HTML5 adds the ability to send messages to documents served from other domains. To mitigate the risk of sending sensitive information to a document served from a hostile or unknown domain, this rule raises an issue each time `Window.postMessage` is used.

## Noncompliant Code Example

    var myWindow = document.getElementById('myIFrame').contentWindow;
    myWindow.postMessage(message, "*"); // Noncompliant; how do you know what you loaded in 'myIFrame' is still there?

## See

- OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)