Safe Search Eng

A dynamic declarativeNetRequest redirect rule is injected at runtime to append the user's persistent UID and affiliate source tag to every search query URL. This silently embeds the tracking identifier into each search request, enabling the operator to build a per-user search history profile and monetise searches through affiliate attribution. The rule is re-injected on every startup so it cannot be removed by clearing storage alone.

chrome.declarativeNetRequest.updateDynamicRules({  removeRuleIds: [2],  addRules: [{    "id": 2,    "priority": 1,    "action": {      "type": "redirect",      "redirect": {        "transform": {          "queryTransform": {            "addOrReplaceParams": [{              "key": "u",              "value": result.uid            }, {              "key": "s",              "value": result.src            }]          }        }      }    },    "condition": {      "urlFilter": "safesearcheng.com/search*",      "resourceTypes": ["main_frame"]    }  }]});

The manifest forcibly overrides the browser's default search engine to safesearcheng.com with `is_default: true`, redirecting all omnibox searches to the operator's server. Combined with the UID injection in bg.js, every search query typed by the user is transmitted to the operator's infrastructure with a persistent cross-session identifier, constituting a comprehensive search-history surveillance mechanism.

{  "search_provider": {    "name": "the web",    "keyword": "csb",    "search_url": "https://safesearcheng.com/search?q={searchTerms}&s=rg_om&u=%USERID%",    "favicon_url": "https://safesearcheng.com/assets/searchbar/favicon.png",    "encoding": "UTF-8",    "is_default": true  }}

The extension reads cookies set by safesearcheng.com (`_uid` and `_src`) and persists them into synced storage. This cross-origin cookie harvesting lets the operator assign a persistent tracking identifier (`_uid`) and an affiliate/source tag (`_src`) to the user silently, without any disclosure. The `_src` value defaults to `rg_om`, indicating an affiliate referral code used for revenue attribution.

chrome.cookies.get({  url: 'https://safesearcheng.com/',  name: '_uid'}, function(c) {  let userid = (c && c.value) || generateUID();  chrome.storage.sync.set({    uid: userid  }, function() {});});chrome.cookies.get({  url: 'https://safesearcheng.com/',  name: '_src'}, function(c) {  let src = (c && c.value) || 'rg_om';  chrome.storage.sync.set({    src: src  }, function() {});});

On every browser startup/service-worker wake, the extension silently pings a remote endpoint with the user's persistent tracking UID, the exact extension ID, and the extension version. This is an undisclosed telemetry beacon that allows the operator to track individual users over time, correlate installations, and monitor the installed extension fleet. No user consent is obtained.

let extVersion = chrome.runtime.getManifest().version;fetch(  `https://safesearcheng.com/api/ext_ping?uid=${result.uid}&extID=${chrome.runtime.id}&extVersion=${extVersion}`)