InsertLearning
ID: dehajjkfchegiinhcmoclkfbnmpgcahj
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- InsertLearning, Inc.View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
Insert instructional content on any web page
InsertLearning saves teachers and students time while keeping students engaged. Teachers can insert questions, discussions, and insight directly into any website. When students go to that website, they can respond to those questions and discussions, see that insight, and take their own notes. Use InsertLearning to turn any website into an interactive learning experience! Here are some tips on how to use InsertLearning: - Click on our extension button to make our toolbar appear. This button has our logo and is located at the top right of your window. - To insert a question, click on the question icon on our toolbar and then click on a paragraph. Inserting a question within an article is a good way to assess what your students are learning as they read. - To insert a video, the first step is to insert a sticky note. To do so, click on the sticky note icon on our toolbar and then click on a paragraph. After inserting a sticky note, either paste in a YouTube link or an embed code from another video provider. Inserting a video is a good way to address different learning styles in your classroom. - As the previous tip suggests, you can also insert other interactive items with sticky notes by pasting in an embed code. Again, interactive items are a good way to address different learning styles. - To insert a discussion, click on the discussion icon on our toolbar (looks like two speech bubbles) and then click on a paragraph. Inserting a discussion is a good way to have students learn from each other. - To highlight text, click on the highlight icon on our toolbar (some people think it looks like a pencil) and then select the text you want to highlight. You can add a comment to a highlight by clicking on the plus that appears when you first make a highlight or whenever you click on the highlight. Similarly, you can change the color of a highlight by clicking on the paint brush that appears when you first make a highlight or whenever you click on the highlight. - Students can also highlight text and insert sticky notes. Having them annotate like this can be a good way to assess what they are learning. If there are student annotations available to view, a button will appear at the top left of your screen with an icon that looks like a group of people. Click on this button and then select a student to view their annotations. When you have a student selected, you'll even see what they annotate in real time. - To assign your lesson to a class, click on a our logo on our toolbar and then click on the class you want your lesson assigned to. Once your lesson is assigned to a class, every student enrolled in that class will be able to see the things your inserted into the article. - During the assigning process, you can choose to share your lesson to Google Classroom. Below the list of your classes, is a button that says "Share to Google Classroom." Click on that button, select the classes from Google Classroom you wish to share to, and then click the button that says "Share to these classes." After doing this, a link to your lesson will appear in Google Classroom. Also, if you haven't already imported your class, this process will import your roster from Google Classroom into InsertLearning.
The sendMessage function falls back to posting messages to the parent window with a wildcard '*' origin when the extension version is older than 1.11.0 or on okeebo.com. This allows any parent frame to receive sensitive internal messages including auth tokens, user data, and lesson content, potentially enabling cross-origin data leakage if the bridge iframe is embedded in a malicious page.
else { window.parent.postMessage(JSON.stringify(msg), '*');}When receiving messages from the extension origin, the bridge reassigns window.parent and forwards the message with wildcard '*' origin. Reassigning window.parent and forwarding all data without validation could enable message relay attacks where the extension's internal messages are leaked to unintended origins.
else if (event.origin == 'chrome-extension://dehajjkfchegiinhcmoclkfbnmpgcahj') { if (event.source == window.top) { return; } window.parent = event.source.parent; window.parent.postMessage(event.data, '*'); return;}User PII (name, email, user ID, role, subscription details) is sent to Intercom third-party service. While Intercom is a legitimate customer messaging platform, this transmits significant user data to a third party including educators' personal information, which may not be clearly disclosed to 700K users.
function cacheUserInfo(response) { window._userInfo = response; var msg = { type: 'userType', userType: response.userType, relay: true }; ... if (window.Intercom) { Intercom('shutdown'); if (response.userType != 'student' && !response.spoofed) { Intercom('boot', { app_id: 'yy1u1uw5', name: response.userName, email: response.userEmail, user_id: response._id.$id, user_hash: response.intercom_user_hash, created_at: parseInt(response._id.$id.substr(0, 8), 16), extension_version: $('body').attr('data-extension-version'), hide_default_launcher: true, role: response.role, subject: JSON.stringify(response.subjectArea) || '', grade: JSON.stringify(response.gradeLevel) || '', subscription_plan: response.subscription && response.subscription.plan, subscription_ends_at: (response.subscription && response.subscription.current_period_end) || null });The extension injects a large set of JavaScript files (including jQuery and its own application code) into ANY webpage the user visits when clicked, enabled by the <all_urls> host permission. While this is core to the extension's educational purpose, it grants broad code injection capability across all origins.
chrome.action.onClicked.addListener(function(tab) { if (tab.url == 'chrome://newtab/' || tab.url == 'about:newtab' || tab.url == 'about:home') { chrome.tabs.update(tab.id, { url: 'https://insertlearning.com/v1/dashboard/' }); } else { activateDocentEDU(tab.id, tab.url); }});...function activateDocentEDU(tabId, url, frameId) { ... chrome.scripting.executeScript({ target, files: [ '/lib/js/jquery.min.js', '/lib/js/jquery.textHighlighter.min.js', '/lib/js/md5.js', '/lib/js/docent.js', '/lib/js/docent.emoji.js', '/lib/js/twemoji.min.js' ] });JWT token is sent via postMessage to parent frames matching a hardcoded whitelist that includes non-InsertLearning domains (okeebo.com, chinchilla-ferret-m7hm.squarespace.com, lumpybones.com). If any whitelisted domain is compromised, the JWT could be intercepted and used for unauthorized API access.
var origin = $('body').attr('data-origin');if (JWT.originWhitelist.indexOf(origin) != -1) { var msg = { jwt: res.jwt }; window.parent.postMessage(msg, origin);}Video iframe sends postMessage to parent with wildcard '*' origin. While the message content here is benign (resize dimensions), using wildcard origin is a security anti-pattern that could be exploited if message content changes.
function resizeParent() { var msg = { type: 'resizeThisIframe', width: '100%', height: $('video').height() }; window.parent.postMessage(JSON.stringify(msg), '*');}Referral module sends postMessage to parent with wildcard '*' origin. This could allow any embedding page to intercept messages from this iframe component.
var statusMessage = window.statusMessage || function(msg, delay) { delay = delay || 3000; var msg = { type: 'news', news: msg, duration: delay }; window.parent.postMessage(JSON.stringify(msg), '*');};Silently pings HubSpot marketing/CRM integration endpoint when a user creates a new lesson, potentially syncing user activity data to a third-party marketing platform without explicit user awareness.
$.post(baseURL.api + 'user/hubspot');Google Analytics custom dimension set with user type (teacher/student). Combined with extensive ga() event tracking throughout the codebase (toolbar clicks, template views, lesson creation, sharing), this creates a detailed behavioral profile of users across the extension.
ga('set', 'dimension1', response.userType);The background script fetches data from a CloudFront CDN endpoint using a UUID directly from the message request without validation. While this appears to be for ReadWorks integration, the UUID parameter is passed unsanitized and could be manipulated by any content script that can send messages to the background page.
else if (request.type == 'getReadworksArticle') { fetch('https://dnmkr7tf85gze.cloudfront.net/data/p/' + request.uuid).then(response => response.json()).then(json => sendResponse(json)); return true;}Extension storage contents are bulk-copied into the web page's sessionStorage and localStorage when on the bridge page. This exposes extension-internal data to the web context where it could be read by other scripts on the insertlearning.com domain.
if (location.pathname == '/v1/toolbar/bridge.php') { window.storagePromise = chrome.storage.local.get().then(storage => { Object.assign(sessionStorage, storage); ['docentID', 'docentURL'].forEach(key => { if (key in storage) { localStorage[key] = storage[key]; } }); chrome.storage.local.clear(); });}By severity
Versions scanned
Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.2.0 | 11 |
Files with findings
6 distinct paths — top paths by unique finding count:
- lib/js/bridge.js5
- background.js2
- lib/js/signin.js1
- lib/referral/referral.js1
- lib/video/video.js1
- version.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.