YieldbotBidAdapter ad markup to use implicit document open via write #3313
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
elljoh
changed the title
mkendall07
approved these changes
Nov 21, 2018
loic-talon
pushed a commit
to onfocusio/Prebid.js
that referenced
this pull request
Dec 19, 2018
ghost
pushed a commit
to devunrulymedia/Prebid.js
that referenced
this pull request
Jan 30, 2019
pedrolopezmrf
pushed a commit
to Marfeel/Prebid.js
that referenced
this pull request
Mar 18, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of change
Description of change
Changes the adapter internal ad markup to remove an explicit call to
document.open()on the rendering framecontentDocumentin preference to the implicit "open()" steps taken by the user-agent as part of a call todocument.write()when aDocumentis not already open for writing.Reasoning for the change
Observations in production deployments have shown cases where the
write()function of ad markup contentDocumentinstance is redefined to equal a function defined on the respectivecontentWindow; therefore, when the associatedcontentDocumentis open() 'ed, in most user-agents thecontentWindowglobals and events will be removed.The result being that the creative markup related to this PR would fail due to a call to an
undefinedfunction.The
contentDocument"core" function redefinitions observed were not cases of malicious code; rather, ad quality tooling deployed or implemented by media owners.