Skip to content

Commit e29e828

Browse files
dgirardipatmmccannChrisHuieprebidjs-releasem-oranskaya
committed
Prebid Core: Start Github CoreQL Code Scans (prebid#8923)
* Create codeql-analysis.yml * Update codeql-analysis.yml * Update instream.html * Update emx_digitalBidAdapter_spec.js * Update index.js * Update index.js * Update index.js * Merge master (prebid#8873) * Readme: remove dead dev dependency and maintenance badges (prebid#8849) * Readme: remove dead dev dependency badge and issue * Remove maintainability and add back issues * Prebid 7.11.0 release * Increment version to 7.12.0-pre * Adriver Bid and Id Modules: buyerid bug fix (prebid#8768) * initial commit * adriver id submodule add * add id system tests, fix adriver bid adapter tests * adriver: fix buyerid * remarks fixing * removal of excess * delete custom parameter * bug fixes * handle native response privacy link (prebid#8838) Co-authored-by: Zicong Zhou <[email protected]> * Criteo Bid Adapter - Add support for banner+native multiformat ad unit (prebid#8842) Previously, the use of a native adunit was exclusive with the banner type. * Ras Bid Adapter: support for SlotSequence parameter (prebid#8792) * add rasbidadapter pos param * Read pos off the adunit * rename conflicting pos parameter for clarity * Improve Digital adapter: refactor code to align with latest RAZR creative tags (prebid#8827) * IX Bid Adapter: Native OpenRTB Request Support (prebid#8853) * fix native click trackers to only fire on click * fix unit tests for ix * remove version for native requests * remove unnecessary request conversion Co-authored-by: Zicong Zhou <[email protected]> * Update Sonobi adapter with GVLID (prebid#8860) * dgkeyword RTD provider: fix tests causing ID5 test failures (prebid#8862) * Id5 id configurable fetch flow (prebid#8784) Co-authored-by: Paweł Kowalski <[email protected]> * NextMillenium Bid Adapter: Remove ortb2 referrerInfo (prebid#8868) * remove ortb2, get device/site manually * updated tests * remove fallbacks * no need to craete variable if there is no fallback (return in place) * removed one test case Co-authored-by: Yakov Klein <[email protected]> * adserver.js : remove unused code (prebid#8855) * Displayio Bid Adapter: custom render; fix eids payload (prebid#8847) * Custom render; call pubmatic get user id function is removed * use refererInfo; remove call createEidsArray * VidCrunch LLC bidder (prebid#8872) Co-authored-by: Chris Huie <[email protected]> Co-authored-by: Prebid.js automated release <[email protected]> Co-authored-by: m-oranskaya <[email protected]> Co-authored-by: Love Sharma <[email protected]> Co-authored-by: Zicong Zhou <[email protected]> Co-authored-by: Léonard Labat <[email protected]> Co-authored-by: wsusrasp <[email protected]> Co-authored-by: Catalin Ciocov <[email protected]> Co-authored-by: Mike Miller <[email protected]> Co-authored-by: Demetrio Girardi <[email protected]> Co-authored-by: Scott Menzer <[email protected]> Co-authored-by: Paweł Kowalski <[email protected]> Co-authored-by: JacobKlein26 <[email protected]> Co-authored-by: Yakov Klein <[email protected]> Co-authored-by: caseywhitmire <[email protected]> Co-authored-by: philan15 <[email protected]> Co-authored-by: Gena <[email protected]> * Revert "Merge master (prebid#8873)" (prebid#8911) This reverts commit 07c5369. * Update code scan config * Update viewability * Sanitize JSON for adgeneration Co-authored-by: Patrick McCann <[email protected]> Co-authored-by: Chris Huie <[email protected]> Co-authored-by: Prebid.js automated release <[email protected]> Co-authored-by: m-oranskaya <[email protected]> Co-authored-by: Love Sharma <[email protected]> Co-authored-by: Zicong Zhou <[email protected]> Co-authored-by: Léonard Labat <[email protected]> Co-authored-by: wsusrasp <[email protected]> Co-authored-by: Catalin Ciocov <[email protected]> Co-authored-by: Mike Miller <[email protected]> Co-authored-by: Scott Menzer <[email protected]> Co-authored-by: Paweł Kowalski <[email protected]> Co-authored-by: JacobKlein26 <[email protected]> Co-authored-by: Yakov Klein <[email protected]> Co-authored-by: caseywhitmire <[email protected]> Co-authored-by: philan15 <[email protected]> Co-authored-by: Gena <[email protected]>
1 parent ca6d68e commit e29e828

File tree

8 files changed

+124
-20
lines changed

8 files changed

+124
-20
lines changed

‎.github/codeql/codeql-config.yml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
paths:
2+
- src
3+
- modules
4+
- libraries

‎.github/workflows/codeql-analysis.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: [ "master" ]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [ "master" ]
20+
schedule:
21+
- cron: '22 11 * * 0'
22+
23+
jobs:
24+
analyze:
25+
name: Analyze
26+
runs-on: ubuntu-latest
27+
permissions:
28+
actions: read
29+
contents: read
30+
security-events: write
31+
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
language: [ 'javascript' ]
36+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
37+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
38+
39+
steps:
40+
- name: Checkout repository
41+
uses: actions/checkout@v3
42+
43+
# Initializes the CodeQL tools for scanning.
44+
- name: Initialize CodeQL
45+
uses: github/codeql-action/init@v2
46+
with:
47+
languages: ${{ matrix.language }}
48+
config-file: ./.github/codeql/codeql-config.yml
49+
# If you wish to specify custom queries, you can do so here or in a config file.
50+
# By default, queries listed here will override any specified in a config file.
51+
# Prefix the list here with "+" to use these queries and those in the config file.
52+
53+
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
54+
# queries: security-extended,security-and-quality
55+
56+
57+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
58+
# If this step fails, then you should remove it and run the build manually (see below)
59+
- name: Autobuild
60+
uses: github/codeql-action/autobuild@v2
61+
62+
# ℹ️ Command-line programs to run using the OS shell.
63+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
64+
65+
# If the Autobuild fails above, remove it and uncomment the following three lines.
66+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
67+
68+
# - run: |
69+
# echo "Run, Build Application using script"
70+
# ./location_of_script_within_repo/buildscript.sh
71+
72+
- name: Perform CodeQL Analysis
73+
uses: github/codeql-action/analyze@v2

‎modules/adgenerationBidAdapter.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import {tryAppendQueryString, getBidIdParameter} from '../src/utils.js';
1+
import {tryAppendQueryString, getBidIdParameter, escapeUnsafeChars} from '../src/utils.js';
22
import {registerBidder} from '../src/adapters/bidderFactory.js';
33
import {BANNER, NATIVE} from '../src/mediaTypes.js';
44
import {config} from '../src/config.js';
@@ -230,7 +230,7 @@ function insertVASTMethodForAPV(targetId, vastXml) {
230230
};
231231
let script = document.createElement(`script`);
232232
script.type = 'text/javascript';
233-
script.innerHTML = `(function(){ new APV.VideoAd(${JSON.stringify(apvVideoAdParam)}).load('${vastXml.replace(/\r?\n/g, '')}'); })();`;
233+
script.innerHTML = `(function(){ new APV.VideoAd(${escapeUnsafeChars(JSON.stringify(apvVideoAdParam))}).load('${vastXml.replace(/\r?\n/g, '')}'); })();`;
234234
return script.outerHTML;
235235
}
236236

‎modules/consentManagement.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ function lookupIabConsent({onSuccess, onError}) {
145145
if (json[cmpDataPkgName] && json[cmpDataPkgName].callId) {
146146
const payload = json[cmpDataPkgName];
147147
// TODO - clean up this logic (move listeners?); we have duplicate messages responses because 2 eventlisteners are active from the 2 cmp requests running in parallel
148-
if (typeof cmpCallbacks[payload.callId] !== 'undefined') {
148+
if (cmpCallbacks.hasOwnProperty(payload.callId)) {
149149
cmpCallbacks[payload.callId](payload.returnValue, payload.success);
150150
}
151151
}

‎modules/consentManagementUsp.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ function lookupUspConsent({onSuccess, onError}) {
150150
function readPostMessageResponse(event) {
151151
const res = event && event.data && event.data.__uspapiReturn;
152152
if (res && res.callId) {
153-
if (typeof uspapiCallbacks[res.callId] !== 'undefined') {
153+
if (uspapiCallbacks.hasOwnProperty(res.callId)) {
154154
uspapiCallbacks[res.callId](res.returnValue, res.success);
155155
delete uspapiCallbacks[res.callId];
156156
}

‎modules/viewability.js

+14-14
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ export function init() {
1313
listenMessagesFromCreative();
1414
}
1515

16-
const observers = {};
16+
const observers = new Map();
1717

1818
function isValid(vid, element, tracker, criteria) {
1919
if (!element) {
@@ -36,7 +36,7 @@ function isValid(vid, element, tracker, criteria) {
3636
return false;
3737
}
3838

39-
if (!vid || observers[vid]) {
39+
if (!vid || observers.has(vid)) {
4040
logWarn(`${MODULE_NAME}: must provide an unregistered vid`, vid);
4141
return false;
4242
}
@@ -46,7 +46,7 @@ function isValid(vid, element, tracker, criteria) {
4646

4747
function stopObserving(observer, vid, element) {
4848
observer.unobserve(element);
49-
observers[vid].done = true;
49+
observers.get(vid).done = true;
5050
}
5151

5252
function fireViewabilityTracker(element, tracker) {
@@ -96,21 +96,21 @@ export function startMeasurement(vid, element, tracker, criteria) {
9696
viewable = entries[0].isIntersecting;
9797

9898
if (viewable) {
99-
observers[vid].timeoutId = window.setTimeout(() => {
99+
observers.get(vid).timeoutId = window.setTimeout(() => {
100100
viewabilityCriteriaMet(observer, vid, element, tracker);
101101
}, criteria.timeInView);
102-
} else if (observers[vid].timeoutId) {
103-
window.clearTimeout(observers[vid].timeoutId);
102+
} else if (observers.get(vid).timeoutId) {
103+
window.clearTimeout(observers.get(vid).timeoutId);
104104
}
105105
};
106106

107107
observer = new IntersectionObserver(stateChange, options);
108-
observers[vid] = {
108+
observers.set(vid, {
109109
observer: observer,
110110
element: element,
111111
timeoutId: null,
112112
done: false,
113-
};
113+
});
114114

115115
observer.observe(element);
116116

@@ -122,19 +122,19 @@ export function startMeasurement(vid, element, tracker, criteria) {
122122
* @param {string} vid unique viewability identifier
123123
*/
124124
export function stopMeasurement(vid) {
125-
if (!vid || !observers[vid]) {
125+
if (!vid || !observers.has(vid)) {
126126
logWarn(`${MODULE_NAME}: must provide a registered vid`, vid);
127127
return;
128128
}
129129

130-
observers[vid].observer.unobserve(observers[vid].element);
131-
if (observers[vid].timeoutId) {
132-
window.clearTimeout(observers[vid].timeoutId);
130+
observers.get(vid).observer.unobserve(observers.get(vid).element);
131+
if (observers.get(vid).timeoutId) {
132+
window.clearTimeout(observers.get(vid).timeoutId);
133133
}
134134

135135
// allow the observer under this vid to be created again
136-
if (!observers[vid].done) {
137-
delete observers[vid];
136+
if (!observers.get(vid).done) {
137+
observers.delete(vid);
138138
}
139139
}
140140

‎src/utils.js

+27
Original file line numberDiff line numberDiff line change
@@ -1381,3 +1381,30 @@ export function setScriptAttributes(script, attributes) {
13811381
}
13821382
}
13831383
}
1384+
1385+
/**
1386+
* Encode a string for inclusion in HTML.
1387+
* See https://pragmaticwebsecurity.com/articles/spasecurity/json-stringify-xss.html and
1388+
* https://codeql.github.com/codeql-query-help/javascript/js-bad-code-sanitization/
1389+
* @return {string}
1390+
*/
1391+
export const escapeUnsafeChars = (() => {
1392+
const escapes = {
1393+
'<': '\\u003C',
1394+
'>': '\\u003E',
1395+
'/': '\\u002F',
1396+
'\\': '\\\\',
1397+
'\b': '\\b',
1398+
'\f': '\\f',
1399+
'\n': '\\n',
1400+
'\r': '\\r',
1401+
'\t': '\\t',
1402+
'\0': '\\0',
1403+
'\u2028': '\\u2028',
1404+
'\u2029': '\\u2029'
1405+
};
1406+
1407+
return function(str) {
1408+
return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029\\]/g, x => escapes[x])
1409+
}
1410+
})();

‎test/pages/instream.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
<title>Prebid.js video adUnit example</title>
99

1010
<!-- videojs -->
11-
<link rel="stylesheet" href="http://vjs.zencdn.net/5.9.2/video-js.css">
12-
<script type="text/javascript" src="http://vjs.zencdn.net/5.9.2/video.js"></script>
11+
<link rel="stylesheet" href="https://vjs.zencdn.net/5.9.2/video-js.css">
12+
<script type="text/javascript" src="https://vjs.zencdn.net/5.9.2/video.js"></script>
1313

1414
<!-- videojs-vast-vpaid -->
1515
<link href="https://cdnjs.cloudflare.com/ajax/libs/videojs-vast-vpaid/2.0.2/videojs.vast.vpaid.min.css" rel="stylesheet">

0 commit comments

Comments
 (0)