prebid.js 7.50.0 → 7.52.0

package/test/spec/activities/objectGuard_spec.js

@@ -0,0 +1,144 @@
+import {objectGuard, writeProtectRule} from '../../../libraries/objectGuard/objectGuard.js';
+
+describe('objectGuard', () => {
+  describe('read rule', () => {
+    let rule, applies;
+    beforeEach(() => {
+      applies = true;
+      rule = {
+        paths: ['foo', 'outer.inner.foo'],
+        name: 'testRule',
+        applies: sinon.stub().callsFake(() => applies),
+        get(val) { return `repl${val}` },
+      }
+    })
+    it('can prevent top level read access', () => {
+      const {obj} = objectGuard([rule])({'foo': 1, 'other': 2});
+      expect(obj).to.eql({
+        foo: 'repl1',
+        other: 2
+      });
+    });
+
+    it('does not choke if a guarded property is missing', () => {
+      const {obj} = objectGuard([rule])({});
+      expect(obj.foo).to.not.exist;
+    });
+
+    it('does not prevent access if applies returns false', () => {
+      applies = false;
+      const {obj} = objectGuard([rule])({foo: 1});
+      expect(obj).to.eql({
+        foo: 1
+      });
+    })
+
+    it('can prevent nested property access', () => {
+      const {obj} = objectGuard([rule])({
+        other: 0,
+        outer: {
+          foo: 1,
+          inner: {
+            foo: 2
+          },
+          bar: {
+            foo: 3
+          }
+        }
+      });
+      expect(obj).to.eql({
+        other: 0,
+        outer: {
+          foo: 1,
+          inner: {
+            foo: 'repl2',
+          },
+          bar: {
+            foo: 3
+          }
+        }
+      })
+    });
+
+    it('does not call applies more than once', () => {
+      JSON.stringify(objectGuard([rule])({
+        foo: 0,
+        outer: {
+          inner: {
+            foo: 1
+          }
+        }
+      }).obj);
+      expect(rule.applies.callCount).to.equal(1);
+    })
+  });
+
+  describe('write protection', () => {
+    let applies, rule;
+
+    beforeEach(() => {
+      applies = true;
+      rule = writeProtectRule({
+        paths: ['foo', 'bar', 'outer.inner.foo', 'outer.inner.bar'],
+        applies: sinon.stub().callsFake(() => applies)
+      });
+    });
+
+    it('should undo top-level writes', () => {
+      const obj = {bar: {nested: 'val'}, other: 'val'};
+      const guard = objectGuard([rule])(obj);
+      guard.obj.foo = 'denied';
+      guard.obj.bar.nested = 'denied';
+      guard.obj.bar.other = 'denied';
+      guard.obj.other = 'allowed';
+      guard.verify();
+      expect(obj).to.eql({bar: {nested: 'val'}, other: 'allowed'});
+    });
+
+    it('should undo top-level deletes', () => {
+      const obj = {foo: {nested: 'val'}, bar: 'val'};
+      const guard = objectGuard([rule])(obj);
+      delete guard.obj.foo.nested;
+      delete guard.obj.bar;
+      guard.verify();
+      expect(obj).to.eql({foo: {nested: 'val'}, bar: 'val'});
+    })
+
+    it('should undo nested writes', () => {
+      const obj = {outer: {inner: {bar: {nested: 'val'}, other: 'val'}}};
+      const guard = objectGuard([rule])(obj);
+      guard.obj.outer.inner.bar.other = 'denied';
+      guard.obj.outer.inner.bar.nested = 'denied';
+      guard.obj.outer.inner.foo = 'denied';
+      guard.obj.outer.inner.other = 'allowed';
+      guard.verify();
+      expect(obj).to.eql({
+        outer: {
+          inner: {
+            bar: {
+              nested: 'val'
+            },
+            other: 'allowed'
+          }
+        }
+      })
+    });
+
+    it('should undo nested deletes', () => {
+      const obj = {outer: {inner: {foo: {nested: 'val'}, bar: 'val'}}};
+      const guard = objectGuard([rule])(obj);
+      delete guard.obj.outer.inner.foo.nested;
+      delete guard.obj.outer.inner.bar;
+      guard.verify();
+      expect(obj).to.eql({outer: {inner: {foo: {nested: 'val'}, bar: 'val'}}})
+    });
+
+    it('should work on null properties', () => {
+      const obj = {foo: null};
+      const guard = objectGuard([rule])(obj);
+      guard.obj.foo = 'denied';
+      guard.verify();
+      expect(obj).to.eql({foo: null});
+    });
+  });
+});

package/test/spec/activities/ortbGuard_spec.js

@@ -0,0 +1,140 @@
+import {ortb2FragmentsGuardFactory, ortb2GuardFactory} from '../../../libraries/objectGuard/ortbGuard.js';
+import {ACTIVITY_PARAM_COMPONENT_NAME, ACTIVITY_PARAM_COMPONENT_TYPE} from '../../../src/activities/params.js';
+import {
+  ACTIVITY_ENRICH_EIDS, ACTIVITY_ENRICH_UFPD,
+  ACTIVITY_TRANSMIT_EIDS,
+  ACTIVITY_TRANSMIT_UFPD
+} from '../../../src/activities/activities.js';
+import {activityParams} from '../../../src/activities/activityParams.js';
+import {deepAccess, deepClone, deepSetValue, mergeDeep} from '../../../src/utils.js';
+import {ORTB_EIDS_PATHS, ORTB_UFPD_PATHS} from '../../../src/activities/redactor.js';
+import {objectGuard, writeProtectRule} from '../../../libraries/objectGuard/objectGuard.js';
+
+describe('ortb2Guard', () => {
+  const MOD_TYPE = 'test';
+  const MOD_NAME = 'mock';
+  let isAllowed, ortb2Guard;
+  beforeEach(() => {
+    isAllowed = sinon.stub();
+    ortb2Guard = ortb2GuardFactory(function (activity, params) {
+      if (params[ACTIVITY_PARAM_COMPONENT_TYPE] === MOD_TYPE && params[ACTIVITY_PARAM_COMPONENT_NAME] === MOD_NAME) {
+        return isAllowed(activity)
+      } else {
+        throw new Error('wrong component')
+      }
+    })
+  });
+
+  function testAllowDeny(transmitActivity, enrichActivity, fn) {
+    Object.entries({
+      allowed: true,
+      denied: false
+    }).forEach(([t, allowed]) => {
+      describe(`when '${enrichActivity}' is ${t}`, () => {
+        beforeEach(() => {
+          isAllowed.callsFake((activity) => {
+            if (activity === transmitActivity) return true;
+            if (activity === enrichActivity) return allowed;
+            throw new Error('wrong activity');
+          })
+        });
+        fn(allowed);
+      })
+    })
+  }
+
+  function testPropertiesAreProtected(properties, allowed) {
+    properties.forEach(prop => {
+      it(`should ${allowed ? 'keep' : 'undo'} additions to ${prop}`, () => {
+        const orig = [{n: 'orig'}];
+        const ortb2 = {};
+        deepSetValue(ortb2, prop, deepClone(orig));
+        const guard = ortb2Guard(ortb2, activityParams(MOD_TYPE, MOD_NAME));
+        const mod = {};
+        const insert = [{n: 'new'}];
+        deepSetValue(mod, prop, insert);
+        mergeDeep(guard.obj, mod);
+        guard.verify();
+        const actual = deepAccess(ortb2, prop);
+        if (allowed) {
+          expect(actual).to.eql(orig.concat(insert))
+        } else {
+          expect(actual).to.eql(orig);
+        }
+      });
+
+      it(`should ${allowed ? 'keep' : 'undo'} modifications to ${prop}`, () => {
+        const orig = [{n: 'orig'}];
+        const ortb2 = {};
+        deepSetValue(ortb2, prop, orig);
+        const guard = ortb2Guard(ortb2, activityParams(MOD_TYPE, MOD_NAME));
+        deepSetValue(guard.obj, `${prop}.0.n`, 'new');
+        guard.verify();
+        const actual = deepAccess(ortb2, prop);
+        if (allowed) {
+          expect(actual).to.eql([{n: 'new'}]);
+        } else {
+          expect(actual).to.eql([{n: 'orig'}]);
+        }
+      });
+    })
+  }
+
+  testAllowDeny(ACTIVITY_TRANSMIT_EIDS, ACTIVITY_ENRICH_EIDS, (allowed) => {
+    testPropertiesAreProtected(ORTB_EIDS_PATHS, allowed);
+  });
+
+  testAllowDeny(ACTIVITY_TRANSMIT_UFPD, ACTIVITY_ENRICH_UFPD, (allowed) => {
+    testPropertiesAreProtected(ORTB_UFPD_PATHS, allowed);
+  });
+});
+
+describe('ortb2FragmentsGuard', () => {
+  let guardFragments
+  beforeEach(() => {
+    const testGuard = objectGuard([
+      writeProtectRule({
+        paths: ['foo'],
+        applies: () => true,
+        name: 'testRule'
+      })
+    ])
+    guardFragments = ortb2FragmentsGuardFactory(testGuard);
+  });
+
+  it('should undo changes to global FPD', () => {
+    const fragments = {
+      global: {
+        foo: {inner: 'val'}
+      }
+    }
+    const guard = guardFragments(fragments);
+    guard.obj.global.foo = 'other';
+    guard.verify();
+    expect(fragments.global.foo).to.eql({inner: 'val'});
+  });
+
+  it('should undo changes to bidder FPD', () => {
+    const fragments = {
+      bidder: {
+        A: {
+          foo: 'val'
+        }
+      }
+    };
+    const guard = guardFragments(fragments);
+    guard.obj.bidder.A.foo = 'denied';
+    guard.verify();
+    expect(fragments.bidder.A).to.eql({foo: 'val'});
+  });
+
+  it('should undo changes to bidder FPD that was not initially there', () => {
+    const fragments = {
+      bidder: {}
+    };
+    const guard = guardFragments(fragments);
+    guard.obj.bidder.A = {foo: 'denied', other: 'allowed'};
+    guard.verify();
+    expect(fragments.bidder.A).to.eql({other: 'allowed'});
+  });
+})

package/test/spec/activities/params_spec.js

@@ -0,0 +1,25 @@
+import {
+  ACTIVITY_PARAM_ADAPTER_CODE,
+  ACTIVITY_PARAM_COMPONENT, ACTIVITY_PARAM_COMPONENT_NAME,
+  ACTIVITY_PARAM_COMPONENT_TYPE
+} from '../../../src/activities/params.js';
+import adapterManager from '../../../src/adapterManager.js';
+import {MODULE_TYPE_BIDDER} from '../../../src/activities/modules.js';
+import {activityParams} from '../../../src/activities/activityParams.js';
+
+describe('activityParams', () => {
+  it('fills out component params', () => {
+    sinon.assert.match(activityParams('bidder', 'mockBidder', {foo: 'bar'}), {
+      [ACTIVITY_PARAM_COMPONENT]: 'bidder.mockBidder',
+      [ACTIVITY_PARAM_COMPONENT_TYPE]: 'bidder',
+      [ACTIVITY_PARAM_COMPONENT_NAME]: 'mockBidder',
+      foo: 'bar'
+    })
+  });
+
+  it('fills out adapterCode', () => {
+    adapterManager.registerBidAdapter({callBids: sinon.stub(), getSpec: sinon.stub().returns({})}, 'mockBidder')
+    adapterManager.aliasBidAdapter('mockBidder', 'mockAlias');
+    expect(activityParams(MODULE_TYPE_BIDDER, 'mockAlias')[ACTIVITY_PARAM_ADAPTER_CODE]).to.equal('mockBidder');
+  });
+});

package/test/spec/activities/redactor_spec.js

@@ -0,0 +1,296 @@
+import {
+  objectTransformer,
+  ORTB_EIDS_PATHS, ORTB_GEO_PATHS,
+  ORTB_UFPD_PATHS,
+  redactorFactory, redactRule
+} from '../../../src/activities/redactor.js';
+import {ACTIVITY_PARAM_COMPONENT_NAME, ACTIVITY_PARAM_COMPONENT_TYPE} from '../../../src/activities/params.js';
+import {
+  ACTIVITY_TRANSMIT_EIDS,
+  ACTIVITY_TRANSMIT_PRECISE_GEO,
+  ACTIVITY_TRANSMIT_UFPD
+} from '../../../src/activities/activities.js';
+import {deepAccess, deepSetValue} from '../../../src/utils.js';
+import {activityParams} from '../../../src/activities/activityParams.js';
+
+describe('objectTransformer', () => {
+  describe('using dummy rules', () => {
+    let rule, applies, run;
+    beforeEach(() => {
+      run = sinon.stub();
+      applies = sinon.stub().callsFake(() => true)
+      rule = {
+        name: 'mockRule',
+        paths: ['foo', 'bar.baz'],
+        applies,
+        run,
+      }
+    });
+
+    it('runs rule for each path', () => {
+      const obj = {foo: 'val'};
+      objectTransformer([rule])({}, obj);
+      sinon.assert.calledWith(run, obj, null, obj, 'foo');
+      sinon.assert.calledWith(run, obj, 'bar', undefined, 'baz');
+    });
+
+    it('does not run rule once it is known that it does not apply', () => {
+      applies.reset();
+      applies.callsFake(() => false);
+      run.callsFake((_1, _2, _3, _4, applies) => applies());
+      objectTransformer([rule])({}, {});
+      expect(applies.callCount).to.equal(1);
+      expect(run.callCount).to.equal(1);
+    });
+
+    it('does not call apply more than once', () => {
+      run.callsFake((_1, _2, _3, _4, applies) => {
+        applies();
+        applies();
+      });
+      objectTransformer([rule])({}, {});
+      expect(applies.callCount).to.equal(1);
+    });
+
+    it('does not call apply if session already contains a result for the rule', () => {
+      objectTransformer([rule])({[rule.name]: false}, {});
+      expect(applies.callCount).to.equal(0);
+      expect(run.callCount).to.equal(0);
+    })
+
+    it('passes arguments to applies', () => {
+      run.callsFake((_1, _2, _3, _4, applies) => applies());
+      const arg1 = {n: 0};
+      const arg2 = {n: 1};
+      objectTransformer([rule])({}, {}, arg1, arg2);
+      sinon.assert.calledWith(applies, arg1, arg2);
+    });
+
+    it('collects rule results', () => {
+      let i = 0;
+      run.callsFake(() => i++);
+      const result = objectTransformer([rule])({}, {});
+      expect(result).to.eql([0, 1]);
+    })
+  });
+
+  describe('using redact rules', () => {
+    Object.entries({
+      replacement: {
+        get(path, val) {
+          return `repl${val}`
+        },
+        expectation(parent, prop, val) {
+          sinon.assert.match(parent, {
+            [prop]: val
+          })
+        }
+      },
+      removal: {
+        get(path, val) {},
+        expectation(parent, prop, val) {
+          expect(Object.keys(parent)).to.not.include.members([prop]);
+        }
+      }
+    }).forEach(([t, {get, expectation}]) => {
+      describe(`property ${t}`, () => {
+        it('should work on top level properties', () => {
+          const obj = {foo: 1, bar: 2};
+          objectTransformer([
+            redactRule({
+              name: 'test',
+              get,
+              paths: ['foo'],
+              applies() { return true }
+            })
+          ])({}, obj);
+          sinon.assert.match(obj, {
+            bar: 2
+          });
+          expectation(obj, 'foo', get(1));
+        });
+        it('should work on nested properties', () => {
+          const obj = {outer: {inner: {foo: 'bar'}, baz: 0}};
+          objectTransformer([
+            redactRule({
+              name: 'test',
+              get,
+              paths: ['outer.inner.foo'],
+              applies() { return true; }
+            })
+          ])({}, obj);
+          sinon.assert.match(obj, {
+            outer: {
+              baz: 0
+            }
+          });
+          expectation(obj.outer.inner, 'foo', get('bar'))
+        })
+      });
+    });
+    describe('should not run rule if property is', () => {
+      Object.entries({
+        'missing': {},
+        'empty array': {foo: []},
+        'empty object': {foo: {}},
+        'null': {foo: null},
+        'undefined': {foo: undefined}
+      }).forEach(([t, obj]) => {
+        it(t, () => {
+          const get = sinon.stub();
+          const applies = sinon.stub()
+          objectTransformer([redactRule({
+            name: 'test',
+            paths: ['foo'],
+            applies,
+            get,
+          })])({}, obj);
+          expect(get.called).to.be.false;
+          expect(applies.called).to.be.false;
+        })
+      })
+    });
+
+    describe('should run rule on falsy, but non-empty, value', () => {
+      Object.entries({
+        zero: 0,
+        false: false
+      }).forEach(([t, val]) => {
+        it(t, () => {
+          const obj = {foo: val};
+          objectTransformer([redactRule({
+            name: 'test',
+            paths: ['foo'],
+            applies() { return true },
+            get(val) { return 'repl' },
+          })])({}, obj);
+          expect(obj).to.eql({foo: 'repl'});
+        })
+      })
+    });
+
+    it('should not run applies twice for the same name/session combination', () => {
+      const applies = sinon.stub().callsFake(() => true);
+      const notApplies = sinon.stub().callsFake(() => false);
+      const t1 = objectTransformer([
+        {
+          name: 'applies',
+          paths: ['foo'],
+          applies,
+          get(val) { return `repl_r1_${val}`; },
+        },
+        {
+          name: 'notApplies',
+          paths: ['notFoo'],
+          applies: notApplies,
+        }
+      ].map(redactRule));
+      const t2 = objectTransformer([
+        {
+          name: 'applies',
+          paths: ['bar'],
+          applies,
+          get(val) { return `repl_r2_${val}` }
+        },
+        {
+          name: 'notApplies',
+          paths: ['notBar'],
+          applies: notApplies,
+        }
+      ].map(redactRule));
+      const obj = {
+        foo: '1',
+        notFoo: '2',
+        bar: '3',
+        notBar: '4'
+      }
+      const session = {};
+      t1(session, obj);
+      t2(session, obj);
+      expect(obj).to.eql({
+        foo: 'repl_r1_1',
+        notFoo: '2',
+        bar: 'repl_r2_3',
+        notBar: '4'
+      });
+      expect(applies.callCount).to.equal(1);
+      expect(notApplies.callCount).to.equal(1);
+    })
+  });
+});
+
+describe('redactor', () => {
+  const MODULE_TYPE = 'mockType';
+  const MODULE_NAME = 'mockModule';
+
+  let isAllowed, redactor;
+
+  beforeEach(() => {
+    isAllowed = sinon.stub();
+    redactor = redactorFactory((activity, params) => {
+      if (params[ACTIVITY_PARAM_COMPONENT_TYPE] === MODULE_TYPE && params[ACTIVITY_PARAM_COMPONENT_NAME] === MODULE_NAME) {
+        return isAllowed(activity)
+      } else {
+        throw new Error('wrong component')
+      }
+    })(activityParams(MODULE_TYPE, MODULE_NAME));
+  });
+
+  function testAllowDeny(activity, fn) {
+    Object.entries({
+      allowed: true,
+      denied: false
+    }).forEach(([t, allowed]) => {
+      describe(`when '${activity}' is ${t}`, () => {
+        beforeEach(() => {
+          isAllowed.callsFake((act) => {
+            if (act === activity) {
+              return allowed;
+            } else {
+              throw new Error('wrong activity');
+            }
+          });
+        });
+        fn(allowed);
+      });
+    });
+  }
+
+  function testPropertiesAreRemoved(method, properties, allowed) {
+    properties.forEach(prop => {
+      it(`should ${allowed ? 'NOT ' : ''}remove ${prop}`, () => {
+        const obj = {};
+        deepSetValue(obj, prop, 'mockVal');
+        method()(obj);
+        expect(deepAccess(obj, prop)).to.eql(allowed ? 'mockVal' : undefined);
+      })
+    })
+  }
+
+  describe('.bidRequest', () => {
+    testAllowDeny(ACTIVITY_TRANSMIT_EIDS, (allowed) => {
+      testPropertiesAreRemoved(() => redactor.bidRequest, ['userId', 'userIdAsEids'], allowed);
+    });
+  });
+
+  describe('.ortb2', () => {
+    testAllowDeny(ACTIVITY_TRANSMIT_EIDS, (allowed) => {
+      testPropertiesAreRemoved(() => redactor.ortb2, ORTB_EIDS_PATHS, allowed)
+    });
+
+    testAllowDeny(ACTIVITY_TRANSMIT_UFPD, (allowed) => {
+      testPropertiesAreRemoved(() => redactor.ortb2, ORTB_UFPD_PATHS, allowed)
+    });
+
+    testAllowDeny(ACTIVITY_TRANSMIT_PRECISE_GEO, (allowed) => {
+      ORTB_GEO_PATHS.forEach(path => {
+        it(`should ${allowed ? 'NOT ' : ''} round down ${path}`, () => {
+          const ortb2 = {};
+          deepSetValue(ortb2, path, 1.2345);
+          redactor.ortb2(ortb2);
+          expect(deepAccess(ortb2, path)).to.eql(allowed ? 1.2345 : 1.23);
+        })
+      })
+    })
+  });
+})