Save To Google Drive

What This Extension Does

Permissions Explained

• contextMenus: Allows the extension to create custom context menus in the browser.
• identity: Grants access to the user's identity and authentication information, which is unusual for a productivity-focused extension like this. This permission is typically used by extensions that interact with external services requiring authentication (e.g., password managers).
• printerProvider: Enables the extension to provide print functionality, which seems unnecessary given its primary function of saving content to Google Drive.
• notifications: Allows the extension to display notifications in the browser.
• pageCapture: Grants permission for the extension to capture screenshots or web pages, aligning with its purpose.
• storage: Provides access to the user's storage, necessary for storing captured content locally before uploading it to Google Drive.
• tabs: Enables the extension to interact with open tabs and windows in the browser.
• webRequest: Allows the extension to intercept and modify HTTP requests, which is high-risk. This permission is typically used by extensions that need to inspect or manipulate network traffic for security reasons (e.g., ad blockers).
• scripting: Grants access to scripting capabilities within the browser context, unusual for a productivity-focused extension.
• <all_urls>: A critical risk due to its broad scope, allowing the extension to access any URL on the web. This is typically used by extensions that need to inspect or manipulate all network traffic (e.g., debugging tools).

What We Found in the Code

• [high] eval() used — can execute arbitrary code: The use of eval() is concerning because it allows for the execution of arbitrary JavaScript code, which could lead to security vulnerabilities if misused. However, without more context, it's difficult to determine whether this is a legitimate use case or not.
• [info] Makes HTTP requests: This flag indicates that the extension makes HTTP requests, which is normal behavior for extensions that interact with external services (like Google Drive).

External Connections

• www.w3.org: A standard domain for web development resources and specifications.
• github.com: Could be related to the extension's development or dependencies.
• www.googleapis.com and drive.google.com: Expected domains for interacting with Google services, including authentication and file storage.
• support.google.com: Unusual; it might indicate an attempt to communicate with Google's support systems, which could be a security risk if not properly handled.
• csp.withgoogle.com: Also unusual; this domain is related to Content Security Policy (CSP) configuration. While CSP is used for security purposes, the extension's interaction with this domain seems out of place given its primary function.

Things to Consider

• The broad scope of <all_urls> permission is concerning, as it could allow the extension to access sensitive information or perform actions beyond its intended functionality.
• The use of eval() in the code is a potential security risk if not properly managed.
• The unusual permissions (identity, scripting) and external connections (support.google.com, csp.withgoogle.com) suggest that the extension might be doing more than just saving content to Google Drive. Users should carefully evaluate whether these additional features are necessary or beneficial for their needs.