search

mallorybowes / chrome-mal-ids

Effort to list and aggregate known malicious Google Chrome Extension IDs
49 stars 14 forks source link

rewrite and add a bunch of features #15

Closed gnyman closed 3 years ago

gnyman commented 3 years ago

this is a bit bigger commit than I wanted but, one change lead to another and then everything got tangled up.

the changes are

  1. instead of using a list of just bad-extension id's, we use the current-list-meta.csv which has some info about the extensions it finds, i.e. name and link to more info, we now display that info if we find a bad extension

  2. instead of using a separate checksum file, we just check that the header matches the meta file, that removes the shasum dependency

  3. replaced the OS checking to decide which paths to check with logic that just scans all known paths that exists. This should make it easier to add other OS's and Chromium browsers which might use the Chrome web store. Currently it scans Brave extensions in OS X and Ubuntu when Brave is installed with snap

  4. instead of downloading the list of bad extensions every time, it now downloads current-list-meta.csv into /tmp/bad-chrome-extensions.csv and use curl -z to avoid downloading it again if it hasn't changed.

gnyman commented 3 years ago

Hi! Thanks for your work on collecting the list of bad extensions! Really useful.

I tried running the script on OS X Mojave but failed because my shasum does not have the -p. (turned out because I have shasum from brew) and I started doing some fixes and ended up rewriting a lot of the script. So here is a PR with some ideas on how to improve (if all changes are improvements or not can be discussed :-) things.

No idea if these changes are anything you want to incorporate, if not, I won't take offence if you just close PR or even if you would just take some parts of it.

mallorybowes commented 3 years ago

Hi and thanks for your work! Sorry I've been out of pocket a bit lately but I wanted to let you know I see your requests and I'll sit down and run through your additions after I get out of work tonight. I hope to have either merged your additions or have comments for you tomorrow. (I don't have OSX around but I do want to give it a quick test on my linux box.)

Thanks again!

mallorybowes commented 3 years ago

Thank you so much for your updates!