github / github/codeql

LGTM.com - false positive - js/unvalidated-message-origin wrongly detects window.chrome.webview.addEventListener('message' ...

Open
#9,541 1 comment 0 reactions 1 assignee Claimed by @asgerf View on GitHub
false-positive JS
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the false positive**

Microsoft's webview2 provides a `window.chrome.webview` object which supports a "message" event for receiving messages from the host application. This is not the same as the `window` "message" event, and the event object doesn't support an `origin` property, but js/unvalidated-message-origin wrongly flags it.

**URL to the alert on the project page on LGTM.com**

This alert is not in a project that's on LGTM.com.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.