XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"

Description The `/:id/digital_wallets/dialog` endpoint is used to display a small dialog box relating to the "digital wallets" functionality on a shop. The endpoint includes a script that listens for postMessages without validating the origin of messages. However, the impact of the missing …

this._messageHandler = function(event) {
  if (event.data) {
    if (event.data.type && event.data.digitalWalletsDialog) {
      c(i, event.data.type, event.data.payload);
    }
  }
}
this._localWindow.addEventListener("message", this._messageHandler)