@Deanyu148/dsh-balance-inquiry

The 'custom' provider path (queryScript) compiles and runs arbitrary JavaScript taken from the persisted account field customScript inside the DSH web origin, where it can read every stored API key, call the host proxy with any URL, and call window.open. The value is stored in localStorage and re-executed automatically by the refresh interval (setTimeout arm/refresh) without further user action; buildScriptWithVars also interpolates accessToken/userId into the script source before compilation, so a token containing quote characters can break out of the string literal and inject code.

normalizeAccount/commitAccounts persist the full account objects (accessToken, accessKeyId, secretAccessKey, userId) as plaintext JSON under dsh-balance-inquiry:accounts, and the settings UI only masks them visually (password input). Any script running in the same origin — including the plugin's own new Function script path and any other plugin or XSS in the DSH UI — can read all credentials with one localStorage.getItem call, and the long-lived Volcengine SecretAccessKey stays on disk indefinitely.

queryNewApi and queryScript enforce isHttpsOrLocal before sending credentials, but cpQueryZenmux concatenates the raw config.baseUrl, so a plain http:// (or arbitrary) endpoint is accepted and the bearer token is sent in cleartext to that host; the same unchecked baseUrl is also parsed for the Volcengine region and the Zhipu host choice. Reachable only through the user's own configuration, so impact is limited.

sendViaHost lets the page ask the DSH host process to perform an arbitrary HTTP request (arbitrary URL, method and headers, including those produced by a custom script) on the local machine, which is a general SSRF/proxy primitive if the host route in lib/index.js does not enforce a host allowlist; that file was not harvested, so no allowlist could be verified or refuted. Reachable by any script in the origin, not only by legitimate balance queries.