ParrotTalks抄筆記

The extension fetches JavaScript from https://www.parrottalks.com/js/calc-gttk.js (PTNT.URL_CALC_GTTK) and executes it with eval(), replacing the PTNT.calcGTTk function. A chrome.alarms job re-runs this every 10 minutes (line 10666), so the developer's server can push arbitrary code into 30,000 installations at any time. This is classic remote code loading and violates Chrome Web Store policy.

}, updateCalcGTTk = function() {  var success;  return success = function(code) {    var e, oldFn;    if (oldFn = PTNT.calcGTTk, code) try {      return PTNT.calcGTTk = eval(code)    } catch (_error) {      return e = _error, PTNT.calcGTTk = oldFn    }  }, UTIL.xhrGet(PTNT.URL_CALC_GTTK, success)}, updateCalcGTTk(),

The Google Translate response body (from https://translate.google.com/translate_a/single) is passed directly to eval() as JavaScript. Any MITM, DNS hijack, or malicious proxy that tampers with that response achieves arbitrary code execution in the extension's service-worker context with full <all_urls> privileges.

success = function(data, status) {var e;try {  data = eval(data)} catch (_error) {  e = _error, data = null}return _cache[key] = UTIL.extend(!0, {}, data), dfd.resolve(data)}, error = function(a, b) {return dfd.reject([a, b])}, UTIL.xhrGet(get_url, success, error), dfd.promise)

The raw response body from the Google Scribe dictionary endpoint (https://www.googleapis.com/scribe/v1/research?...) is eval()'d as JavaScript. Because the API key is hard-coded client-side and the response is eval'd without parsing, any response tampering becomes code execution in the background context.

success = function(res) {  var data, e;  data = res.data;  try {    data = eval(data)  } catch (_error) {    e = _error, data = null  }  return _cache[key] = UTIL.extend(!0, {}, data), data}

The POS tagger scrapes HTML from the unencrypted endpoint http://nlp.stanford.edu:8080/corenlp/process, pulls text between <pre>...</pre>, and feeds it into window.eval(). Cleartext HTTP plus eval() of third-party-controlled text is a trivial remote code execution vector for anyone who can MITM the connection.

return c = pDefer(), d = "http://nlp.stanford.edu:8080/corenlp/process", b = {    outputFormat: "json",    input: a,    Process: "Submit"  }, UTIL.xhrPost(d, b, null, null, {    timeout: 3e3  })  .then(function(b) {      var c, d, e, f, g;      return d = b.data, g = d.substr(d.search("<pre>")), g = g.substring(0, g.search("</pre>") + 6), c = $(g),        e = a, window.eval("var __buf = " + c.text()), f = __buf, {

The background service worker exposes an ACTION_BG_XHR RPC that performs arbitrary cross-origin XHR (any URL, any method, any body) and returns the full response to the caller. The content script installed.js (injected on parrottalks.com and localhost) relays this via window.postMessage, letting any JavaScript on parrottalks.com bypass the same-origin policy through the extension's <all_urls> privilege. No URL allowlist, no origin check.

case PTNT.ACTION_BG_XHR:  return p = function(a, b, d) {    c({        success: !0,        status: b,        data: a,        headers: d      }),      chrome.runtime.lastError  }, f = function(a, b, d) {    c({        status: b,        data: a,        headers: d      }),      chrome.runtime.lastError  }, UTIL.xhr(a.url, a.method, a.body, p, f, a.options), !0;

Uses a webRequest blocking redirect to encode the current frameId into a synthetic GIF, then calls b.eval(e) inside each subframe to run an arbitrary script string. This is a DOM-injection technique that effectively re-implements tabs.executeScript in subframes, bypassing the documented script-injection APIs, and runs caller-supplied JavaScript strings in any http/https/file frame the page contains.

chrome.webRequest.onBeforeRequest.addListener(function(a) {    var b = a.frameId + 1,      c = String.fromCharCode(255 & b, b >> 8 & 255),      d = String.fromCharCode((b >> 16) + 1, 0),      e = "data:image/gif;base64," + btoa("GIF89a" + c + d + "\0\xff\0,\0\0\0\0" + c + d + "\0D\0;");    return {      redirectUrl: e    }  }, {    urls: [b + "*"],    types: ["image"]  }, ["blocking"]),  ...  try {    a = b.eval(e)  } finally {    ...  }

This content script (injected on *.parrottalks.com and localhost) accepts any window.postMessage with message === PAGE_MESSAGE_XHR_REQUEST and proxies it to the background ACTION_BG_XHR handler, which performs cross-origin XHR with <all_urls> privileges. No origin/source verification on the message. Any script that can execute on parrottalks.com (including a compromised third-party tag or XSS) can issue authenticated fetches to any domain through the extension.

window.addEventListener("message", function(k) {  var l;  try {    l = JSON.parse(k.data)  } catch (m) {}  if (l && l.message) switch (l.message) {    ...    case PTNT.PAGE_MESSAGE_XHR_REQUEST:      h(l);      break;      ...  }}, !1)