sonarqube - SonarJs 仍然显示有关 postMessage 跨域问题的警告

Question

错误消息是“确保这个跨域消息被发送到预期的域”。

此检查规则来自RSPEC-2819

Authors should not use the wildcard keyword ( *) in the targetOrigin argument in messages that contain any confidential information, as otherwise there is no way to guarantee that the message is only delivered to the recipient to which it was intended.

我假设它要求 * 不能用作 targetOrigin，但是当我使用预期域作为 targetOrigin 时它仍然显示警告，如下所示:

请有人告诉我如何通过此检查，

任何帮助将不胜感激

Answer 1

此规则仅检测是否在名称中包含 window 的对象上调用方法 postMessage。源代码:PostMessageCheck.java .要绕过它，只需将您的 contentWindow 对象分配给不同的对象，如下所示:

var content = this.elem.contentWindow;

content.postMessage('your message', window.location.origin);