Skip to content
Sarj Code Standards

no-message-origin-string-matching

Compare incoming browser message origins against exact trusted origins.

originMatch Rule source Tests Catalog JSON

Why

Prefix, suffix and substring checks do not establish an origin trust boundary. For example, https://trusted.example.attacker.invalid passes a prefix check against https://trusted.example.

Fix

Compare exact allowlisted origins or parse the origin and validate the intended scheme, host and port. Reject opaque null origins unless a separately verified source/capability contract establishes trust; do not require an experimental Origin API.

Examples

Before — flagged Review a spoofable origin prefix
src/listener.ts
window.addEventListener("message", (event) => {
  if (event.origin.startsWith("https://trusted.example")) accept(event.data);
});
After — preferred Compare an explicit trusted origin
src/listener.ts
window.addEventListener("message", (event) => {
  if (event.origin === "https://trusted.example") accept(event.data);
});

References