Security Warning: High Security Risk
Wanderlog: search & save Google Maps places
ID: ppklhnpdbmedfmgidedifnpdfcdlfijn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Travelchime Inc.View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Make planning your next trip easier: search for places on articles and blog posts on Google Maps without switching tabs.
Optimize your travel experience with the Wanderlog Chrome extension. - Search for places mentioned on articles, blog posts, and other websites without having to open a new tab. - Save places to your Wanderlog trip. - Never get caught out by unexpected Airbnb fees again: See total prices on Airbnb's maps. The extension formerly allowed you to see prices for Southwest flights on Google Flights pages, but this feature is currently disabled while we work out some issues.
The extension explicitly removes security headers (X-Frame-Options and Content-Security-Policy) from Southwest.com responses and spoofs the 'referer' header. This bypasses the website's protection against clickjacking and other frame-based attacks, intentionally enabling cross-origin iframing of a third-party site.
{ "responseHeaders": [ { "header": "x-frame-options", "operation": "remove" }, { "header": "content-security-policy", "operation": "remove" } ], "condition": { "urlFilter": "*southwest*", "resourceTypes": [ "main_frame", "sub_frame" ] }}The extension monkey-patches the global XMLHttpRequest object to intercept and capture all AJAX request and response data, including full response bodies and headers, on Southwest.com. This captured data is then passed to the extension, representing a broad and unauthorized data collection pattern.
XHR.open = function() { for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) { args[_key] = arguments[_key]; } var method = args[0], url = args[1]; this._url = typeof url === 'string' ? url : url.toString(); this._method = method; this._requestHeaders = {}; return open.apply(this, args);};XHR.send = function(requestBody) { this.addEventListener('load', function() { // ... var _requestAndResponse = { url: this._url, method: this._method, requestHeaders: this._requestHeaders, responseHeaders, responseBody, requestBody: typeof requestBody === 'string' ? requestBody : null, responseStatus: this.status };The extension implements a manual cookie jar for Southwest.com by observing 'Set-Cookie' headers via the webRequest API and re-injecting them into subsequent requests using declarativeNetRequest. This bypasses modern SameSite cookie security policies to maintain authenticated sessions within cross-origin iframes.
if (!lodash_isEqual__WEBPACK_IMPORTED_MODULE_0___default()(cookies, newCookies)) { cookies = newCookies; chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: [cookiesRuleId], addRules: [{ id: cookiesRuleId, action: { type: chrome.declarativeNetRequest.RuleActionType.MODIFY_HEADERS, requestHeaders: [{ header: 'cookie', operation: chrome.declarativeNetRequest.HeaderOperation.SET, value: Object.entries(cookies) .map(function(_ref) { // ... }).join(';') }] }, condition: { urlFilter: '*southwest*', resourceTypes: [...] } }] });}The extension references multiple critical JavaScript files ('js/content.js' and 'js/mapContent.js') in its manifest and background scripts that are entirely missing from the source bundle. This is highly suspicious as it obfuscates the extension's core logic and behaviors on major domains like Airbnb and Google Flights.
"matches": [ "*://*.google.com/travel/flights*", "*://*.google.com/flights*", "*://*.airbnb.com/*", "*://*.airbnb.az/*", // ... ], "js": ["js/content.js"] }The extension uses window.postMessage with a wildcard target origin ('*') to transmit captured request and response data. This insecure communication pattern allows any other script or iframe present on the page to intercept the sensitive data being passed to the extension.
response = _context.sent;if (event.source) { event.source.postMessage(JSON.stringify(response), '*');}case 8: case "end": return _context.stop();}}}, _callee);}));return function messageListener(_x) { return _ref.apply(this, arguments);};}();window.addEventListener('message', messageListener);By severity
Versions scanned
Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.6 | 5 |
Files with findings
4 distinct paths — top paths by unique finding count:
- js/injectedScript.js2
- declarativeNetRequest/removeSouthwestFrameHeaders.json1
- js/serviceWorker.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.