search

jquery / sizzle

A sizzlin' hot selector engine.
https://sizzlejs.com
Other
6.29k stars 951 forks source link

Why is sizzle loading a script from massehight.com ? #470

Closed dimerman closed 4 years ago

dimerman commented 4 years ago

While developing I caught this fragment of network traffic. I couldn't find any information about the host massehight.com but looks like it's publishing metrics of some sort. I had a brief look at sizzle's code but couldn't find any reference to this. Am I misreading things?

Screen Shot 2020-04-26 at 10 31 03 AM

dmethvin commented 4 years ago

There's no information in the report so it's not a bug. A screen shot of a devtools panel does not tell us the version of Sizzle, where the script came from, what code it was called from, or other important things. You can put a breakpoint on the call to determine more.

dimerman commented 4 years ago

Turns out the chrome extension "Ultra Ad Block" was responsible for this. I see the version of sizzle used is not even supported. My concern was a malicious pull request that would have compromised the library. cheers.