PostMessage triggers false security alert

[rickg-hcl]

This scanning tool:
https://www.hcl-software.com/appscan/products/appscan-standard

flags an error on this line:

https://github.com/emscripten-core/emscripten/blob/main/src/library_eventloop.js#L368

because PostMessage() is passing "*" as the second parameter.

As far as I can tell, that PostMessage turns into parentPort.postMessage() for which the
second parameter would be objects to transfer, so "*" would not apply.

This seems to be a harmless error that could be easily removed, so as to not trigger
AppScan or other scanning tools.

Here is the finding from AppScan:

Reasoning: AppScan found a postMessage() function that uses the wildcard * for the target domain[s] parameter

...
  setImmediates.shift()();
 }
};
addEventListener("message", Browser_setImmediate_messageHandler, true);
Browser.setImmediate = /** @type{function(function(): ?, ...?): number} */ (function
Browser_emulated_setImmediate(func) {
 setImmediates.push(func);
     if (ENVIRONMENT_IS_WORKER) {
      if (Module["setImmediates"] === undefined) Module["setImmediates"] = [];
      Module["setImmediates"].push(func);
      postMessage({
       target: emscriptenMainLoopMessageId
      });
     } else postMessage(emscriptenMainLoopMessageId, "*");
    });
   } else {
    Browser.setImmediate = setImmediate;
} }
  Browser.mainLoop.scheduler = function Browser_mainLoop_scheduler_setImmediate() {
   Browser.setImmediate(Browser.mainLoop.runner);
};
  Browser.mainLoop.method = "immediate";
...

There's another instance here:

https://github.com/emscripten-core/emscripten/blob/main/src/library_eventloop.js#L76

that didn't trigger the scan, but could.

[sbc100]

It seems that doing postMessage(..., "*"); is the way to emulate setImmediate. See https://github.com/YuzuJS/setImmediate/blob/master/setImmediate.js.

I think in this case the use of * for the targetOrigin is OK because we are posting a message to ourselves. I'm not totally sure its needed.. but I do see it used in https://github.com/YuzuJS/setImmediate/blob/master/setImmediate.js so I imagine that for some reason it is. @juj do you know more about this?

My guess is that this is likely a false positive security alert.

[sbc100]

Looks like the "*" is indeed needed for this hack: https://dbaron.org/log/20100309-faster-timeouts