react-doctor/postmessage-origin-risk

Reading `event.data` in a `message` handler without checking `event.origin` lets any other window send data your code trusts, which can lead to cross-site scripting or data theft.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires when a message handler: a *.addEventListener('message', ...) call or a *.onmessage = assignment: reads event.data (also matched on e/evt/msg/message.data) without an origin/sender check appearing before that read. An origin check is any origin reference (a helper call like isTrustedOrigin(event) or a destructured binding; original is excluded) or an event.source ===/!== comparison; if the check is ordered after the first .data read it still fires. Same-application channels are exempt: MessagePort/Worker/BroadcastChannel/WebSocket/EventSource/SSE targets (port, worker, channel, broadcast, socket, ws, sse, eventsource, self.onmessage, source.) and files whose path contains "worker" are skipped.

Suppress when: real origin validation the static check can't see textually before the read: e.g. it lives in a deeply nested helper whose name lacks "origin", or the first .data access is benign (logging) and a genuine guard follows; confirm only when event.data is consumed with no exact-origin allowlist check.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

At the top of the handler, compare event.origin for exact equality against a known origin (if (event.origin !== EXPECTED_ORIGIN) return;), never an endsWith/includes/regex match an attacker domain can satisfy. Optionally also confirm event.source is the expected window or iframe. Treat any parent or child frame as attacker-controlled and read event.data only after the check passes.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.