accounts.google.com/o/oauth2/iframehttps://accounts.google.com/o/oauth2/iframe
insertlearning.com/v1/video/https://insertlearning.com/v1/video/
www.okeebo.com-https://www.okeebo.com
insertlearning.com-https://insertlearning.com
chrome.google.com/webstore/*https://chrome.google.com/webstore/*
insertlearning.com/v1/https://insertlearning.com/v1/?source=chrome-web-store
insertlearning.com/removed/https://insertlearning.com/removed/
accounts.google.com/o/oauth2/revokehttps://accounts.google.com/o/oauth2/revoke?token=
Showing 1 to 10 of 90 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found
Showing 1 to 8 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.