Extension Purpose and Functionality

This Chrome extension adds custom jump buttons under specified DOM elements on web pages, based on URL patterns defined in a configuration file (config.json). The buttons are designed to facilitate quick navigation or actions related to the current page.

Key Functionalities and Behaviors

• Configuration Loading:

  • Loads a JSON configuration file (config.json) containing an array of button configurations.

• URL Pattern Matching:

  • Matches the current page URL against patterns in the configuration, supporting wildcards (*).

• DOM Element Selection:

  • Uses selectors from the configuration to find elements on the page where buttons should be added.
  • Includes a safe querying mechanism to handle potentially problematic CSS selectors.

• Button Creation:

  • Creates anchor (<a>) elements styled as buttons with an embedded SVG icon.
  • Buttons open links in new tabs with noopener noreferrer for security.

• Button Click Behavior:

  • On click, the button calls an external API (https://gateway.plug4.me/goods-service/spu/google-linkParsingToDetail) with the current page URL and a buy parameter from the config.
  • If the API returns a valid result URL, it opens that URL in a new tab.
  • If the API call fails or returns no result, it falls back to opening the configured target URL.

• DOM Mutation Observers:

  • Observes changes in the DOM to handle dynamically loaded content and Single Page Application (SPA) URL changes.
  • Re-applies buttons as needed when the page content or URL changes.

• Duplicate Prevention:

  • Maintains a set of added buttons to avoid adding duplicates.

API Calls

const apiUrl = `https://gateway.plug4.me/goods-service/spu/google-linkParsingToDetail?url=${encodeURIComponent(currentUrl)}&buy=${encodeURIComponent(buyParam)}`;
fetch(apiUrl, { method: 'GET', headers: { 'Content-Type': 'application/json' } })

• The extension makes GET requests to an external API hosted on gateway.plug4.me.
• The API is queried with the current page URL and a buy parameter.

Network Activity

• Communicates with https://gateway.plug4.me.

Filesystem Activity

• Loads a local configuration file config.json via chrome.runtime.getURL.

Other Observations

• No use of obfuscation techniques beyond standard minification.
• No execution of shell commands, PowerShell, or process executions.
• No Windows Registry operations, file creation, or user creation.
• No clipboard access.

Potential Concerns

• The extension relies on an external API (gateway.plug4.me) to determine the final URL to open on button click. This could potentially redirect users to unexpected destinations if the API is compromised or malicious.
• However, the extension falls back to a predefined target URL if the API call fails or returns no result.

Summary

The extension enhances web pages by adding navigation buttons based on configurable rules and interacts with an external API to determine navigation targets. It does not exhibit direct malicious behavior such as data exfiltration, code execution, or privilege escalation within the analyzed code.