prebid.js 7.10.0 → 7.13.0

package/src/adserver.js

@@ -1,61 +1,5 @@
-import { formatQS } from './utils.js';
-import { targeting } from './targeting.js';
 import {hook} from './hook.js';
 
-// Adserver parent class
-const AdServer = function(attr) {
-  this.name = attr.adserver;
-  this.code = attr.code;
-  this.getWinningBidByCode = function() {
-    return targeting.getWinningBids(this.code)[0];
-  };
-};
-
-// DFP ad server
-// TODO: this seems to be unused?
-export function dfpAdserver(options, urlComponents) {
-  var adserver = new AdServer(options);
-  adserver.urlComponents = urlComponents;
-
-  var dfpReqParams = {
-    'env': 'vp',
-    'gdfp_req': '1',
-    'impl': 's',
-    'unviewed_position_start': '1'
-  };
-
-  var dfpParamsWithVariableValue = ['output', 'iu', 'sz', 'url', 'correlator', 'description_url', 'hl'];
-
-  var getCustomParams = function(targeting) {
-    return encodeURIComponent(formatQS(targeting));
-  };
-
-  adserver.appendQueryParams = function() {
-    var bid = adserver.getWinningBidByCode();
-    if (bid) {
-      this.urlComponents.search.description_url = encodeURIComponent(bid.vastUrl);
-      this.urlComponents.search.cust_params = getCustomParams(bid.adserverTargeting);
-      this.urlComponents.search.correlator = Date.now();
-    }
-  };
-
-  adserver.verifyAdserverTag = function() {
-    for (var key in dfpReqParams) {
-      if (!this.urlComponents.search.hasOwnProperty(key) || this.urlComponents.search[key] !== dfpReqParams[key]) {
-        return false;
-      }
-    }
-    for (var i in dfpParamsWithVariableValue) {
-      if (!this.urlComponents.search.hasOwnProperty(dfpParamsWithVariableValue[i])) {
-        return false;
-      }
-    }
-    return true;
-  };
-
-  return adserver;
-};
-
 /**
  * return the GAM PPID, if available (eid for the userID configured with `userSync.ppidSource`)
  */

package/src/auction.js

@@ -498,8 +498,9 @@ function tryAddVideoBid(auctionInstance, bidResponse, afterBidAdded, {index = au
       transactionId: bidResponse.transactionId
     }), 'video');
   const context = videoMediaType && deepAccess(videoMediaType, 'context');
+  const useCacheKey = videoMediaType && deepAccess(videoMediaType, 'useCacheKey');
 
-  if (config.getConfig('cache.url') && context !== OUTSTREAM) {
+  if (config.getConfig('cache.url') && (useCacheKey || context !== OUTSTREAM)) {
     if (!bidResponse.videoCacheKey || config.getConfig('cache.ignoreBidderCacheKey')) {
       addBid = false;
       callPrebidCache(auctionInstance, bidResponse, afterBidAdded, videoMediaType);
@@ -514,28 +515,71 @@ function tryAddVideoBid(auctionInstance, bidResponse, afterBidAdded, {index = au
   }
 }
 
-export const callPrebidCache = hook('async', function(auctionInstance, bidResponse, afterBidAdded, videoMediaType) {
-  store([bidResponse], function (error, cacheIds) {
-    if (error) {
-      logWarn(`Failed to save to the video cache: ${error}. Video bid must be discarded.`);
-
-      doCallbacksIfTimedout(auctionInstance, bidResponse);
-    } else {
-      if (cacheIds[0].uuid === '') {
-        logWarn(`Supplied video cache key was already in use by Prebid Cache; caching attempt was rejected. Video bid must be discarded.`);
+const storeInCache = (batch) => {
+  store(batch.map(entry => entry.bidResponse), function (error, cacheIds) {
+    cacheIds.forEach((cacheId, i) => {
+      const { auctionInstance, bidResponse, afterBidAdded } = batch[i];
+      if (error) {
+        logWarn(`Failed to save to the video cache: ${error}. Video bid must be discarded.`);
 
         doCallbacksIfTimedout(auctionInstance, bidResponse);
       } else {
-        bidResponse.videoCacheKey = cacheIds[0].uuid;
+        if (cacheId.uuid === '') {
+          logWarn(`Supplied video cache key was already in use by Prebid Cache; caching attempt was rejected. Video bid must be discarded.`);
 
-        if (!bidResponse.vastUrl) {
-          bidResponse.vastUrl = getCacheUrl(bidResponse.videoCacheKey);
+          doCallbacksIfTimedout(auctionInstance, bidResponse);
+        } else {
+          bidResponse.videoCacheKey = cacheId.uuid;
+
+          if (!bidResponse.vastUrl) {
+            bidResponse.vastUrl = getCacheUrl(bidResponse.videoCacheKey);
+          }
+          addBidToAuction(auctionInstance, bidResponse);
+          afterBidAdded();
         }
-        addBidToAuction(auctionInstance, bidResponse);
-        afterBidAdded();
       }
-    }
+    });
   });
+};
+
+let batchSize, batchTimeout;
+config.getConfig('cache', (cacheConfig) => {
+  batchSize = typeof cacheConfig.cache.batchSize === 'number' && cacheConfig.cache.batchSize > 0
+    ? cacheConfig.cache.batchSize
+    : 1;
+  batchTimeout = typeof cacheConfig.cache.batchTimeout === 'number' && cacheConfig.cache.batchTimeout > 0
+    ? cacheConfig.cache.batchTimeout
+    : 0;
+});
+
+export const batchingCache = (timeout = setTimeout, cache = storeInCache) => {
+  let batches = [[]];
+  let debouncing = false;
+  const noTimeout = cb => cb();
+
+  return function(auctionInstance, bidResponse, afterBidAdded) {
+    const batchFunc = batchTimeout > 0 ? timeout : noTimeout;
+    if (batches[batches.length - 1].length >= batchSize) {
+      batches.push([]);
+    }
+
+    batches[batches.length - 1].push({auctionInstance, bidResponse, afterBidAdded});
+
+    if (!debouncing) {
+      debouncing = true;
+      batchFunc(() => {
+        batches.forEach(cache);
+        batches = [[]];
+        debouncing = false;
+      }, batchTimeout);
+    }
+  }
+};
+
+const batchAndStore = batchingCache();
+
+export const callPrebidCache = hook('async', function(auctionInstance, bidResponse, afterBidAdded, videoMediaType) {
+  batchAndStore(auctionInstance, bidResponse, afterBidAdded);
 }, 'callPrebidCache');
 
 // Postprocess the bids so that all the universal properties exist, no matter which bidder they came from.

package/src/bidfactory.js

@@ -59,7 +59,7 @@ function Bid(statusCode, {src = 'client', bidder = '', bidId, transactionId, auc
       transactionId: this.transactionId,
       auctionId: this.auctionId
     }
-  }
+  };
 }
 
 // Bid factory function.

package/src/native.js

@@ -272,7 +272,7 @@ export function fireNativeTrackers(message, bidResponse) {
   const nativeResponse = bidResponse.native.ortb || legacyPropertiesToOrtbNative(bidResponse.native);
 
   if (message.action === 'click') {
-    fireClickTrackers(nativeResponse);
+    fireClickTrackers(nativeResponse, message?.assetId);
   } else {
     fireImpressionTrackers(nativeResponse);
   }
@@ -305,8 +305,27 @@ export function fireImpressionTrackers(nativeResponse, {runMarkup = (mkup) => in
   }
 }
 
-export function fireClickTrackers(nativeResponse, {fetchURL = triggerPixel} = {}) {
-  (nativeResponse.link?.clicktrackers || []).forEach(url => fetchURL(url));
+export function fireClickTrackers(nativeResponse, assetId = null, {fetchURL = triggerPixel} = {}) {
+  // legacy click tracker
+  if (!assetId) {
+    (nativeResponse.link?.clicktrackers || []).forEach(url => fetchURL(url));
+  } else {
+    // ortb click tracker. This will try to call the clicktracker associated with the asset;
+    // will fallback to the link if none is found.
+    const assetIdLinkMap = (nativeResponse.assets || [])
+      .filter(a => a.link)
+      .reduce((map, asset) => {
+        map[asset.id] = asset.link;
+        return map
+      }, {});
+    const masterClickTrackers = nativeResponse.link?.clicktrackers || [];
+    let assetLink = assetIdLinkMap[assetId];
+    let clickTrackers = masterClickTrackers;
+    if (assetLink) {
+      clickTrackers = assetLink.clicktrackers || [];
+    }
+    clickTrackers.forEach(url => fetchURL(url));
+  }
 }
 
 /**
@@ -366,34 +385,9 @@ export function getNativeTargeting(bid, {index = auctionManager.index} = {}) {
   return keyValues;
 }
 
-/**
- * Constructs a message object containing asset values for each of the
- * requested data keys.
- */
-export function getAssetMessage(data, adObject) {
-  const message = {
-    message: 'assetResponse',
-    adId: data.adId,
-    assets: [],
-  };
-
-  if (adObject.native.hasOwnProperty('adTemplate')) {
-    message.adTemplate = getAssetValue(adObject.native['adTemplate']);
-  } if (adObject.native.hasOwnProperty('rendererUrl')) {
-    message.rendererUrl = getAssetValue(adObject.native['rendererUrl']);
-  }
-
-  data.assets.forEach(asset => {
-    const key = getKeyByValue(CONSTANTS.NATIVE_KEYS, asset);
-    const value = getAssetValue(adObject.native[key]);
+const getNativeRequest = (bidResponse) => auctionManager.index.getAdUnit(bidResponse)?.nativeOrtbRequest;
 
-    message.assets.push({ key, value });
-  });
-
-  return message;
-}
-
-export function getAllAssetsMessage(data, adObject, {getNativeReq = (bidResponse) => auctionManager.index.getAdUnit(bidResponse).nativeOrtbRequest} = {}) {
+function assetsMessage(data, adObject, keys, {getNativeReq = getNativeRequest} = {}) {
   const message = {
     message: 'assetResponse',
     adId: data.adId,
@@ -401,12 +395,12 @@ export function getAllAssetsMessage(data, adObject, {getNativeReq = (bidResponse
 
   // Pass to Prebid Universal Creative all assets, the legacy ones + the ortb ones (under ortb property)
   const ortbRequest = getNativeReq(adObject);
-  let nativeReq = adObject.native;
+  let nativeResp = adObject.native;
   const ortbResponse = adObject.native?.ortb;
   let legacyResponse = {};
   if (ortbRequest && ortbResponse) {
     legacyResponse = toLegacyResponse(ortbResponse, ortbRequest);
-    nativeReq = {
+    nativeResp = {
       ...adObject.native,
       ...legacyResponse
     };
@@ -416,20 +410,20 @@ export function getAllAssetsMessage(data, adObject, {getNativeReq = (bidResponse
   }
   message.assets = [];
 
-  Object.keys(nativeReq).forEach(function(key) {
-    if (key === 'adTemplate' && nativeReq[key]) {
-      message.adTemplate = getAssetValue(nativeReq[key]);
-    } else if (key === 'rendererUrl' && nativeReq[key]) {
-      message.rendererUrl = getAssetValue(nativeReq[key]);
+  (keys == null ? Object.keys(nativeResp) : keys).forEach(function(key) {
+    if (key === 'adTemplate' && nativeResp[key]) {
+      message.adTemplate = getAssetValue(nativeResp[key]);
+    } else if (key === 'rendererUrl' && nativeResp[key]) {
+      message.rendererUrl = getAssetValue(nativeResp[key]);
     } else if (key === 'ext') {
-      Object.keys(nativeReq[key]).forEach(extKey => {
-        if (nativeReq[key][extKey]) {
-          const value = getAssetValue(nativeReq[key][extKey]);
+      Object.keys(nativeResp[key]).forEach(extKey => {
+        if (nativeResp[key][extKey]) {
+          const value = getAssetValue(nativeResp[key][extKey]);
           message.assets.push({ key: extKey, value });
         }
       })
-    } else if (nativeReq[key] && CONSTANTS.NATIVE_KEYS.hasOwnProperty(key)) {
-      const value = getAssetValue(nativeReq[key]);
+    } else if (nativeResp[key] && CONSTANTS.NATIVE_KEYS.hasOwnProperty(key)) {
+      const value = getAssetValue(nativeResp[key]);
 
       message.assets.push({ key, value });
     }
@@ -437,6 +431,19 @@ export function getAllAssetsMessage(data, adObject, {getNativeReq = (bidResponse
   return message;
 }
 
+/**
+ * Constructs a message object containing asset values for each of the
+ * requested data keys.
+ */
+export function getAssetMessage(data, adObject, {getNativeReq = getNativeRequest} = {}) {
+  const keys = data.assets.map((k) => getKeyByValue(CONSTANTS.NATIVE_KEYS, k));
+  return assetsMessage(data, adObject, keys, {getNativeReq});
+}
+
+export function getAllAssetsMessage(data, adObject, {getNativeReq = getNativeRequest} = {}) {
+  return assetsMessage(data, adObject, null, {getNativeReq});
+}
+
 /**
  * Native assets can be a string or an object with a url prop. Returns the value
  * appropriate for sending in adserver targeting or placeholder replacement.
@@ -689,40 +696,47 @@ export function legacyPropertiesToOrtbNative(legacyNative) {
 }
 
 export function toOrtbNativeResponse(legacyResponse, ortbRequest) {
-  // copy the request, so we don't pollute it with response data below
-  ortbRequest = deepClone(ortbRequest);
-
   const ortbResponse = {
     ...legacyPropertiesToOrtbNative(legacyResponse),
     assets: []
   };
+
+  function useRequestAsset(predicate, fn) {
+    let asset = ortbRequest.assets.find(predicate);
+    if (asset != null) {
+      asset = deepClone(asset);
+      fn(asset);
+      ortbResponse.assets.push(asset);
+    }
+  }
+
   Object.keys(legacyResponse).filter(key => !!legacyResponse[key]).forEach(key => {
     const value = legacyResponse[key];
     switch (key) {
       // process titles
       case 'title':
-        const titleAsset = ortbRequest.assets.find(asset => asset.title != null);
-        titleAsset.title = {
-          text: value
-        };
-        ortbResponse.assets.push(titleAsset);
+        useRequestAsset(asset => asset.title != null, titleAsset => {
+          titleAsset.title = {
+            text: value
+          };
+        })
         break;
       case 'image':
       case 'icon':
         const imageType = key === 'image' ? NATIVE_IMAGE_TYPES.MAIN : NATIVE_IMAGE_TYPES.ICON;
-        const imageAsset = ortbRequest.assets.find(asset => asset.img != null && asset.img.type == imageType);
-        imageAsset.img = {
-          url: value
-        };
-        ortbResponse.assets.push(imageAsset);
+        useRequestAsset(asset => asset.img != null && asset.img.type === imageType, imageAsset => {
+          imageAsset.img = {
+            url: value
+          };
+        })
         break;
       default:
         if (key in PREBID_NATIVE_DATA_KEYS_TO_ORTB) {
-          const dataAsset = ortbRequest.assets.find(asset => asset.data != null && asset.data.type === NATIVE_ASSET_TYPES[PREBID_NATIVE_DATA_KEYS_TO_ORTB[key]]);
-          dataAsset.data = {
-            value
-          };
-          ortbResponse.assets.push(dataAsset);
+          useRequestAsset(asset => asset.data != null && asset.data.type === NATIVE_ASSET_TYPES[PREBID_NATIVE_DATA_KEYS_TO_ORTB[key]], dataAsset => {
+            dataAsset.data = {
+              value
+            };
+          })
         }
         break;
     }
@@ -740,6 +754,7 @@ function toLegacyResponse(ortbResponse, ortbRequest) {
   const legacyResponse = {};
   const requestAssets = ortbRequest?.assets || [];
   legacyResponse.clickUrl = ortbResponse.link.url;
+  legacyResponse.privacyLink = ortbResponse.privacy;
   for (const asset of ortbResponse?.assets || []) {
     const requestAsset = requestAssets.find(reqAsset => asset.id === reqAsset.id);
     if (asset.title) {

package/src/refererDetection.js

@@ -11,6 +11,8 @@
 import { config } from './config.js';
 import {logWarn} from './utils.js';
 
+let RI = new WeakMap();
+
 /**
  * Prepend a URL with the page's protocol (http/https), if necessary.
  */
@@ -252,10 +254,19 @@ export function detectReferer(win) {
     };
   }
 
-  return refererInfo;
+  return function() {
+    if (!RI.has(win)) {
+      RI.set(win, Object.freeze(refererInfo()));
+    }
+    return RI.get(win);
+  }
 }
 
 /**
  * @type {function(): refererInfo}
  */
 export const getRefererInfo = detectReferer(window);
+
+export function resetRefererInfo() {
+  RI = new WeakMap();
+}

package/src/sizeMapping.js

@@ -1,6 +1,7 @@
 import { config } from './config.js';
 import {logWarn, logInfo, isPlainObject, deepAccess, deepClone, getWindowTop} from './utils.js';
 import {includes} from './polyfill.js';
+import {BANNER} from './mediaTypes.js';
 
 let sizeConfig = [];
 
@@ -75,22 +76,19 @@ export function resolveStatus({labels = [], labelAll = false, activeLabels = []}
     } else {
       mediaTypes = {};
     }
-  } else {
-    mediaTypes = deepClone(mediaTypes);
   }
 
   let oldSizes = deepAccess(mediaTypes, 'banner.sizes');
   if (maps.shouldFilter && oldSizes) {
+    mediaTypes = deepClone(mediaTypes);
     mediaTypes.banner.sizes = oldSizes.filter(size => maps.sizesSupported[size]);
   }
 
-  let allMediaTypes = Object.keys(mediaTypes);
-
   let results = {
     active: (
-      allMediaTypes.every(type => type !== 'banner')
+      !mediaTypes.hasOwnProperty(BANNER)
     ) || (
-      allMediaTypes.some(type => type === 'banner') && deepAccess(mediaTypes, 'banner.sizes.length') > 0 && (
+      deepAccess(mediaTypes, 'banner.sizes.length') > 0 && (
         labels.length === 0 || (
           (!labelAll && (
             labels.some(label => maps.labels[label]) ||
@@ -111,7 +109,7 @@ export function resolveStatus({labels = [], labelAll = false, activeLabels = []}
     results.filterResults = {
       before: oldSizes,
       after: mediaTypes.banner.sizes
-    }
+    };
   }
 
   return results;

package/src/targeting.js

@@ -63,7 +63,7 @@ export const getHighestCpmBidsFromBidPool = hook('sync', function(bidsReceived,
   }
 
   return bidsReceived;
-})
+});
 
 /**
 * A descending sort function that will sort the list of objects based on the following two dimensions:

package/src/userSync.js

@@ -311,7 +311,7 @@ export function newUserSync(userSyncDependencies) {
       }
     }
     return true;
-  }
+  };
   return publicApi;
 }
 

package/src/utils/promise.js

@@ -1,10 +1,12 @@
+import {getGlobal} from '../prebidGlobal.js';
+
 const SUCCESS = 0;
 const FAIL = 1;
 
 /**
  * A version of Promise that runs callbacks synchronously when it can (i.e. after it's been fulfilled or rejected).
  */
-export class GreedyPromise extends Promise {
+export class GreedyPromise extends (getGlobal().Promise || Promise) {
   #result;
   #callbacks;
   #parent = null;

package/src/utils.js

@@ -1381,3 +1381,30 @@ export function setScriptAttributes(script, attributes) {
     }
   }
 }
+
+/**
+ * Encode a string for inclusion in HTML.
+ * See https://pragmaticwebsecurity.com/articles/spasecurity/json-stringify-xss.html and
+ * https://codeql.github.com/codeql-query-help/javascript/js-bad-code-sanitization/
+ * @return {string}
+ */
+export const escapeUnsafeChars = (() => {
+  const escapes = {
+    '<': '\\u003C',
+    '>': '\\u003E',
+    '/': '\\u002F',
+    '\\': '\\\\',
+    '\b': '\\b',
+    '\f': '\\f',
+    '\n': '\\n',
+    '\r': '\\r',
+    '\t': '\\t',
+    '\0': '\\0',
+    '\u2028': '\\u2028',
+    '\u2029': '\\u2029'
+  };
+
+  return function(str) {
+    return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029\\]/g, x => escapes[x])
+  }
+})();

package/src/video.js

@@ -35,15 +35,16 @@ export const hasNonVideoBidder = adUnit =>
 export function isValidVideoBid(bid, {index = auctionManager.index} = {}) {
   const videoMediaType = deepAccess(index.getMediaTypes(bid), 'video');
   const context = videoMediaType && deepAccess(videoMediaType, 'context');
+  const useCacheKey = videoMediaType && deepAccess(videoMediaType, 'useCacheKey');
   const adUnit = index.getAdUnit(bid);
 
   // if context not defined assume default 'instream' for video bids
   // instream bids require a vast url or vast xml content
-  return checkVideoBidSetup(bid, adUnit, videoMediaType, context);
+  return checkVideoBidSetup(bid, adUnit, videoMediaType, context, useCacheKey);
 }
 
-export const checkVideoBidSetup = hook('sync', function(bid, adUnit, videoMediaType, context) {
-  if (videoMediaType && context !== OUTSTREAM) {
+export const checkVideoBidSetup = hook('sync', function(bid, adUnit, videoMediaType, context, useCacheKey) {
+  if (videoMediaType && (useCacheKey || context !== OUTSTREAM)) {
     // xml-only video bids require a prebid cache url
     if (!config.getConfig('cache.url') && bid.vastXml && !bid.vastUrl) {
       logError(`
@@ -57,7 +58,7 @@ export const checkVideoBidSetup = hook('sync', function(bid, adUnit, videoMediaT
   }
 
   // outstream bids require a renderer on the bid or pub-defined on adunit
-  if (context === OUTSTREAM) {
+  if (context === OUTSTREAM && !useCacheKey) {
     return !!(bid.renderer || (adUnit && adUnit.renderer) || videoMediaType.renderer);
   }
 

package/src/videoCache.js

@@ -13,6 +13,12 @@ import { ajax } from './ajax.js';
 import { config } from './config.js';
 import {auctionManager} from './auctionManager.js';
 
+/**
+ * Might be useful to be configurable in the future
+ * Depending on publisher needs
+ */
+const ttlBufferInSeconds = 15;
+
 /**
  * @typedef {object} CacheableUrlBid
  * @property {string} vastUrl A URL which loads some valid VAST XML.
@@ -63,11 +69,11 @@ function wrapURI(uri, impUrl) {
 function toStorageRequest(bid, {index = auctionManager.index} = {}) {
   const vastValue = bid.vastXml ? bid.vastXml : wrapURI(bid.vastUrl, bid.vastImpUrl);
   const auction = index.getAuction(bid);
-
+  const ttlWithBuffer = Number(bid.ttl) + ttlBufferInSeconds;
   let payload = {
     type: 'xml',
     value: vastValue,
-    ttlseconds: Number(bid.ttl)
+    ttlseconds: ttlWithBuffer
   };
 
   if (config.getConfig('cache.vasttrack')) {

package/test/pages/instream.html

@@ -8,8 +8,8 @@
     <title>Prebid.js video adUnit example</title>
 
     <!-- videojs -->
-    <link rel="stylesheet" href="http://vjs.zencdn.net/5.9.2/video-js.css">
-    <script type="text/javascript" src="http://vjs.zencdn.net/5.9.2/video.js"></script>
+    <link rel="stylesheet" href="https://vjs.zencdn.net/5.9.2/video-js.css">
+    <script type="text/javascript" src="https://vjs.zencdn.net/5.9.2/video.js"></script>
 
     <!-- videojs-vast-vpaid -->
     <link href="https://cdnjs.cloudflare.com/ajax/libs/videojs-vast-vpaid/2.0.2/videojs.vast.vpaid.min.css" rel="stylesheet">