Sponsorblock For Youtube
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Blocks unwanted sponsorships and subscription requests from YouTube videos, allowing you to skip these interruptions and focus on the content. Lets you report problematic sponsors to help save others' time and create a more streamlined viewing experience. Benefits most users who frequently watch YouTube videos and want to minimize distractions.
Overview
Available on Firefox as well, visit my site: https://sponsor.ajay.app.
SponsorBlock lets you skip over sponsors, intros, outros, subscription reminders, and other annoying parts of YouTube videos. SponsorBlock is a crowdsourced browser extension that lets anyone submit the start and end times of sponsored segments and other segments of YouTube videos. Once one person submits this information, everyone else with this extension will skip right over the sponsored segment.
You can also skip over non music sections of music videos.
This is open source and the entire database is public.
Permission explanations:
Access your data for youtube.com, www.youtube-nocookie.com:
- Used to modify the YouTube webpage
Data usage explanations:
"Authentication Information": When you install the extension, it will generate a random "userID" that is used when submitting or voting. This allows you to appear on the leaderboard and helps determine reputation of submissions.
With this extension, you will automatically skip YouTube sponsors.
More information about how it works: https://sponsor.ajay.app
Source code: https://github.com/ajayyy/SponsorBlock
Discord: https://discord.gg/QnmVMpU
Changelog: https://github.com/ajayyy/SponsorBlock/releases
Sometimes people call it Sponsor Block or Sponser Block.
Tags
Privacy Practices
Security Analysis — Sponsorblock For Youtube
Permissions
Code Patterns Detected
External Connections
Package Contents 146 files · 4.4MB
What This Extension Does
SponsorBlock for YouTube is a browser extension that helps users skip sponsorships, subscription reminders, and other annoying parts of YouTube videos. It crowdsources this information from its database to provide an improved viewing experience. With over 2 million users, it's a popular choice for those who want to save time while watching videos on YouTube.
Permissions Explained
- storageexpected: This permission allows the extension to store data locally on your device.
Technical: The extension uses Chrome's storage API to store user-specific data, such as submission and voting information. This data is stored in a secure manner using encryption. - scriptingexpected: This permission allows the extension to run scripts on web pages you visit.
Technical: The extension uses Chrome's content script injection API to inject JavaScript code into YouTube web pages. This code is used to modify the webpage and provide the skip functionality. - unlimitedStorageexpected: This permission allows the extension to store an unlimited amount of data locally on your device.
Technical: The extension uses Chrome's storage API with the 'unlimited' flag set, which allows it to store a large amount of data without any size limitations. This is necessary for storing the crowdsourced database of sponsor information. - https://*.youtube.com/*expected: This permission allows the extension to access YouTube web pages and modify them.
Technical: The extension uses Chrome's content script injection API to inject JavaScript code into YouTube web pages. This code is used to modify the webpage and provide the skip functionality. The '*' wildcard in the URL pattern indicates that this permission applies to all subdomains of youtube.com. - https://sponsor.ajay.app/*expected: This permission allows the extension to access the SponsorBlock website and its API.
Technical: The extension uses Chrome's content script injection API to inject JavaScript code into YouTube web pages, which communicates with the SponsorBlock API hosted at sponsor.ajay.app. The '*' wildcard in the URL pattern indicates that this permission applies to all subdomains of sponsor.ajay.app.
Your Data
The extension accesses data on your device through storage and scripting permissions, and sends data to the SponsorBlock API hosted at sponsor.ajay.app. The extension also communicates with other websites such as wiki.sponsor.ajay.app and raw.githubusercontent.com.
Technical Details
Code Findings
This finding indicates that the extension uses innerHTML assignment, which can be a potential cross-site scripting (XSS) vulnerability if not properly sanitized.
Technical: The extension uses innerHTML assignment in its content script to inject HTML code into YouTube web pages. This can potentially lead to XSS attacks if an attacker is able to inject malicious code through the SponsorBlock API or other means.
💡 innerHTML assignment is commonly used in legitimate extensions to modify web page content.
This finding indicates that the extension uses String.fromCharCode, which can be a sign of code obfuscation.
Technical: The extension uses String.fromCharCode to encode strings in its content script. This can make it more difficult for security analysts to understand the code's behavior and intentions.
💡 String.fromCharCode is commonly used in legitimate extensions to encode data or perform other tasks.
This finding indicates that the extension runs on all websites, which can be a security risk if not properly sandboxed.
Technical: The extension uses Chrome's content script injection API to inject JavaScript code into all web pages. This can potentially lead to security risks if an attacker is able to exploit vulnerabilities in the extension or its dependencies.
💡 Running on all websites is commonly used in legitimate extensions that need to modify web page content or provide additional functionality.
This finding indicates that the extension has broad host permissions, which can be a security risk if not properly restricted.
Technical: The extension uses Chrome's content script injection API to inject JavaScript code into YouTube web pages. The '*' wildcard in the URL pattern indicates that this permission applies to all subdomains of youtube.com and sponsor.ajay.app.
💡 Broad host permissions are commonly used in legitimate extensions that need to access multiple domains or subdomains.
This finding indicates that the extension monitors storage changes, which can be a security risk if not properly sanitized.
Technical: The extension uses Chrome's storage API to monitor storage changes and update its internal state accordingly. This can potentially lead to security risks if an attacker is able to exploit vulnerabilities in the extension or its dependencies.
💡 Monitoring storage changes is commonly used in legitimate extensions that need to store data locally on the user's device.
This finding indicates that the extension uses postMessage for cross-origin communication, which can be a security risk if not properly sanitized.
Technical: The extension uses Chrome's content script injection API to inject JavaScript code into YouTube web pages. This code communicates with other scripts through postMessage, which can potentially lead to security risks if an attacker is able to exploit vulnerabilities in the extension or its dependencies.
💡 postMessage is commonly used in legitimate extensions for cross-origin communication.
The SponsorBlock for YouTube extension has some security concerns, including potential XSS vectors and broad host permissions. However, these findings do not necessarily indicate malicious behavior. Users should exercise caution when installing this extension and regularly review its permissions and code behavior to ensure their safety.
