Security issues: old libraries, CSP...

cloudtracer / ThreatPinchLookup

Documentation and Sharing Repository for ThreatPinch Lookup Chrome & Firefox Extension

362 stars 80 forks source link

Open juju4 opened 3 years ago

juju4 commented 3 years ago

Uncertain if still maintained but there are multiple issues identified from https://crxcavator.io/report/ljdgplocfnmnofbhpkjclbefmjoikgke/3.0.6

many vulnerabilities associated to retirejs: bootstrap, jquery, moment, background
permissive content-security policy. something like https://github.com/ninoseki/mitaka/pull/477/files would help
less rated but possible entry points, external javascript on https://oss.maxcdn.com

Would be great to fix. Thanks!