Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent renderAd from overwriting the website DOM document #607

Merged
merged 2 commits into from
Sep 7, 2016
Merged

Prevent renderAd from overwriting the website DOM document #607

merged 2 commits into from
Sep 7, 2016

Conversation

kasparsd
Copy link
Contributor

@kasparsd kasparsd commented Sep 7, 2016

Fixes #602

@@ -441,7 +441,9 @@ $$PREBID_GLOBAL$$.renderAd = function (doc, id) {
var url = adObject.adUrl;
var ad = adObject.ad;

if (ad) {
if (doc===document) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need mark the winning bid before bailing out if the ad render call tries to replace the top document. Previously I had placed it right before the if (adObject) check but that's too early.

@mkendall07
Copy link
Member

LGTM. Thanks!

@mkendall07 mkendall07 merged commit ea0aba8 into prebid:master Sep 7, 2016
Studnicky pushed a commit to sonobi/Prebid.js that referenced this pull request Oct 4, 2016
* Ensure that we’re not writing to the current document

* Check for current document access after marking the ad as winning bid
Studnicky pushed a commit to sonobi/Prebid.js that referenced this pull request Oct 4, 2016
* Ensure that we’re not writing to the current document

* Check for current document access after marking the ad as winning bid
@kasparsd kasparsd deleted the feature/secure-adrender-document branch November 9, 2016 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants