---
title: "JavaScript – Avoid Unrestricted targetOrigin On Cross-Domain Messaging – Catalog UI Policy scriptFalse"
description: "Impact Area Security Severity High Affected Element Catalog UI Policy ## Rule number **SN-0357** ## Impact HTML5 adds the ability to send messages to documents served from other domains. If improperly used, this can cause a data leak. ## Remediation…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/javascript-avoid-unrestricted-targetorigin-on-cross-domain-messaging-catalog-ui-policy-scriptfalse/"
updated: "2025-03-21"
category: Best Practices Rules / JavaScript Rules
---

# JavaScript – Avoid Unrestricted targetOrigin On Cross-Domain Messaging – Catalog UI Policy scriptFalse

Impact Area

Security

           Severity

High

           Affected Element

Catalog UI Policy

## Rule number

**SN-0357**

## Impact

HTML5 adds the ability to send messages to documents served from other domains. If improperly used, this can cause a data leak.

## Remediation

Do not use unrestricted targetOrigin calls.

### Time to fix

20 min

## References

This rule is linked to [Common Weakness Enumeration CWE-1021 Improper Restriction of Rendered UI Layers or Frames](https://cwe.mitre.org/data/definitions/1021.html).

## Code examples

### Noncompliant code

When sending message: var iframe = document.getElementById(“testiframe”); iframe.contentWindow.postMessage(“secret”, “*”); // Noncompliant: * is used

When receiving message: window.addEventListener(“message”, function(event) { // Noncompliant: no checks are done on the origin property. console.log(event.data); });

### Compliant code

When sending message: var iframe = document.getElementById(“testsecureiframe”); iframe.contentWindow.postMessage(“hello”, “https://secure.example.com”); // Compliant

When receiving message: window.addEventListener(“message”, function(event) { if (event.origin !== “http://example.org”) // Compliant return; });