Security vulnerability in Chrome's JSONView extension?

#1

Post by Pyppe » Thu, Nov 10, 2016, 8:09 PM UTC

I've used daily the JSONView Chrome extension (previously available in https://chrome.google.com/webstore/detail/jsonview/chklaanhfefbnpoihckbnefhakgolnmc?hl=en) for viewing JSON.

Just now I noticed that it has been automatically disabled from my browser. Visiting `chrome://extensions/` states "This extension contains a serious security vulnerability". And also, it's no longer available in the Chrome Web Store (see link above).

Any idea, what's the vulnerability? I tried to google, but found no info about this...

Re: Security vulnerability in Chrome's JSONView extension?

#2

Post by Pyppe » Thu, Nov 10, 2016, 8:14 PM UTC

https://github.com/gildas-lormeau/JSONView-for-Chrome/pull/4... maybe it's about this XSS issue. Funny though, that the extension it's just now suddenly being pulled out.

I would've imagined this extension being used by A LOT of developers...

Re: Security vulnerability in Chrome's JSONView extension?

#3

Post by dacort » Thu, Nov 10, 2016, 8:17 PM UTC

Pyppe wrote: post #2

https://github.com/gildas-lormeau/JSONView-for-Chrome/pull/4... maybe it's about this XSS issue. Funny though, that the extension it's just now suddenly being pulled out. I would've imagined this extension being used by A LOT of developers...

Yea, my guess would be that's it. Coupled with the fact it hasn't been updated in ~3 years.

I've giving this one a shot, might have too much functionality for me though...I liked how bare-bones the other one was. https://chrome.google.com/webstore/detail/json-viewer/gbmdgp...

Re: Security vulnerability in Chrome's JSONView extension?

#4

Post by joelberger » Thu, Nov 10, 2016, 10:33 PM UTC

dacort wrote: post #3

Pyppe wrote: post #2

https://github.com/gildas-lormeau/JSONView-for-Chrome/pull/4... maybe it's about this XSS issue. Funny though, that the extension it's just now suddenly being pulled out. I would've imagined this extension being used by A LOT of developers...

Yea, my guess would be that's it. Coupled with the fact it hasn't been updated in ~3 years. I've giving this one a shot, might have too much functionality for me though...I liked how bare-bones the other one was. https://chrome.google.com/webstore/detail/json-viewer/gbmdgp...

Giving that one a try too. Thanks for the link.

Re: Security vulnerability in Chrome's JSONView extension?

#5

Post by vjt » Mon, Nov 14, 2016, 3:10 PM UTC

dacort wrote: post #3

Pyppe wrote: post #2

https://github.com/gildas-lormeau/JSONView-for-Chrome/pull/4... maybe it's about this XSS issue. Funny though, that the extension it's just now suddenly being pulled out. I would've imagined this extension being used by A LOT of developers...

Yea, my guess would be that's it. Coupled with the fact it hasn't been updated in ~3 years. I've giving this one a shot, might have too much functionality for me though...I liked how bare-bones the other one was. https://chrome.google.com/webstore/detail/json-viewer/gbmdgp...

I also like bare-bones stuff, and I am currently evaluating this https://chrome.google.com/webstore/detail/json-formatter/bcj... that is fast, easy on the eye and minimal. Haven't reviewed the code tho.