prebid.js 9.53.2 → 9.53.3

package/libraries/objectGuard/objectGuard.js

@@ -1,5 +1,5 @@
-import {isData, objectTransformer, sessionedApplies} from '../../src/activities/redactor.js';
-import {deepAccess, deepClone, deepEqual, deepSetValue} from '../../src/utils.js';
+import {isData, sessionedApplies} from '../../src/activities/redactor.js';
+import {deepEqual, logWarn} from '../../src/utils.js';
 
 /**
  * @typedef {import('../src/activities/redactor.js').TransformationRuleDef} TransformationRuleDef
@@ -12,66 +12,182 @@ import {deepAccess, deepClone, deepEqual, deepSetValue} from '../../src/utils.js
 /**
  * Create a factory function for object guards using the given rules.
  *
- * An object guard is a pair {obj, verify} where:
- *  - `obj` is a view on the guarded object that applies "redact" rules (the same rules used in activites/redactor.js)
- *  - `verify` is a function that, when called, will check that the guarded object was not modified
- *   in a way that violates any "write protect" rules, and rolls back any offending changes.
+ * An object guard is a view on the guarded object that applies "redact" rules (the same rules used in activites/redactor.js),
+ * and prevents writes (including deltes) that violate "write protect" rules.
  *
  * This is meant to provide sandboxed version of a privacy-sensitive object, where reads
  * are filtered through redaction rules and writes are checked against write protect rules.
  *
- * @param {Array[TransformationRule]} rules
- * @return {function(*, ...[*]): ObjectGuard}
  */
 export function objectGuard(rules) {
   const root = {};
-  const writeRules = [];
+
+  // rules are associated with specific portions of the object, e.g. "user.eids"
+  // build a tree representation of them, where the root is the object itself,
+  // and each node's children are properties of the corresponding (nested) object.
 
   rules.forEach(rule => {
-    if (rule.wp) writeRules.push(rule);
-    if (!rule.get) return;
     rule.paths.forEach(path => {
       let node = root;
       path.split('.').forEach(el => {
-        node.children = node.children || {};
-        node.children[el] = node.children[el] || {};
+        node.children = node.children ?? {};
+        node.children[el] = node.children[el] ?? { parent: node, path: node.path ? `${node.path}.${el}` : el };
         node = node.children[el];
-      })
-      node.rule = rule;
+        node.wpRules = node.wpRules ?? [];
+        node.redactRules = node.redactRules ?? [];
+      });
+      (rule.wp ? node.wpRules : node.redactRules).push(rule);
+      if (rule.wp) {
+        // mark the whole path as write protected, so that write operations
+        // on parents do not need to walk down the tree
+        let parent = node;
+        while (parent && !parent.hasWP) {
+          parent.hasWP = true;
+          parent = parent.parent;
+        }
+      }
     });
   });
 
-  const wpTransformer = objectTransformer(writeRules);
+  function getRedactRule(node) {
+    if (node.redactRule == null) {
+      node.redactRule = node.redactRules.length === 0 ? false : {
+        check: (applies) => node.redactRules.some(applies),
+        get(val) {
+          for (const rule of node.redactRules) {
+            val = rule.get(val);
+            if (!isData(val)) break;
+          }
+          return val;
+        }
+      }
+    }
+    return node.redactRule;
+  }
+
+  function getWPRule(node) {
+    if (node.wpRule == null) {
+      node.wpRule = node.wpRules.length === 0 ? false : {
+        check: (applies) => node.wpRules.some(applies),
+      }
+    }
+    return node.wpRule;
+  }
+
+  /**
+   * clean up `newValue` so that it doesn't violate any write protect rules
+   * when set onto the property represented by 'node'.
+   *
+   * This is done substituting (portions of) `curValue` when some rule is violated.
+   */
+  function cleanup(node, curValue, newValue, applies) {
+    if (
+      !node.hasWP ||
+      (!isData(curValue) && !isData(newValue)) ||
+      deepEqual(curValue, newValue)
+    ) {
+      return newValue;
+    }
+    const rule = getWPRule(node);
+    if (rule && rule.check(applies)) {
+      return curValue;
+    }
+    if (node.children) {
+      for (const [prop, child] of Object.entries(node.children)) {
+        const propValue = cleanup(child, curValue?.[prop], newValue?.[prop], applies);
+        if (newValue != null && typeof newValue === 'object') {
+          if (!isData(propValue) && !curValue?.hasOwnProperty(prop)) {
+            delete newValue[prop];
+          } else {
+            newValue[prop] = propValue;
+          }
+        } else {
+          logWarn(`Invalid value set for '${node.path}', expected an object`, newValue);
+          return curValue;
+        }
+      }
+    }
+    return newValue;
+  }
 
-  function mkGuard(obj, tree, applies) {
+  function isDeleteAllowed(node, curValue, applies) {
+    if (!node.hasWP || !isData(curValue)) {
+      return true;
+    }
+    const rule = getWPRule(node);
+    if (rule && rule.check(applies)) {
+      return false;
+    }
+    if (node.children) {
+      for (const [prop, child] of Object.entries(node.children)) {
+        if (!isDeleteAllowed(child, curValue?.[prop], applies)) {
+          return false;
+        }
+      }
+    }
+    return true;
+  }
+
+  function mkGuard(obj, tree, final, applies) {
     return new Proxy(obj, {
       get(target, prop, receiver) {
         const val = Reflect.get(target, prop, receiver);
-        if (tree.hasOwnProperty(prop)) {
-          const {children, rule} = tree[prop];
-          if (children && val != null && typeof val === 'object') {
-            return mkGuard(val, children, applies);
-          } else if (rule && isData(val) && applies(rule)) {
-            return rule.get(val);
+        if (final && val != null && typeof val === 'object') {
+          // a parent property has write protect rules, keep guarding
+          return mkGuard(val, tree, final, applies)
+        } else if (tree.children?.hasOwnProperty(prop)) {
+          const {children, hasWP} = tree.children[prop];
+          if ((children || hasWP) && val != null && typeof val === 'object') {
+            // some nested properties have rules, return a guard for the branch
+            return mkGuard(val, tree.children?.[prop] || tree, final || children == null, applies);
+          } else if (isData(val)) {
+            // if this property has redact rules, apply them
+            const rule = getRedactRule(tree.children[prop]);
+            if (rule && rule.check(applies)) {
+              return rule.get(val);
+            }
           }
         }
         return val;
       },
+      set(target, prop, newValue, receiver) {
+        if (final) {
+          // a parent property has rules, apply them
+          const rule = getWPRule(tree);
+          if (rule && rule.check(applies)) {
+            return true;
+          }
+        }
+        if (tree.children?.hasOwnProperty(prop)) {
+          // apply all (possibly nested) write protect rules
+          const curValue = Reflect.get(target, prop, receiver);
+          newValue = cleanup(tree.children[prop], curValue, newValue, applies);
+          if (!isData(newValue) && !target.hasOwnProperty(prop)) {
+            return true;
+          }
+        }
+        return Reflect.set(target, prop, newValue, receiver);
+      },
+      deleteProperty(target, prop) {
+        if (final) {
+          // a parent property has rules, apply them
+          const rule = getWPRule(tree);
+          if (rule && rule.check(applies)) {
+            return true;
+          }
+        }
+        if (tree.children?.hasOwnProperty(prop) && !isDeleteAllowed(tree.children[prop], target[prop], applies)) {
+          // some nested properties should not be deleted
+          return true;
+        }
+        return Reflect.deleteProperty(target, prop);
+      }
     });
   }
 
-  function mkVerify(transformResult) {
-    return function () {
-      transformResult.forEach(fn => fn());
-    }
-  }
-
   return function guard(obj, ...args) {
     const session = {};
-    return {
-      obj: mkGuard(obj, root.children || {}, sessionedApplies(session, ...args)),
-      verify: mkVerify(wpTransformer(session, obj, ...args))
-    }
+    return mkGuard(obj, root, false, sessionedApplies(session, ...args))
   };
 }
 
@@ -82,20 +198,5 @@ export function objectGuard(rules) {
 export function writeProtectRule(ruleDef) {
   return Object.assign({
     wp: true,
-    run(root, path, object, property, applies) {
-      const origHasProp = object && object.hasOwnProperty(property);
-      const original = origHasProp ? object[property] : undefined;
-      const origCopy = origHasProp && original != null && typeof original === 'object' ? deepClone(original) : original;
-      return function () {
-        const object = path == null ? root : deepAccess(root, path);
-        const finalHasProp = object && isData(object[property]);
-        const finalValue = finalHasProp ? object[property] : undefined;
-        if (!origHasProp && finalHasProp && applies()) {
-          delete object[property];
-        } else if ((origHasProp !== finalHasProp || finalValue !== original || !deepEqual(finalValue, origCopy)) && applies()) {
-          deepSetValue(root, (path == null ? [] : [path]).concat(property).join('.'), origCopy);
-        }
-      }
-    }
   }, ruleDef)
 }

package/libraries/objectGuard/ortbGuard.js

@@ -7,11 +7,7 @@ import {
   ORTB_UFPD_PATHS
 } from '../../src/activities/redactor.js';
 import {objectGuard, writeProtectRule} from './objectGuard.js';
-import {mergeDeep} from '../../src/utils.js';
-
-/**
- * @typedef {import('./objectGuard.js').ObjectGuard} ObjectGuard
- */
+import {logError} from '../../src/utils.js';
 
 function ortb2EnrichRules(isAllowed = isActivityAllowed) {
   return [
@@ -32,20 +28,10 @@ export function ortb2GuardFactory(isAllowed = isActivityAllowed) {
   return objectGuard(ortb2TransmitRules(isAllowed).concat(ortb2EnrichRules(isAllowed)));
 }
 
-/**
- *
- *
- * @typedef {Function} ortb2Guard
- * @param {{}} ortb2 ORTB object to guard
- * @param {{}} params activity params to use for activity checks
- * @returns {ObjectGuard}
- */
-
 /*
  * Get a guard for an ORTB object. Read access is restricted in the same way it'd be redacted (see activites/redactor.js);
  * and writes are checked against the enrich* activites.
  *
- * @type ortb2Guard
  */
 export const ortb2Guard = ortb2GuardFactory();
 
@@ -53,40 +39,44 @@ export function ortb2FragmentsGuardFactory(guardOrtb2 = ortb2Guard) {
   return function guardOrtb2Fragments(fragments, params) {
     fragments.global = fragments.global || {};
     fragments.bidder = fragments.bidder || {};
-    const bidders = new Set(Object.keys(fragments.bidder));
-    const verifiers = [];
-
-    function makeGuard(ortb2) {
-      const guard = guardOrtb2(ortb2, params);
-      verifiers.push(guard.verify);
-      return guard.obj;
-    }
-
-    const obj = {
-      global: makeGuard(fragments.global),
-      bidder: Object.fromEntries(Object.entries(fragments.bidder).map(([bidder, ortb2]) => [bidder, makeGuard(ortb2)]))
+    const guard = {
+      global: guardOrtb2(fragments.global, params),
+      bidder: new Proxy(fragments.bidder, {
+        get(target, prop, receiver) {
+          let bidderData = Reflect.get(target, prop, receiver);
+          if (bidderData != null) {
+            bidderData = guardOrtb2(bidderData, params)
+          }
+          return bidderData;
+        },
+        set(target, prop, newValue, receiver) {
+          if (newValue == null || typeof newValue !== 'object') {
+            logError(`ortb2Fragments.bidder[bidderCode] must be an object`);
+          }
+          let bidderData = Reflect.get(target, prop, receiver);
+          if (bidderData == null) {
+            bidderData = target[prop] = {};
+          }
+          bidderData = guardOrtb2(bidderData, params);
+          Object.entries(newValue).forEach(([prop, value]) => {
+            bidderData[prop] = value;
+          })
+          return true;
+        }
+      })
     };
 
-    return {
-      obj,
-      verify() {
-        Object.entries(obj.bidder)
-          .filter(([bidder]) => !bidders.has(bidder))
-          .forEach(([bidder, ortb2]) => {
-            const repl = {};
-            const guard = guardOrtb2(repl, params);
-            mergeDeep(guard.obj, ortb2);
-            guard.verify();
-            fragments.bidder[bidder] = repl;
-          })
-        verifiers.forEach(fn => fn());
-      }
-    }
+    return Object.defineProperties(
+      {},
+      Object.fromEntries(
+        // disallow overwriting of the top level `global` / `bidder`
+        Object.entries(guard).map(([prop, obj]) => [prop, {get: () => obj}])
+      )
+    )
   }
 }
 
 /**
  * Get a guard for an ortb2Fragments object.
- * @type {function(*, *): ObjectGuard}
  */
 export const guardOrtb2Fragments = ortb2FragmentsGuardFactory();

package/modules/adagioAnalyticsAdapter.js

@@ -267,7 +267,7 @@ function handlerAuctionInit(event) {
       ban_szs: bannerSizes.join(','),
       bdrs: sortedBidderNames.join(','),
       pgtyp: deepAccess(event.bidderRequests[0], 'ortb2.site.ext.data.pagetype', null),
-      plcmt: deepAccess(adUnits[0], 'ortb2Imp.ext.data.placement', null),
+      plcmt: deepAccess(adUnits[0], 'ortb2Imp.ext.data.adg_rtd.placement', null), // adg_rtd.placement is set by AdagioRtdProvider.
       t_n: adgRtdSession.testName || null,
       t_v: adgRtdSession.testVersion || null,
       s_id: adgRtdSession.id || null,
@@ -289,6 +289,11 @@ function handlerAuctionInit(event) {
         // for backward compatibility: if we didn't find organizationId & site but we have a bid from adagio we might still find it in params
         qp.org_id = qp.org_id || adagioAdUnitBids[0].params.organizationId;
         qp.site = qp.site || adagioAdUnitBids[0].params.site;
+
+        // `qp.plcmt` uses the value set by the AdagioRtdProvider. If not present, we fallback on the value set at the adUnit.params level.
+        if (!qp.plcmt) {
+          qp.plcmt = deepAccess(adagioAdUnitBids[0], 'params.placement', null);
+        }
       }
     }
 

package/modules/adagioBidAdapter.js

@@ -399,11 +399,18 @@ function autoFillParams(bid) {
     bid.params.site = adgGlobalConf.siteId.split(':')[1];
   }
 
-  // `useAdUnitCodeAsPlacement` is an edge case. Useful when a Prebid Manager cannot handle properly params setting.
-  // In Prebid.js 9, `placement` should be defined in ortb2Imp and the `useAdUnitCodeAsPlacement` param should be removed
-  bid.params.placement = deepAccess(bid, 'ortb2Imp.ext.data.placement', bid.params.placement);
-  if (!bid.params.placement && (adgGlobalConf.useAdUnitCodeAsPlacement === true || bid.params.useAdUnitCodeAsPlacement === true)) {
-    bid.params.placement = bid.adUnitCode;
+  if (!bid.params.placement) {
+    let p = deepAccess(bid, 'ortb2Imp.ext.data.adg_rtd.placement', '');
+    if (!p) {
+      // Use ortb2Imp.ext.data.placement for backward compatibility.
+      p = deepAccess(bid, 'ortb2Imp.ext.data.placement', '');
+    }
+
+    // `useAdUnitCodeAsPlacement` is an edge case. Useful when a Prebid Manager cannot handle properly params setting.
+    if (!p && bid.params.useAdUnitCodeAsPlacement === true) {
+      p = bid.adUnitCode;
+    }
+    bid.params.placement = p;
   }
 
   bid.params.adUnitElementId = deepAccess(bid, 'ortb2Imp.ext.data.divId', bid.params.adUnitElementId);

package/modules/adagioRtdProvider.js

@@ -47,7 +47,7 @@ export const PLACEMENT_SOURCES = {
 };
 export const storage = getStorageManager({ moduleType: MODULE_TYPE_RTD, moduleName: SUBMODULE_NAME });
 
-const { logError, logWarn } = prefixLog('AdagioRtdProvider:');
+const { logError, logInfo, logWarn } = prefixLog('AdagioRtdProvider:');
 
 // Guard to avoid storing the same bid data several times.
 const guard = new Set();
@@ -238,6 +238,25 @@ export const _internal = {
         return value;
       }
     });
+  },
+
+  // Compute the placement from the legacy RTD config params or ortb2Imp.ext.data.placement key.
+  computePlacementFromLegacy: function(rtdConfig, adUnit) {
+    const placementSource = deepAccess(rtdConfig, 'params.placementSource', '');
+    let placementFromSource = '';
+
+    switch (placementSource.toLowerCase()) {
+      case PLACEMENT_SOURCES.ADUNITCODE:
+        placementFromSource = adUnit.code;
+        break;
+      case PLACEMENT_SOURCES.GPID:
+        placementFromSource = deepAccess(adUnit, 'ortb2Imp.ext.gpid')
+        break;
+    }
+
+    const placementLegacy = deepAccess(adUnit, 'ortb2Imp.ext.data.placement', '');
+
+    return placementFromSource || placementLegacy;
   }
 };
 
@@ -317,7 +336,6 @@ function onBidRequest(bidderRequest, config, _userConsent) {
  * @param {*} config
  */
 function onGetBidRequestData(bidReqConfig, callback, config) {
-  const configParams = deepAccess(config, 'params', {});
   const { site: ortb2Site } = bidReqConfig.ortb2Fragments.global;
   const features = _internal.getFeatures().get();
   const ext = {
@@ -345,30 +363,11 @@ function onGetBidRequestData(bidReqConfig, callback, config) {
     const slotPosition = getSlotPosition(divId);
     deepSetValue(ortb2Imp, `ext.data.adg_rtd.adunit_position`, slotPosition);
 
-    // It is expected that the publisher set a `adUnits[].ortb2Imp.ext.data.placement` value.
-    // Btw, We allow fallback sources to programmatically set this value.
-    // The source is defined in the `config.params.placementSource` and the possible values are `code` or `gpid`.
-    // (Please note that this `placement` is not related to the oRTB video property.)
-    if (!deepAccess(ortb2Imp, 'ext.data.placement')) {
-      const { placementSource = '' } = configParams;
-
-      switch (placementSource.toLowerCase()) {
-        case PLACEMENT_SOURCES.ADUNITCODE:
-          deepSetValue(ortb2Imp, 'ext.data.placement', adUnit.code);
-          break;
-        case PLACEMENT_SOURCES.GPID:
-          deepSetValue(ortb2Imp, 'ext.data.placement', deepAccess(ortb2Imp, 'ext.gpid'));
-          break;
-        default:
-          logWarn('`ortb2Imp.ext.data.placement` is missing and `params.definePlacement` is not set in the config.');
-      }
-    }
-
-    // We expect that `pagetype`, `category`, `placement` are defined in FPD `ortb2.site.ext.data` and `adUnits[].ortb2Imp.ext.data` objects.
-    // Btw, we have to ensure compatibility with publishers that use the "legacy" adagio params at the adUnit.params level.
     const adagioBid = adUnit.bids.find(bid => _internal.isAdagioBidder(bid.bidder));
     if (adagioBid) {
       // ortb2 level
+      // We expect that `pagetype`, `category` are defined in FPD `ortb2.site.ext.data` object.
+      // Btw, we still ensure compatibility with publishers that use the adagio params at the adUnit.params level.
       let mustWarnOrtb2 = false;
       if (!deepAccess(ortb2Site, 'ext.data.pagetype') && adagioBid.params.pagetype) {
         deepSetValue(ortb2Site, 'ext.data.pagetype', adagioBid.params.pagetype);
@@ -378,21 +377,28 @@ function onGetBidRequestData(bidReqConfig, callback, config) {
         deepSetValue(ortb2Site, 'ext.data.category', adagioBid.params.category);
         mustWarnOrtb2 = true;
       }
-
-      // ortb2Imp level
-      let mustWarnOrtb2Imp = false;
-      if (!deepAccess(ortb2Imp, 'ext.data.placement')) {
-        if (adagioBid.params.placement) {
-          deepSetValue(ortb2Imp, 'ext.data.placement', adagioBid.params.placement);
-          mustWarnOrtb2Imp = true;
-        }
+      if (mustWarnOrtb2) {
+        logInfo('`pagetype` and/or `category` have been set in the FPD `ortb2.site.ext.data` object from `adUnits[].bids.adagio.params`.');
       }
 
-      if (mustWarnOrtb2) {
-        logWarn('`pagetype` and `category` must be defined in the FPD `ortb2.site.ext.data` object. Relying on `adUnits[].bids.adagio.params` is deprecated.');
+      // ortb2Imp level to handle legacy.
+      // The `placement` is finally set at the adUnit.params level (see https://github.com/prebid/Prebid.js/issues/12845)
+      // but we still need to set it at the ortb2Imp level for our internal use.
+      const placementParam = adagioBid.params.placement;
+      const adgRtdPlacement = deepAccess(ortb2Imp, 'ext.data.adg_rtd.placement', '');
+
+      if (placementParam) {
+        // Always overwrite the ortb2Imp value with the one from the adagio adUnit.params.placement if defined.
+        // This is the common case.
+        deepSetValue(ortb2Imp, 'ext.data.adg_rtd.placement', placementParam);
       }
-      if (mustWarnOrtb2Imp) {
-        logWarn('`placement` must be defined in the FPD `adUnits[].ortb2Imp.ext.data` object. Relying on `adUnits[].bids.adagio.params` is deprecated.');
+
+      if (!placementParam && !adgRtdPlacement) {
+        const p = _internal.computePlacementFromLegacy(config, adUnit);
+        if (p) {
+          deepSetValue(ortb2Imp, 'ext.data.adg_rtd.placement', p);
+          logWarn('`ortb2Imp.ext.data.adg_rtd.placement` has been set from a legacy source. Please set `bids[].adagio.params.placement` or `ortb2Imp.ext.data.adg_rtd.placement` value.');
+        }
       }
     }
   });