Chad Bentz 9bffcf81b5 JavaScript: Recognize Angular @HostListener('window:message') as a postMessage handler ...

Angular registers window message handlers via the
@HostListener('window:message', ['\']) decorator rather than
window.addEventListener('message', ...). The PostMessageEventHandler class
only modeled the addEventListener and window.onmessage forms, so the decorated
handler's event parameter was never treated as a message source. As a result,
js/missing-origin-check produced no alert and the event was not a client-side
remote flow source for downstream queries (e.g. client-side URL redirection).

Extend PostMessageEventHandler to also recognize methods decorated with
@HostListener for 'window:message', 'document:message', or 'message'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-22 21:21:15 -04:00

..

examples

JS: Deprecate PathExpr and related classes

2025-04-29 13:23:47 +02:00

integration-tests

Merge branch 'main' into bazookamusic/cwe-1427

2026-06-11 12:05:57 +02:00

lib

JavaScript: Recognize Angular @HostListener('window:message') as a postMessage handler

2026-06-22 21:21:15 -04:00

src

Fix prompt injection severity

2026-06-17 12:52:33 +03:00

test

JavaScript: Recognize Angular @HostListener('window:message') as a postMessage handler

2026-06-22 21:21:15 -04:00