JS-2205 USER-2389 Support Window onmessage in S2819

packages/analysis/src/jsts/rules/S2819/rule.ts

@@ -24,6 +24,7 @@ import { generateMeta } from '../helpers/generate-meta.js';
 import { getTypeAsString } from '../helpers/type.js';
 import {
   getValueOfExpression,
+  getUniqueWriteUsageOrNode,
   isIdentifier,
   isIfStatement,
   resolveFunction,
@@ -33,6 +34,7 @@ import * as meta from './generated-meta.js';
 
 const POST_MESSAGE = 'postMessage';
 const ADD_EVENT_LISTENER = 'addEventListener';
+const ON_MESSAGE = 'onmessage';
 
 export const rule: Rule.RuleModule = {
   meta: generateMeta(meta, {
@@ -54,6 +56,9 @@ export const rule: Rule.RuleModule = {
       [`CallExpression[callee.property.name="${ADD_EVENT_LISTENER}"]`]: (node: estree.Node) => {
         checkAddEventListenerCall(node as estree.CallExpression, context);
       },
+      AssignmentExpression: (node: estree.Node) => {
+        checkOnMessageAssignment(node as estree.AssignmentExpression, context);
+      },
     };
   },
 };
@@ -100,9 +105,36 @@ function checkAddEventListenerCall(callExpr: estree.CallExpression, context: Rul
     return;
   }
 
-  let listener = resolveFunction(context, args[1]);
+  checkMessageListener(context, args[1], callee);
+}
+
+function checkOnMessageAssignment(
+  assignment: estree.AssignmentExpression,
+  context: Rule.RuleContext,
+) {
+  const { left } = assignment;
+  if (
+    assignment.operator !== '=' ||
+    left.type !== 'MemberExpression' ||
+    left.computed ||
+    left.property.type !== 'Identifier' ||
+    left.property.name !== ON_MESSAGE ||
+    !isWindowObject(left.object, context)
+  ) {
+    return;
+  }
+
+  checkMessageListener(context, assignment.right, left);
+}
+
+function checkMessageListener(
+  context: Rule.RuleContext,
+  listenerNode: estree.Node,
+  reportNode: estree.Node,
+) {
+  let listener = resolveFunction(context, getUniqueWriteUsageOrNode(context, listenerNode));
   if (listener?.body.type === 'CallExpression') {
-    listener = resolveFunction(context, listener.body);
+    listener = resolveFunction(context, getUniqueWriteUsageOrNode(context, listener.body));
   }
   if (!listener || listener.params.length === 0) {
     return;
@@ -115,7 +147,7 @@ function checkAddEventListenerCall(callExpr: estree.CallExpression, context: Rul
 
   if (!hasVerifiedOrigin(context, listener, event)) {
     context.report({
-      node: callee,
+      node: reportNode,
       messageId: 'verifyOrigin',
     });
   }

packages/analysis/src/jsts/rules/S2819/unit.test.ts

@@ -68,6 +68,42 @@ describe('S2819', () => {
         },
         {
           code: `
+      window.onmessage = function(event) {
+        if (event.origin !== "http://example.org")
+          return;
+        console.log(event.data);
+      };
+            `,
+        },
+        {
+          code: `
+      function handleMessage(event) {
+        if (event.origin !== "http://example.org")
+          return;
+      }
+      globalThis.onmessage = handleMessage;
+            `,
+        },
+        {
+          code: `
+      const target = window;
+      const handleMessage = event => {
+        if (event.origin !== "http://example.org")
+          return;
+      };
+      target.onmessage = handleMessage;
+            `,
+        },
+        {
+          code: `
+      const socket = new WebSocket('wss://example.org');
+      socket.onmessage = function(event) {
+        console.log(event.data);
+      };
+            `,
+        },
+        {
+          code: `
       window.addEventListener("missing listener");
       window.addEventListener("message", "not a function");
       not_a_win_dow.addEventListener("message", () => {});
@@ -195,6 +231,33 @@ describe('S2819', () => {
         },
         {
           code: `
+      window.onmessage = function(event) {
+        console.log(event.data);
+      };
+            `,
+          errors: [{ messageId: 'verifyOrigin' }],
+        },
+        {
+          code: `
+      function handleMessage(event) {
+        console.log(event.data);
+      }
+      globalThis.onmessage = handleMessage;
+            `,
+          errors: [{ messageId: 'verifyOrigin' }],
+        },
+        {
+          code: `
+      const target = window;
+      const handleMessage = function (event) {
+        console.log(event.data);
+      };
+      target.onmessage = handleMessage;
+            `,
+          errors: [{ messageId: 'verifyOrigin' }],
+        },
+        {
+          code: `
       function eventHandler(event) {
         console.log(event.data);
       }