MDN URL <a href="https://developer.mozilla.org/en-US/docs/Web/API/

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

MDN URL <a href="https://developer.mozilla.org/en-US/

terms "this", "target", "recipient", "window", "origin" appear indistinctly used about content HOT 2 OPEN

u-an-i commented on July 20, 2024

terms "this", "target", "recipient", "window", "origin" appear indistinctly used

from content.

Comments (2)

u-an-i commented on July 20, 2024 1

@Ashish-CodeJourney i thank you. i added a "review".

from content.

Ashish-CodeJourney commented on July 20, 2024

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

What specific section or headline is this issue about?

multiple

What information was incorrect, unhelpful, or incomplete?

targetOrigin Optional
Specifies what the origin of this window must be for the event to be dispatched,

"this"

Any window (including, for example, http://evil.example.com) can send a message to any other window

"window"

What did you expect to see?

depending on what is really meant, I expected to see "this" replaced by "the intended recipient" and "window" replaced by "contentWindow within the iframe hierarchy from top to every iframe below of the current document"

Do you have any supporting links, references, or citations?

no

Do you have anything more you want to share?

"window": can a post occur to another tab? another users PC's tab? a server? any browser's having the same document open?

how is targetOrigin safety? If the iframe src can be changed away while posting to its contentWindow or the to-be-sender's page is copied and run on a malicious host, that host can simply replace the text inside the JavaScript code of postMessage.

postMessage operates on a contentWindow already obtained. It is not BroadcastChannel.

MDN metadata

Page report details