JSFiddle - React, Tailwind, and code Playground

HTML

<input type="button" onclick="runit()" value="runit"></input>
<iframe width=100 height=100 id="client" src="http://ops.epo.org/3.0/xss/crosssitescript.html" />

JavaScript

function runit() {
    // Get the iframe window object
    var client = document.getElementById('client');
    // Create the data string to be passed to the OPS JavaScript
    var data = "{'url' : 'http://ops.epo.org/3.0/rest-services/published-data/images/US/7123345/B2/thumbnail.pdf?Range=1', " + "'method' : 'GET', " + "'requestHeaders' : {'Accept': 'application/pdf' } " + "}";
    // Use the postMessage() method in order to send the data to the
    // iframe object
    client.contentWindow.postMessage(data, 'http://ops.epo.org');
}
// Add event listener for your window
window.addEventListener("message", receiveMessage, false);
// Method handling window events
function receiveMessage(event) {
    // Check origin of the event!
    if (event.origin == "http://ops.epo.org") {
        alert("How do I display the event.data as a pdf on the page?");
    } else {
        alert("Got message from unknown source.");
    }
}