VNX-940: Cross-window message handler does not verify the sender's origin

Reports a browser window 'message' listener (addEventListener, onmessage, jQuery .on) whose handler never reads event.origin or event.source.

Field	Value
Rule ID	`VNX-940`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript
CWE	CWE-940
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`postmessage` `origin` `cwe-940`
Source	`internal/sast/rules/vnx-940.rego`

Overview

VNX-940 maps to CWE-940: Improper Verification of Source of a Communication Channel. A window message event can be sent by any page that frames or opens this one. A handler that acts on event.data without checking event.origin takes commands from any site.

What Gets Flagged

window.addEventListener('message', function (event) {   // flagged
  document.getElementById('out').innerHTML = event.data.html;
});

window.addEventListener("message", receive, false);      // flagged when receive() never reads origin
window.onmessage = function (e) { ... };                 // flagged

Not flagged: a handler that reads event.origin (or a destructured { origin }) or compares event.source; a named handler the file does not define; message events of Workers, WebSockets, MessagePorts, BroadcastChannels, Node child processes and worker scripts (self.addEventListener); comments and string literals. VNX-NODE-024 reports the same listener shape alongside wildcard postMessage targets.

Remediation

window.addEventListener('message', (event) => {
  if (event.origin !== 'https://app.example.com') return;
  handle(event.data);
});

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-940
// nosec vnx-940

Or record an ignore rule: vulnetix ignore add --rule vnx-940 --reason "...". See Suppressing findings.