Json Formatter
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
Automatically prettifies any JSON response opened in a browser tab.
FEATURES:
🏎️ **Fast**, even on very long JSON pages
🌗 Dark mode support
🎨 Syntax highlighting
📎 Code folding and indent guides
🔗 Clickable URLs
🔌 Raw/Parsed toggler
Pro tips:
🪄 Hold down Ctrl (or ⌘ on Mac) when clicking to fold/unfold all adjacent siblings
🪄 Open the Dev Tools console and type `json` if you want to explore the parsed JSON
Tags
Privacy Practices
Security Analysis — Json Formatter
Permissions
Code Patterns Detected
External Connections
Package Contents 11 files · 204KB
What This Extension Does
The Json Formatter extension makes JSON data easy to read and explore, solving a common problem for developers and users. It's designed to work with long JSON pages, providing features like syntax highlighting, code folding, and clickable URLs.
Permissions Explained
- storageexpected: This permission allows the extension to store data locally on your device.
Technical: The extension uses the chrome.storage API to access and modify browser storage. This could potentially allow unauthorized access or modification of sensitive user data if compromised. - unlimitedStoragecheck this: This permission allows the extension to store an unlimited amount of data locally on your device.
Technical: The extension uses the chrome.storage API with the 'unlimited' scope, which could potentially lead to storage exhaustion or unauthorized access if compromised. ⚠ 1 - webRequestcheck this: This permission allows the extension to intercept and modify web requests.
Technical: The extension uses the chrome.webRequest API, which grants access to all URLs. This could potentially allow unauthorized modification of sensitive user data or eavesdropping if compromised. ⚠ 1 - *://*/*check this: This permission allows the extension to intercept and modify web requests for all URLs.
Technical: The extension uses a wildcard pattern to match all URLs, granting access to sensitive user data. This is considered a critical risk if compromised. ⚠ 1 - <all_urls>check this: This permission allows the extension to intercept and modify web requests for all URLs, including those with sensitive information.
Technical: The extension uses a wildcard pattern to match all URLs, granting access to sensitive user data. This is considered a critical risk if compromised. ⚠ 1
Your Data
The extension accesses browser storage and sends data to cdn.givefreely.com, geoip.maxmind.com, and shop.app. It also uses the Fetch API to make requests.
Technical Details
Code Findings
The extension assigns innerHTML to an element, which could potentially lead to a cross-site scripting (XSS) vulnerability if compromised.
Technical: The extension uses the element.innerHTML property to assign user-input data. This is a potential XSS vector if not properly sanitized.
💡 This pattern is commonly used in legitimate extensions for rendering HTML content.
The extension uses the Fetch API to make requests, which is a common and safe practice.
Technical: The extension uses the fetch function to make HTTP requests. This is a legitimate use of the Fetch API.
💡 1
The extension reads data from browser storage, which could potentially allow unauthorized access if compromised.
Technical: The extension uses the chrome.storage API to read data from browser storage. This grants access to sensitive user data.
💡 1
The extension writes data to browser storage, which could potentially allow unauthorized modification if compromised.
Technical: The extension uses the chrome.storage API to write data to browser storage. This grants access to sensitive user data.
💡 1
The extension removes data from browser storage, which could potentially allow unauthorized deletion if compromised.
Technical: The extension uses the chrome.storage API to remove data from browser storage. This grants access to sensitive user data.
💡 1
The extension may contain a hardcoded secret, which could potentially allow unauthorized access if compromised.
Technical: The extension contains a hardcoded API key. This is a potential security risk if not properly secured.
💡 1
The extension sets up event listeners, which is a common and safe practice.
Technical: The extension uses the addEventListener method to set up event listeners. This is a legitimate use of the API.
💡 1
Based on our analysis, we recommend exercising caution when using this extension due to its potential for data exposure and unauthorized access. While it provides useful features, the extension's permissions and code behavior raise some concerns that should be addressed by the developer.
