Updated qhelp with a third example

Author: dellalibera

javascript/ql/src/experimental/Security/CWE-020/PostMessageNoOriginCheck.qhelp

@@ -21,8 +21,11 @@ Always verify the sender's identity of incoming messages.
 <p>In the first example, the `MessageEvent.data` is passed to the `eval` function withouth checking the origin. This means that any window can send arbitrary messages that will be executed in the window receiving the message</p>
 <sample src="examples/postMessageNoOriginCheck.js" />
 
-<p> In the second example, the `MessageEvent.origin` is checked against a trusted origin. 
-<sample src="examples/postMessageWithOriginCheck.js" />
+<p> In the second example, the `MessageEvent.origin` is verified with an unsecure check. For example, using `event.origin.indexOf('www.example.com') > -1` can be baypassed because the string `www.example.com` could appear anywhere in `event.origin` (i.e. `www.example.com.mydomain.com`)
+<sample src="examples/postMessageWithInsufficientCheck.js" />
+
+<p> In the third example, the `MessageEvent.origin` is properly checked against a trusted origin. 
+<sample src="examples/postMessageWithInsufficientCheck.js" />
 
 </example>