Wanderlog: search & save Google Maps places

Wanderlog: search & save Google Maps places

ID: ppklhnpdbmedfmgidedifnpdfcdlfijn

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Active
Version
1.0.6
Size
2.40 MB
Rating
2.5/5
Reviews
47
Users
40,000
Type
Extension
Updated
Mar 9, 2024
Category
Workflow & planning
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes

Publisher Contextual Analysis

Trusted
Author
Travelchime Inc.View Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
40,000
Screenshot 1
Screenshot 2
Screenshot 3

Make planning your next trip easier: search for places on articles and blog posts on Google Maps without switching tabs.

Optimize your travel experience with the Wanderlog Chrome extension. - Search for places mentioned on articles, blog posts, and other websites without having to open a new tab. - Save places to your Wanderlog trip. - Never get caught out by unexpected Airbnb fees again: See total prices on Airbnb's maps. The extension formerly allowed you to see prices for Southwest flights on Google Flights pages, but this feature is currently disabled while we work out some issues.

Item
Type
Severity
Description
declarativeNetRequestWithHostAccess
Permission
Critical
This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
*://*.southwest.com/*
Host
Medium
Host permission — access limited to this URL pattern.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.

The extension explicitly removes security headers (X-Frame-Options and Content-Security-Policy) from Southwest.com responses and spoofs the 'referer' header. This bypasses the website's protection against clickjacking and other frame-based attacks, intentionally enabling cross-origin iframing of a third-party site.

declarativeNetRequest/removeSouthwestFrameHeaders.json (Line 12)
{  "responseHeaders": [    {      "header": "x-frame-options",      "operation": "remove"    },    {      "header": "content-security-policy",      "operation": "remove"    }  ],  "condition": {    "urlFilter": "*southwest*",    "resourceTypes": [      "main_frame",      "sub_frame"    ]  }}

The extension monkey-patches the global XMLHttpRequest object to intercept and capture all AJAX request and response data, including full response bodies and headers, on Southwest.com. This captured data is then passed to the extension, representing a broad and unauthorized data collection pattern.

js/injectedScript.js (Line 102)
XHR.open = function() {  for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {    args[_key] = arguments[_key];  }  var method = args[0],    url = args[1];  this._url = typeof url === 'string' ? url : url.toString();  this._method = method;  this._requestHeaders = {};  return open.apply(this, args);};XHR.send = function(requestBody) {    this.addEventListener('load', function() {          // ...          var _requestAndResponse = {            url: this._url,            method: this._method,            requestHeaders: this._requestHeaders,            responseHeaders,            responseBody,            requestBody: typeof requestBody === 'string' ? requestBody : null,            responseStatus: this.status          };

The extension implements a manual cookie jar for Southwest.com by observing 'Set-Cookie' headers via the webRequest API and re-injecting them into subsequent requests using declarativeNetRequest. This bypasses modern SameSite cookie security policies to maintain authenticated sessions within cross-origin iframes.

js/serviceWorker.js (Line 259)
if (!lodash_isEqual__WEBPACK_IMPORTED_MODULE_0___default()(cookies, newCookies)) {  cookies = newCookies;  chrome.declarativeNetRequest.updateDynamicRules({    removeRuleIds: [cookiesRuleId],    addRules: [{      id: cookiesRuleId,      action: {        type: chrome.declarativeNetRequest.RuleActionType.MODIFY_HEADERS,        requestHeaders: [{          header: 'cookie',          operation: chrome.declarativeNetRequest.HeaderOperation.SET,          value: Object.entries(cookies)            .map(function(_ref) {              // ...            }).join(';')        }]      },      condition: {        urlFilter: '*southwest*',        resourceTypes: [...]      }    }]  });}

The extension references multiple critical JavaScript files ('js/content.js' and 'js/mapContent.js') in its manifest and background scripts that are entirely missing from the source bundle. This is highly suspicious as it obfuscates the extension's core logic and behaviors on major domains like Airbnb and Google Flights.

manifest.json (Line 104)
      "matches": [        "*://*.google.com/travel/flights*",        "*://*.google.com/flights*",        "*://*.airbnb.com/*",        "*://*.airbnb.az/*",        // ...      ],      "js": ["js/content.js"]    }

The extension uses window.postMessage with a wildcard target origin ('*') to transmit captured request and response data. This insecure communication pattern allows any other script or iframe present on the page to intercept the sensitive data being passed to the extension.

js/injectedScript.js (Line 766)
response = _context.sent;if (event.source) {  event.source.postMessage(JSON.stringify(response), '*');}case 8:  case "end":  return _context.stop();}}}, _callee);}));return function messageListener(_x) {  return _ref.apply(this, arguments);};}();window.addEventListener('message', messageListener);

By severity

Critical0
High4
Medium1
Low0

Versions scanned

Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
1.0.65

Files with findings

4 distinct paths — top paths by unique finding count:

  • js/injectedScript.js2
  • declarativeNetRequest/removeSouthwestFrameHeaders.json1
  • js/serviceWorker.js1
  • manifest.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Network Interception
high
declarativeNetRequest/removeSouthwestFrameHeaders.json (line 12)The extension explicitly removes security headers (X-Frame-Options and Content-Security-Policy) from Southwest.com responses and spoofs the 'referer' header. This bypasses the website's protection against clickjacking…
1.0.6
2Other
high
manifest.json (line 104)The extension references multiple critical JavaScript files ('js/content.js' and 'js/mapContent.js') in its manifest and background scripts that are entirely missing from the source bundle. This is highly suspicious a…
1.0.6
3Privilege Escalation
high
js/serviceWorker.js (line 259)The extension implements a manual cookie jar for Southwest.com by observing 'Set-Cookie' headers via the webRequest API and re-injecting them into subsequent requests using declarativeNetRequest. This bypasses modern …
1.0.6
4Unauthorized Data Collection
high
js/injectedScript.js (line 102)The extension monkey-patches the global XMLHttpRequest object to intercept and capture all AJAX request and response data, including full response bodies and headers, on Southwest.com. This captured data is then passe…
1.0.6
5Other
medium
js/injectedScript.js (line 766)The extension uses window.postMessage with a wildcard target origin ('*') to transmit captured request and response data. This insecure communication pattern allows any other script or iframe present on the page to in…
1.0.6
URLs
614
IPv4
3
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

www.southwest.com-https://www.southwest.com/
stackoverflow.com/a/9517879/309011,https://stackoverflow.com/a/9517879/309011,
stackoverflow.com/a/67390377/309011,https://stackoverflow.com/a/67390377/309011,
stackoverflow.com/a/9517879/309011/nhttps://stackoverflow.com/a/9517879/309011\n
developer.chrome.com/docs/extensions/mv3/messaging/https://developer.chrome.com/docs/extensions/mv3/messaging/#simple\n
developer.chrome.com/docs/extensions/reference/tabs/https://developer.chrome.com/docs/extensions/reference/tabs/#perms\n
stackoverflow.com/questions/18534771/chrome-extension-how-to-get-http-response-body/n///ninterceptXMLHttpRequests(https://stackoverflow.com/questions/18534771/chrome-extension-how-to-get-http-response-body\n//\ninterceptXMLHttpRequests(
babeljs.io/docs/en/7.10.0/babel-polyfill/nimporthttps://babeljs.io/docs/en/7.10.0/babel-polyfill\nimport
wanderlog.com-https://wanderlog.com
www.facebook.com/GoWanderloghttps://www.facebook.com/GoWanderlog
Showing 1 to 10 of 620 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

25.4.3.1
IPv4
-
25.3.3.3
IPv4
-
4.4.3.2
IPv4
-
Showing 1 to 8 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.