oxc-project/oxc · error · OxcDiagnostic

Missing the `targetOrigin` argument.

Error message

Missing the `targetOrigin` argument.

What it means

Emitted by the unicorn/require-post-message-target-origin rule at a `window.postMessage` call that omits the `targetOrigin` argument. It fires because without `targetOrigin` the message may be delivered to any origin, which is a security risk; the MDN reference is attached as a note.

Source

Thrown at crates/oxc_linter/src/rules/unicorn/require_post_message_target_origin.rs:12

use oxc_ast::{
    AstKind,
    ast::{Argument, Expression},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_span::{GetSpan, Span};

use crate::{AstNode, context::LintContext, rule::Rule};

fn require_post_message_target_origin_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Missing the `targetOrigin` argument.")
        .with_label(span)
        .with_note("https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage")
}

#[derive(Debug, Default, Clone)]
pub struct RequirePostMessageTargetOrigin;

declare_oxc_lint!(
    /// ### What it does
    ///
    /// Enforce using the `targetOrigin` argument with `window.postMessage()`.
    ///
    /// Note that this rule may have false positives, as it is not capable of
    /// detecting all cases correctly without type information. As such, it
    /// may not be a good idea to enable in cases where `postMessage()` may
    /// be used with `BroadcastChannel` or worker/service worker contexts
    /// (for example, `WorkerGlobalScope#postMessage`, where the second argument
    /// is a transfer list or options object, not `targetOrigin`).

View on GitHub (pinned to e1e7af627c)

Solutions

1. Pass an explicit origin, e.g. `win.postMessage(msg, 'https://example.com')`
2. Pass `'/'` only when the target window's origin is known to match

When it happens

Trigger: Thrown at crates/oxc_linter/src/rules/unicorn/require_post_message_target_origin.rs:12 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/f477a362d5063f15. Report an issue: GitHub.