mirror of
https://github.com/github/codeql.git
synced 2026-06-28 16:17:03 +02:00
9bffcf81b5
Angular registers window message handlers via the
@HostListener('window:message', ['\']) decorator rather than
window.addEventListener('message', ...). The PostMessageEventHandler class
only modeled the addEventListener and window.onmessage forms, so the decorated
handler's event parameter was never treated as a message source. As a result,
js/missing-origin-check produced no alert and the event was not a client-side
remote flow source for downstream queries (e.g. client-side URL redirection).
Extend PostMessageEventHandler to also recognize methods decorated with
@HostListener for 'window:message', 'document:message', or 'message'.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
6 lines
368 B
Plaintext
6 lines
368 B
Plaintext
| Angular.ts:8:19:8:23 | event | Postmessage handler has no origin check. |
|
|
| Angular.ts:13:21:13:25 | event | Postmessage handler has no origin check. |
|
|
| tst.js:11:20:11:24 | event | Postmessage handler has no origin check. |
|
|
| tst.js:24:27:24:27 | e | Postmessage handler has no origin check. |
|
|
| tst.js:40:27:40:27 | e | Postmessage handler has no origin check. |
|