Micro Focus WebInspect vulnerability

[vm6ej04]

Hello people. I've encountered a problem just recently.
We have most of our websites(React.js) go through security scan as one of the requirements.

One vulnerability was found

Medium Issues

HTML5: Overly Permissive Message Posting Policy ( 11347 ) View Description
CWE: 942
Page: Function:Window.postMessage

Fix

All data that is shared between windows must have explicit origins to avoid eavesdropping. It is recommended to avoid using “*” for the targetOrigin in order to prevent a broadcast of the information.

I spent some time just to find where it is, it's not in our sourcecode nor any node_modules.
It only shows up after we run the next build.
Then it hit me... how / where do I go about changing that myself?
Any ideas are appreciated, thank you in advance!

[timneutkens]

There's no postmessage in Next.js: https://github.com/zeit/next.js/search?q=postMessage&unscoped_q=postMessage

Probably you're including an external library through a <script> tag yourself.

[vm6ej04]

hmm... ok that's odd...
it's located here /_next/static/chunks/commons.db2967273688b40e00a2.js
so I assumed Next.js generated it.
Thanks for your reply though! I'll go back and keep looking.

[timneutkens]

commons includes common dependencies of your application

[vm6ej04]

Just found out that, Visual Studio Code excludes /node_modules/ when it searches through all files.
And there are many many modules uses .postMessage().