LGTM.com - false positive - js/unvalidated-message-origin wrongly detects window.chrome.webview.addEventListener('message' ...

[TimBarham]

Description of the false positive

Microsoft's webview2 provides a window.chrome.webview object which supports a "message" event for receiving messages from the host application. This is not the same as the window "message" event, and the event object doesn't support an origin property, but js/unvalidated-message-origin wrongly flags it.

URL to the alert on the project page on LGTM.com

This alert is not in a project that's on LGTM.com.

[asgerf]

Hi 👋

I can't quite reproduce the problem. When I scan the code below, I don't get any alerts from js/unvalidated-message-origin:

window.chrome.webview.addEventListener('message', event => {
    eval(event.data); // OK - not a cross-origin request
});

Could you create a small example that demonstrates the problem? Thanks