{"action":"created","comment":{"url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/comments/98795014","pull_request_review_id":19448887,"id":98795014,"diff_hunk":"@@ -52,6 +52,7 @@ Then configure the rules you want to use under the rules section.\n - [`jsx-classname-namespace`](docs/rules/jsx-classname-namespace.md): Ensure JSX className adheres to CSS namespace guidelines\n - [`jsx-gridicon-size`](docs/rules/jsx-gridicon-size.md): Enforce recommended Gridicon size attributes\n - [`import-docblock`](docs/rules/import-docblock.md): Enforce external, internal dependencies docblocks\n+- [`post-message-no-wildcard-targets`](docs/rules/postMessage-no-wildcard-targets): Disallow using the wildcard '*' in `postMessage`","path":"README.md","position":4,"original_position":4,"commit_id":"6b6838215e7ef3a56958376e3533c462dd502e29","original_commit_id":"6b6838215e7ef3a56958376e3533c462dd502e29","user":{"login":"aduth","id":1779930,"avatar_url":"https://avatars.githubusercontent.com/u/1779930?v=3","gravatar_id":"","url":"https://api.github.com/users/aduth","html_url":"https://github.com/aduth","followers_url":"https://api.github.com/users/aduth/followers","following_url":"https://api.github.com/users/aduth/following{/other_user}","gists_url":"https://api.github.com/users/aduth/gists{/gist_id}","starred_url":"https://api.github.com/users/aduth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aduth/subscriptions","organizations_url":"https://api.github.com/users/aduth/orgs","repos_url":"https://api.github.com/users/aduth/repos","events_url":"https://api.github.com/users/aduth/events{/privacy}","received_events_url":"https://api.github.com/users/aduth/received_events","type":"User","site_admin":false},"body":"This is a broken link (needs `.md`)","created_at":"2017-01-31T23:13:30Z","updated_at":"2017-01-31T23:13:30Z","html_url":"https://github.com/Automattic/eslint-plugin-wpcalypso/pull/33#discussion_r98795014","pull_request_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33","_links":{"self":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/comments/98795014"},"html":{"href":"https://github.com/Automattic/eslint-plugin-wpcalypso/pull/33#discussion_r98795014"},"pull_request":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33"}}},"pull_request":{"url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33","id":103261521,"html_url":"https://github.com/Automattic/eslint-plugin-wpcalypso/pull/33","diff_url":"https://github.com/Automattic/eslint-plugin-wpcalypso/pull/33.diff","patch_url":"https://github.com/Automattic/eslint-plugin-wpcalypso/pull/33.patch","issue_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/33","number":33,"state":"open","locked":false,"title":"New rule: postMessage-no-wildcard-targets","user":{"login":"dmsnell","id":5431237,"avatar_url":"https://avatars.githubusercontent.com/u/5431237?v=3","gravatar_id":"","url":"https://api.github.com/users/dmsnell","html_url":"https://github.com/dmsnell","followers_url":"https://api.github.com/users/dmsnell/followers","following_url":"https://api.github.com/users/dmsnell/following{/other_user}","gists_url":"https://api.github.com/users/dmsnell/gists{/gist_id}","starred_url":"https://api.github.com/users/dmsnell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmsnell/subscriptions","organizations_url":"https://api.github.com/users/dmsnell/orgs","repos_url":"https://api.github.com/users/dmsnell/repos","events_url":"https://api.github.com/users/dmsnell/events{/privacy}","received_events_url":"https://api.github.com/users/dmsnell/received_events","type":"User","site_admin":false},"body":"Adds a new rule to warn when attempting to use the wildcard target\r\norigin with `postMessage()`, which introduces a security vulnerability\r\nallowing for data scraping by unintended parties.\r\n\r\nFor review I would especially appreciate some consideration for if I have used the right patterns here. Most of what I did was copy and paste work from other existing rules.\r\n\r\nAt first I wanted to limit this rule to invocations of `window.postMessage()` and `contentWindow.postMessage()` but then changed my mind because of the likelihood that someone might bind these and drop the parent object from the call, mixed with the unlikelihood that we would find the second parameter as the wildcard in these cases if they weren't actually calling `postMessage()` the way we expect.\r\n\r\n**Note on failing build**\r\nThe tests were also failing on **master**","created_at":"2017-01-26T07:14:03Z","updated_at":"2017-01-31T23:13:30Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2c7e0990915871d8cf30cf0d5bbe01c33c24fce2","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33/commits","review_comments_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33/comments","review_comment_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/comments{/number}","comments_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/33/comments","statuses_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/statuses/6b6838215e7ef3a56958376e3533c462dd502e29","head":{"label":"Automattic:add/postMessage-rule","ref":"add/postMessage-rule","sha":"6b6838215e7ef3a56958376e3533c462dd502e29","user":{"login":"Automattic","id":887802,"avatar_url":"https://avatars.githubusercontent.com/u/887802?v=3","gravatar_id":"","url":"https://api.github.com/users/Automattic","html_url":"https://github.com/Automattic","followers_url":"https://api.github.com/users/Automattic/followers","following_url":"https://api.github.com/users/Automattic/following{/other_user}","gists_url":"https://api.github.com/users/Automattic/gists{/gist_id}","starred_url":"https://api.github.com/users/Automattic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Automattic/subscriptions","organizations_url":"https://api.github.com/users/Automattic/orgs","repos_url":"https://api.github.com/users/Automattic/repos","events_url":"https://api.github.com/users/Automattic/events{/privacy}","received_events_url":"https://api.github.com/users/Automattic/received_events","type":"Organization","site_admin":false},"repo":{"id":50957401,"name":"eslint-plugin-wpcalypso","full_name":"Automattic/eslint-plugin-wpcalypso","owner":{"login":"Automattic","id":887802,"avatar_url":"https://avatars.githubusercontent.com/u/887802?v=3","gravatar_id":"","url":"https://api.github.com/users/Automattic","html_url":"https://github.com/Automattic","followers_url":"https://api.github.com/users/Automattic/followers","following_url":"https://api.github.com/users/Automattic/following{/other_user}","gists_url":"https://api.github.com/users/Automattic/gists{/gist_id}","starred_url":"https://api.github.com/users/Automattic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Automattic/subscriptions","organizations_url":"https://api.github.com/users/Automattic/orgs","repos_url":"https://api.github.com/users/Automattic/repos","events_url":"https://api.github.com/users/Automattic/events{/privacy}","received_events_url":"https://api.github.com/users/Automattic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Automattic/eslint-plugin-wpcalypso","description":"Custom ESLint rules for the WordPress.com Calypso project","fork":false,"url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso","forks_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/forks","keys_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/teams","hooks_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/hooks","issue_events_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/events{/number}","events_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/events","assignees_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/assignees{/user}","branches_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/branches{/branch}","tags_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/tags","blobs_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/refs{/sha}","trees_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/statuses/{sha}","languages_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/languages","stargazers_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/stargazers","contributors_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/contributors","subscribers_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/subscribers","subscription_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/subscription","commits_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/commits{/sha}","git_commits_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/commits{/sha}","comments_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/comments{/number}","issue_comment_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/comments{/number}","contents_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/contents/{+path}","compare_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/merges","archive_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/downloads","issues_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues{/number}","pulls_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls{/number}","milestones_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/milestones{/number}","notifications_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/labels{/name}","releases_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/releases{/id}","deployments_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/deployments","created_at":"2016-02-02T22:45:07Z","updated_at":"2016-11-17T21:08:49Z","pushed_at":"2017-01-31T23:11:52Z","git_url":"git://github.com/Automattic/eslint-plugin-wpcalypso.git","ssh_url":"git@github.com:Automattic/eslint-plugin-wpcalypso.git","clone_url":"https://github.com/Automattic/eslint-plugin-wpcalypso.git","svn_url":"https://github.com/Automattic/eslint-plugin-wpcalypso","homepage":null,"size":112,"stargazers_count":6,"watchers_count":6,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":3,"forks":2,"open_issues":3,"watchers":6,"default_branch":"master"}},"base":{"label":"Automattic:master","ref":"master","sha":"9fad8309e1caef83e15ff16eb9c502bcb9fb5403","user":{"login":"Automattic","id":887802,"avatar_url":"https://avatars.githubusercontent.com/u/887802?v=3","gravatar_id":"","url":"https://api.github.com/users/Automattic","html_url":"https://github.com/Automattic","followers_url":"https://api.github.com/users/Automattic/followers","following_url":"https://api.github.com/users/Automattic/following{/other_user}","gists_url":"https://api.github.com/users/Automattic/gists{/gist_id}","starred_url":"https://api.github.com/users/Automattic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Automattic/subscriptions","organizations_url":"https://api.github.com/users/Automattic/orgs","repos_url":"https://api.github.com/users/Automattic/repos","events_url":"https://api.github.com/users/Automattic/events{/privacy}","received_events_url":"https://api.github.com/users/Automattic/received_events","type":"Organization","site_admin":false},"repo":{"id":50957401,"name":"eslint-plugin-wpcalypso","full_name":"Automattic/eslint-plugin-wpcalypso","owner":{"login":"Automattic","id":887802,"avatar_url":"https://avatars.githubusercontent.com/u/887802?v=3","gravatar_id":"","url":"https://api.github.com/users/Automattic","html_url":"https://github.com/Automattic","followers_url":"https://api.github.com/users/Automattic/followers","following_url":"https://api.github.com/users/Automattic/following{/other_user}","gists_url":"https://api.github.com/users/Automattic/gists{/gist_id}","starred_url":"https://api.github.com/users/Automattic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Automattic/subscriptions","organizations_url":"https://api.github.com/users/Automattic/orgs","repos_url":"https://api.github.com/users/Automattic/repos","events_url":"https://api.github.com/users/Automattic/events{/privacy}","received_events_url":"https://api.github.com/users/Automattic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Automattic/eslint-plugin-wpcalypso","description":"Custom ESLint rules for the WordPress.com Calypso project","fork":false,"url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso","forks_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/forks","keys_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/teams","hooks_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/hooks","issue_events_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/events{/number}","events_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/events","assignees_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/assignees{/user}","branches_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/branches{/branch}","tags_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/tags","blobs_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/refs{/sha}","trees_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/statuses/{sha}","languages_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/languages","stargazers_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/stargazers","contributors_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/contributors","subscribers_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/subscribers","subscription_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/subscription","commits_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/commits{/sha}","git_commits_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/git/commits{/sha}","comments_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/comments{/number}","issue_comment_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/comments{/number}","contents_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/contents/{+path}","compare_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/merges","archive_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/downloads","issues_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues{/number}","pulls_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls{/number}","milestones_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/milestones{/number}","notifications_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/labels{/name}","releases_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/releases{/id}","deployments_url":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/deployments","created_at":"2016-02-02T22:45:07Z","updated_at":"2016-11-17T21:08:49Z","pushed_at":"2017-01-31T23:11:52Z","git_url":"git://github.com/Automattic/eslint-plugin-wpcalypso.git","ssh_url":"git@github.com:Automattic/eslint-plugin-wpcalypso.git","clone_url":"https://github.com/Automattic/eslint-plugin-wpcalypso.git","svn_url":"https://github.com/Automattic/eslint-plugin-wpcalypso","homepage":null,"size":112,"stargazers_count":6,"watchers_count":6,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"open_issues_count":3,"forks":2,"open_issues":3,"watchers":6,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33"},"html":{"href":"https://github.com/Automattic/eslint-plugin-wpcalypso/pull/33"},"issue":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/33"},"comments":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/issues/33/comments"},"review_comments":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33/comments"},"review_comment":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/pulls/33/commits"},"statuses":{"href":"https://api.github.com/repos/Automattic/eslint-plugin-wpcalypso/statuses/6b6838215e7ef3a56958376e3533c462dd502e29"}}}}
{"actor":{"display_login":"aduth"}}