JavaScript: Recognize Angular @HostListener('window:message') as a postMessage handler#22036
Open
felickz wants to merge 2 commits into
Open
JavaScript: Recognize Angular @HostListener('window:message') as a postMessage handler#22036felickz wants to merge 2 commits into
felickz wants to merge 2 commits into
Conversation
…stMessage handler Angular registers window message handlers via the @HostListener('window:message', ['\']) decorator rather than window.addEventListener('message', ...). The PostMessageEventHandler class only modeled the addEventListener and window.onmessage forms, so the decorated handler's event parameter was never treated as a message source. As a result, js/missing-origin-check produced no alert and the event was not a client-side remote flow source for downstream queries (e.g. client-side URL redirection). Extend PostMessageEventHandler to also recognize methods decorated with @HostListener for 'window:message', 'document:message', or 'message'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the JavaScript DOM dataflow modeling to recognize Angular @HostListener(...message...)-decorated methods as postMessage event handlers, ensuring the handler’s event parameter is treated as a message-event source for security queries like js/missing-origin-check.
Changes:
- Updated the
PostMessageEventHandlermodel to match Angular@HostListener-decorated message handlers. - Added an Angular-specific regression test case for missing-origin-check behavior and updated expected results.
- Added a change note documenting the new modeling support.
Show a summary per file
| File | Description |
|---|---|
| javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll | Extends postMessage handler recognition to include Angular @HostListener(...message...) decorated methods. |
| javascript/ql/test/query-tests/Security/CWE-020/MissingOriginCheck/Angular.ts | Adds Angular HostListener examples to exercise the missing-origin-check query. |
| javascript/ql/test/query-tests/Security/CWE-020/MissingOriginCheck/MissingOriginCheck.expected | Updates expected alert locations to include the new Angular test cases. |
| javascript/ql/lib/change-notes/2026-06-22-angular-hostlistener-postmessage.md | Documents the added Angular HostListener postMessage handler support. |
Copilot's findings
- Files reviewed: 4/4 changed files
- Comments generated: 2
…sage targets Drop the plain 'message' event name from the @HostListener matcher. The postMessage 'message' event is dispatched on window and does not bubble, so an element-level @HostListener('message') does not receive cross-window messages. Keeping only 'window:message' and 'document:message' makes the model more precise and matches the accompanying comment and change note. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Angular applications commonly receive cross-window
postMessagedata through a handler registered with the@HostListener('window:message', ['$event'])decorator rather thanwindow.addEventListener('message', ...).The
PostMessageEventHandlerclass (inDOM.qll) only modeled theaddEventListener('message', ...)andwindow.onmessage = ...forms. As a result, the decorated handler's event parameter was not recognized as a message-event source, which meant:js/missing-origin-checkproduced no alert for the missingevent.origincheck, andClientSideRemoteFlowSource, so downstream taint queries (e.g.js/client-side-unvalidated-url-redirection) did not flag flows from the message payload to sinks such aswindow.open/window.location.href.Change
Extend
PostMessageEventHandlerto also recognize a method decorated with@HostListenerfrom@angular/corewhen the event name is'window:message'or'document:message'. The decorated method's first parameter is theMessageEvent, equivalent to theaddEventListener('message', ...)form.Impact
On a sample Angular app where a
@HostListener('window:message')handler forwards the payload to navigation / URL-opening logic without an origin check:js/missing-origin-checknow reports the handler (previously missed).js/client-side-unvalidated-url-redirectionnow reports two flows from the message event towindow.open(msg.url, ...)andwindow.location.href = msg.url(previously missed).Test
Added
Angular.tsto theMissingOriginCheckquery test covering:@HostListener('window:message', ...)without an origin check: alert@HostListener('document:message', ...)without an origin check: alert@HostListener('window:message', ...)with anevent.originequality check: no alert@HostListener('window:resize', ...)(not a message event): no alert