mirror of
https://github.com/github/codeql.git
synced 2026-06-16 18:31:07 +02:00
57 lines
1.9 KiB
XML
57 lines
1.9 KiB
XML
<!DOCTYPE qhelp PUBLIC
|
|
"-//Semmle//qhelp//EN"
|
|
"qhelp.dtd">
|
|
<qhelp>
|
|
|
|
<overview>
|
|
<p>
|
|
The <code>window.postMessage</code> method allows different windows or iframes
|
|
to communicate directly, even if they were loaded from different origins, circumventing
|
|
the usual same-origin policy.
|
|
</p>
|
|
<p>
|
|
The sender of the message can restrict the origin of the receiver by specifying
|
|
a target origin. If the receiver window does not come from this origin, the
|
|
message is not sent.
|
|
</p>
|
|
<p>
|
|
Alternatively, the sender can specify a target origin of <code>'*'</code>, which means
|
|
that any origin is acceptable and the message is always sent.
|
|
</p>
|
|
<p>
|
|
This feature should not be used if the message being sent contains sensitive data such
|
|
as user credentials: the target window may have been loaded from a malicious site,
|
|
to which the data would then become available.
|
|
</p>
|
|
</overview>
|
|
|
|
<recommendation>
|
|
<p>
|
|
If possible, specify a target origin when using <code>window.postMessage</code>.
|
|
Alternatively, encrypt the sensitive data before sending it to prevent an unauthorized
|
|
receiver from accessing it.
|
|
</p>
|
|
</recommendation>
|
|
|
|
<example>
|
|
<p>
|
|
The following example code sends user credentials (in this case, their user
|
|
name) to <code>window.parent</code> without checking its origin. If a malicious site
|
|
loads the page containing this code into an iframe it would be able to gain access
|
|
to the user name.
|
|
</p>
|
|
<sample src="examples/PostMessageStar.js"/>
|
|
<p>
|
|
To prevent this from happening, the origin of the target window should be restricted,
|
|
as in this example:
|
|
</p>
|
|
<sample src="examples/PostMessageStarGood.js"/>
|
|
</example>
|
|
|
|
|
|
<references>
|
|
<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage">Window.postMessage</a>.</li>
|
|
<li>Mozilla Developer Network: <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy">Same-origin policy</a>.</li>
|
|
</references>
|
|
</qhelp>
|