content.js

// content.js - Injected into the active page to scan for vulnerabilities

// Function to check if a string looks like a JWT
function isJWT(token) {
  const parts = token.split('.');
  if (parts.length !== 3) return false;
  try {
    const header = JSON.parse(atob(parts[0]));
    const payload = JSON.parse(atob(parts[1]));
    return header && payload && header.alg;
  } catch (e) {
    return false;
  }
}

// Function to scan storage for sensitive info
function scanStorage(storage, storageName) {
  const findings = [];
  for (let i = 0; i < storage.length; i++) {
    const key = storage.key(i);
    const value = storage.getItem(key);
    
    // Check for JWTs
    if (isJWT(value)) {
      findings.push({ key, value, issue: 'JWT found in ' + storageName + ' (Vulnerable to XSS)' });
    }
    
    // Check for obvious unencrypted sensitive data keywords
    const lowerKey = key.toLowerCase();
    if (lowerKey.includes('password') || lowerKey.includes('secret') || lowerKey.includes('token') || lowerKey.includes('auth')) {
       // Only flag if it doesn't look like a properly encrypted or hashed value (simple heuristic)
       if (value.length < 100 && !value.startsWith('enc_') && !isJWT(value)) {
          findings.push({ key, value, issue: 'Potential unencrypted sensitive data in ' + storageName });
       }
    }
  }
  return findings;
}

chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {
  if (request.action === "scanVulnerabilities") {
    const localScan = scanStorage(localStorage, 'localStorage');
    const sessionScan = scanStorage(sessionStorage, 'sessionStorage');
    const cookieString = document.cookie;
    
    // Check document.cookie exposure (Cookies accessible via JS)
    const accessibleCookies = [];
    if (cookieString) {
      cookieString.split(';').forEach(c => {
        accessibleCookies.push({
           cookie: c.trim(),
           issue: 'Cookie accessible via document.cookie (Missing HttpOnly flag)'
        });
      });
    }

    sendResponse({
      localStorage: localScan,
      sessionStorage: sessionScan,
      documentCookies: accessibleCookies
    });
  }
});