{"record":{"id":"f477a362d5063f15","repo":"oxc-project/oxc","slug":"missing-the-targetorigin-argument","errorCode":null,"errorMessage":"Missing the `targetOrigin` argument.","messagePattern":"Missing the `targetOrigin` argument\\.","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"error","filePath":"crates/oxc_linter/src/rules/unicorn/require_post_message_target_origin.rs","lineNumber":12,"sourceCode":"use oxc_ast::{\n    AstKind,\n    ast::{Argument, Expression},\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_span::{GetSpan, Span};\n\nuse crate::{AstNode, context::LintContext, rule::Rule};\n\nfn require_post_message_target_origin_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Missing the `targetOrigin` argument.\")\n        .with_label(span)\n        .with_note(\"https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage\")\n}\n\n#[derive(Debug, Default, Clone)]\npub struct RequirePostMessageTargetOrigin;\n\ndeclare_oxc_lint!(\n    /// ### What it does\n    ///\n    /// Enforce using the `targetOrigin` argument with `window.postMessage()`.\n    ///\n    /// Note that this rule may have false positives, as it is not capable of\n    /// detecting all cases correctly without type information. As such, it\n    /// may not be a good idea to enable in cases where `postMessage()` may\n    /// be used with `BroadcastChannel` or worker/service worker contexts\n    /// (for example, `WorkerGlobalScope#postMessage`, where the second argument\n    /// is a transfer list or options object, not `targetOrigin`).","sourceCodeStart":1,"sourceCodeEnd":30,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/unicorn/require_post_message_target_origin.rs#L1-L30","documentation":"Emitted by the unicorn/require-post-message-target-origin rule at a `window.postMessage` call that omits the `targetOrigin` argument. It fires because without `targetOrigin` the message may be delivered to any origin, which is a security risk; the MDN reference is attached as a note.","triggerScenarios":"Thrown at crates/oxc_linter/src/rules/unicorn/require_post_message_target_origin.rs:12 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass an explicit origin, e.g. `win.postMessage(msg, 'https://example.com')`","Pass `'/'` only when the target window's origin is known to match"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}