My project runs the sonarqube scan for each build.

In the line self.addEventListener, I have the "Verify the message's origin in this cross-origin communication." vulnerability in scan results.

My application is getting loaded in an iframe.

The code snippet is as follows:-

self.addEventListener("message", function(e) {
    switch (e.data.cmd) {
        case "init":
            _initializeTimer(e.data.timeIntervalInSec);
            break;
        case "resetTimer":
            clearTimeout(self.sessionTimer);
            _initializeTimer(e.data.timeIntervalInSec);
            break;
        default:
            self.postMessage({
                status: "error",
                info: "please send a valid command"
            });
            break;
    }

What is the potential cause of this vulnerability ?

How can I resolve this ?