LGTM.com - false positive - js/unvalidated-message-origin wrongly detects window.chrome.webview.addEventListener('message' ... #9541
Assignees
Labels
Comments
|
Hi I can't quite reproduce the problem. When I scan the code below, I don't get any alerts from window.chrome.webview.addEventListener('message', event => {
eval(event.data); // OK - not a cross-origin request
});Could you create a small example that demonstrates the problem? Thanks |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description of the false positive
Microsoft's webview2 provides a
window.chrome.webviewobject which supports a "message" event for receiving messages from the host application. This is not the same as thewindow"message" event, and the event object doesn't support anoriginproperty, but js/unvalidated-message-origin wrongly flags it.URL to the alert on the project page on LGTM.com
This alert is not in a project that's on LGTM.com.
The text was updated successfully, but these errors were encountered: