VNX-941: Message sent without specifying its intended recipient

Reports postMessage(data, '*') to another window, and Android implicit broadcasts that carry extras with no receiver permission or target package.

Field	Value
Rule ID	`VNX-941`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Java, Kotlin
CWE	CWE-941
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`postmessage` `android` `broadcast` `cwe-941`
Source	`internal/sast/rules/vnx-941.rego`

Overview

VNX-941 maps to CWE-941: Incorrectly Specified Destination in a Communication Channel. Data sent over a channel whose destination is left open is delivered to whoever is listening: the page a popup or iframe now shows, or any installed app that registers for a broadcast action.

What Gets Flagged

window.opener.postMessage({ type: 'oauth', token }, '*');   // flagged
frame.contentWindow.postMessage(session, '*');               // flagged

Intent changed = new Intent("com.example.PASSWORD_CHANGED");
changed.putExtra("password", newPassword);
sendBroadcast(changed);                                      // flagged

Not flagged: postMessage with an explicit target origin; postMessage to the page’s own window and Worker/MessagePort postMessage; explicit Intents (new Intent(ctx, X.class), setPackage, setComponent); broadcasts with a receiver permission; LocalBroadcastManager; intents without extras; comments and string literals.

Remediation

Name the recipient: pass the expected origin to postMessage, and send broadcasts with setPackage(...), a receiver permission, or LocalBroadcastManager.

window.opener.postMessage({ type: 'oauth', token }, 'https://app.example.com');

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-941
// nosec vnx-941

Or record an ignore rule: vulnetix ignore add --rule vnx-941 --reason "...". See Suppressing findings.