postMessage: origin checks and message-driven sinks

Mechanism

Window messaging crosses origin boundaries explicitly. A receiver must verify the sender origin and, where appropriate, its window source before interpreting message data. The sender must use a precise target origin when transmitting sensitive information. An unsafe receiver becomes exploitable only when the message reaches a consequential sink or state transition.

Practical method

Find message listeners and trace event.data into DOM writes, navigation, storage, or privileged actions. Inspect origin comparisons for exact scheme, host, and port matching. Use an inert message from a controlled lab origin and observe receiver state. Check structured data validation independently of origin validation.

window.addEventListener("message", event => {
  if (event.origin !== "https://trusted.lab") return;
  if (event.source !== trustedFrame.contentWindow) return;
  handleValidatedMessage(event.data);
});

Interpreting evidence

Acceptance of a marker demonstrates message reachability. Identify the actual sink before claiming XSS or another impact, and record whether the sending window relationship is required.

Pitfalls and limits

Substring origin comparisons accept misleading hosts. A trusted origin can contain multiple applications. Navigation can change a window origin between messages; wildcard target origins risk disclosing data.