rules:
- id: wildcard-postmessage-configuration
  message: >-
    The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
  languages:
  - javascript
  - typescript
  severity: WARNING
  metadata:
    owasp: 'A3: Sensitive Data Exposure'
    cwe: 'CWE-345: Insufficient Verification of Data Authenticity'
    category: security
    technology:
    - browser
  pattern: $OBJECT.postMessage(...,'*')