xss on polaris.shopify.com/demo using postMessage

it's possible to run arbitrary js code using https://polaris.shopify.com/demo + `postMessage`

          componentDidMount() {
            window.addEventListener("message", this.handleMessage),
              this.throttledSendDetails(),
              window.addEventListener("click", handleAnchorClick);
          }