Ad
"));
+ // Rewriting is on by default, and a body-less fragment still receives
+ // the creative runtime (prepended), so the markup is carried rather
+ // than returned verbatim.
+ let adm = bid["adm"].as_str().expect("should serialize adm");
+ assert!(
+ adm.contains("Ad
"),
+ "should carry the creative: {adm}"
+ );
+ assert!(
+ adm.contains("/static/tsjs=tsjs-unified.min.js"),
+ "should inject the creative runtime into a body-less fragment: {adm}"
+ );
assert_eq!(bid["crid"], json!("appnexus-creative"));
assert_eq!(bid["w"], json!(300));
assert_eq!(bid["h"], json!(250));
@@ -951,8 +972,10 @@ mod tests {
}
#[test]
- fn convert_to_openrtb_response_rewrites_sanitized_creative_by_default() {
- let settings = make_settings();
+ fn convert_to_openrtb_response_rewrites_sanitized_creative_when_enabled() {
+ let mut settings = make_settings();
+ settings.auction.sanitize_creatives = true;
+ settings.auction.rewrite_creatives = true;
let auction_request = make_auction_request();
let result = make_result(make_complete_creative_bid());
@@ -999,12 +1022,88 @@ mod tests {
}
#[test]
- fn convert_to_openrtb_response_can_skip_rewriting_but_not_sanitization() {
+ fn convert_to_openrtb_response_can_skip_sanitization_when_disabled() {
+ // Sanitization strips every executable element with its inner content, which
+ // destroys script-based creatives (the majority of programmatic display).
+ // Publishers whose creatives render in a foreign-origin frame — where the
+ // markup cannot reach the publisher origin — can opt out and deliver the
+ // creative exactly as the bidder returned it.
let mut settings = make_settings();
+ settings.auction.sanitize_creatives = false;
settings.auction.rewrite_creatives = false;
let auction_request = make_auction_request();
let result = make_result(make_complete_creative_bid());
+ let original = make_complete_creative_bid()
+ .creative
+ .expect("should have a creative fixture");
+
+ let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+ .expect("should convert creative with sanitization disabled");
+ let adm = response_adm(response);
+
+ assert_eq!(
+ adm, original,
+ "should deliver the creative byte-for-byte as the bidder returned it"
+ );
+ }
+
+ #[test]
+ fn convert_to_openrtb_response_rewrites_raw_markup_without_sanitizing() {
+ // The fourth mode: rewriting enabled while sanitization stays off. The
+ // rewriter converts eligible resource/click URLs on the raw bidder
+ // markup and preserves executable content.
+ let mut settings = make_settings();
+ settings.auction.sanitize_creatives = false;
+ settings.auction.rewrite_creatives = true;
+ let auction_request = make_auction_request();
+ let result = make_result(make_complete_creative_bid());
+
+ let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
+ .expect("should convert creative with rewriting only");
+ let adm = response_adm(response);
+
+ assert!(
+ adm.contains("/first-party/proxy?tsurl="),
+ "should rewrite accepted resource URLs: {adm}"
+ );
+ assert!(
+ adm.contains("/first-party/click?tsurl="),
+ "should rewrite accepted click URLs: {adm}"
+ );
+ assert!(
+ adm.contains("auction-script-marker"),
+ "should preserve script content when sanitization is disabled: {adm}"
+ );
+ assert!(
+ adm.contains("auction-handler-marker"),
+ "should preserve event handlers when sanitization is disabled: {adm}"
+ );
+ }
+
+ #[test]
+ fn sanitize_creatives_defaults_to_disabled() {
+ let config = crate::auction_config_types::AuctionConfig::default();
+ assert!(
+ !config.sanitize_creatives,
+ "sanitization is opt-in: it blanks script-based creatives"
+ );
+ assert!(
+ config.rewrite_creatives,
+ "creative URL rewriting stays enabled by default"
+ );
+ }
+
+ #[test]
+ fn convert_to_openrtb_response_can_skip_rewriting_while_sanitizing() {
+ // The two controls are independent: sanitization can stay on while URL
+ // rewriting is off.
+ let mut settings = make_settings();
+ settings.auction.rewrite_creatives = false;
+ settings.auction.sanitize_creatives = true;
+ let auction_request = make_auction_request();
+ let result = make_result(make_complete_creative_bid());
+
let response = convert_to_openrtb_response(&result, &settings, &auction_request, false)
.expect("should convert creative with rewriting disabled");
let adm = response_adm(response);
@@ -1171,10 +1270,12 @@ mod tests {
"should preserve top slot impid"
);
assert_eq!(top_bid["price"], json!(2.75), "should preserve top price");
- assert_eq!(
- top_bid["adm"],
- json!("Ad
"),
- "should preserve top creative"
+ assert!(
+ top_bid["adm"]
+ .as_str()
+ .is_some_and(|adm| adm.contains("Ad
")),
+ "should preserve top creative: {}",
+ top_bid["adm"]
);
let sidebar_seatbid = seatbids
@@ -1202,10 +1303,12 @@ mod tests {
json!(1.25),
"should preserve sidebar price"
);
- assert_eq!(
- sidebar_bid["adm"],
- json!("Sidebar
"),
- "should preserve sidebar creative"
+ assert!(
+ sidebar_bid["adm"]
+ .as_str()
+ .is_some_and(|adm| adm.contains("Sidebar
")),
+ "should preserve sidebar creative: {}",
+ sidebar_bid["adm"]
);
assert_eq!(
json["ext"]["orchestrator"]["total_bids"],
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 4a143b223..c16a839e8 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -2102,6 +2102,7 @@ mod tests {
futures::executor::block_on(async {
let config = AuctionConfig {
enabled: true,
+ sanitize_creatives: true,
rewrite_creatives: true,
providers: vec![],
mediator: None,
diff --git a/crates/trusted-server-core/src/auction_config_types.rs b/crates/trusted-server-core/src/auction_config_types.rs
index c6c237e59..27b62b11b 100644
--- a/crates/trusted-server-core/src/auction_config_types.rs
+++ b/crates/trusted-server-core/src/auction_config_types.rs
@@ -11,7 +11,24 @@ pub struct AuctionConfig {
#[serde(default)]
pub enabled: bool,
- /// Rewrite sanitized winning-bid creative HTML to first-party endpoints.
+ /// Strip executable markup from winning-bid creative HTML before delivery.
+ ///
+ /// Sanitization removes `script`/`object`/`embed`/`form`/etc. **with their inner
+ /// content**, which blanks script-based creatives — the majority of programmatic
+ /// display. It is the primary defence when the creative renders in a context that
+ /// shares the publisher's origin.
+ ///
+ /// Disable only when creatives render in a foreign-origin frame (for example the
+ /// Prebid Universal Creative inside the ad server's iframe), where the markup
+ /// cannot reach the publisher origin. Defaults to disabled.
+ #[serde(
+ default = "default_sanitize_creatives",
+ skip_serializing_if = "is_default_sanitize_creatives"
+ )]
+ pub sanitize_creatives: bool,
+
+ /// Rewrite winning-bid creative HTML to first-party endpoints (applied
+ /// after sanitization when [`Self::sanitize_creatives`] is enabled).
///
/// The default must stay omitted from serialized config blobs: older
/// [`AuctionConfig`] schemas reject unknown fields during binary rollback.
@@ -53,6 +70,7 @@ impl Default for AuctionConfig {
fn default() -> Self {
Self {
enabled: false,
+ sanitize_creatives: default_sanitize_creatives(),
rewrite_creatives: default_rewrite_creatives(),
providers: Vec::new(),
mediator: None,
@@ -67,6 +85,10 @@ fn default_timeout() -> u32 {
2000
}
+fn default_sanitize_creatives() -> bool {
+ false
+}
+
fn default_rewrite_creatives() -> bool {
true
}
@@ -76,6 +98,10 @@ fn is_default_rewrite_creatives(value: &bool) -> bool {
*value == default_rewrite_creatives()
}
+fn is_default_sanitize_creatives(value: &bool) -> bool {
+ *value == default_sanitize_creatives()
+}
+
fn default_creative_store() -> String {
"creative_store".to_owned()
}
@@ -107,13 +133,17 @@ mod tests {
use super::*;
#[test]
- fn rewrite_creatives_defaults_to_true() {
+ fn creative_processing_defaults() {
let config: AuctionConfig =
serde_json::from_value(serde_json::json!({})).expect("should deserialize defaults");
assert!(
config.rewrite_creatives,
- "should enable creative rewriting by default"
+ "creative rewriting stays enabled by default: existing deployments keep first-party proxying"
+ );
+ assert!(
+ !config.sanitize_creatives,
+ "creative sanitization is opt-in: it strips executable markup with its content"
);
}
@@ -142,4 +172,31 @@ mod tests {
"should preserve an explicit rewrite opt-out"
);
}
+
+ #[test]
+ fn default_sanitize_creatives_is_not_serialized() {
+ let serialized =
+ serde_json::to_value(AuctionConfig::default()).expect("should serialize defaults");
+
+ assert!(
+ serialized.get("sanitize_creatives").is_none(),
+ "should omit the default sanitize setting"
+ );
+ }
+
+ #[test]
+ fn enabled_sanitize_creatives_is_serialized() {
+ let config = AuctionConfig {
+ sanitize_creatives: true,
+ ..AuctionConfig::default()
+ };
+ let serialized =
+ serde_json::to_value(config).expect("should serialize enabled sanitization");
+
+ assert_eq!(
+ serialized.get("sanitize_creatives"),
+ Some(&serde_json::Value::Bool(true)),
+ "should preserve an explicit sanitize opt-in"
+ );
+ }
}
diff --git a/crates/trusted-server-core/src/creative.rs b/crates/trusted-server-core/src/creative.rs
index 527b9869b..b2dd8c62a 100644
--- a/crates/trusted-server-core/src/creative.rs
+++ b/crates/trusted-server-core/src/creative.rs
@@ -506,10 +506,15 @@ pub fn sanitize_creative_html(markup: &str) -> String {
String::from_utf8(out).unwrap_or_default()
}
-/// Sanitize auction creative HTML, then optionally rewrite it to first-party endpoints.
+/// Optionally sanitize auction creative HTML, then optionally rewrite it to
+/// first-party endpoints.
///
-/// Sanitization is mandatory in both modes. Rewriting is controlled by
-/// [`crate::auction_config_types::AuctionConfig::rewrite_creatives`].
+/// Sanitization is controlled by
+/// [`crate::auction_config_types::AuctionConfig::sanitize_creatives`] and
+/// rewriting by
+/// [`crate::auction_config_types::AuctionConfig::rewrite_creatives`]. With both
+/// disabled the creative is returned exactly as the bidder sent it. In every
+/// mode, input over the 1 MiB per-creative cap is rejected (empty string).
#[must_use]
pub(crate) fn process_auction_creative(settings: &Settings, raw: &str) -> String {
process_auction_creative_with_rewriter(settings, raw, |sanitized| {
@@ -519,9 +524,10 @@ pub(crate) fn process_auction_creative(settings: &Settings, raw: &str) -> String
/// Process an inline auction creative rendered from a foreign-origin document.
///
-/// Sanitization is mandatory. When auction creative rewriting is enabled, proxy
-/// and click URLs are emitted as absolute URLs against `base_origin` without
-/// injecting the creative TSJS bundle.
+/// Applies the same opt-in sanitization as [`process_auction_creative`]. When
+/// auction creative rewriting is enabled, proxy and click URLs are emitted as
+/// absolute URLs against `base_origin` without injecting the creative TSJS
+/// bundle.
#[must_use]
pub(crate) fn process_inline_auction_creative(
settings: &Settings,
@@ -538,7 +544,24 @@ fn process_auction_creative_with_rewriter(
raw: &str,
rewrite: impl FnOnce(&str) -> String,
) -> String {
- let sanitized = sanitize_creative_html(raw);
+ // The per-creative size cap is a delivery invariant, not a sanitizer
+ // implementation detail: it must hold in every processing mode, including
+ // full pass-through, so oversized markup never reaches rewriting, JSON
+ // serialization, or the client. Fail closed with an empty string, matching
+ // the sanitizer's own oversized-input behaviour.
+ if raw.len() > MAX_CREATIVE_SIZE {
+ log::warn!(
+ "process_auction_creative: creative of {} bytes exceeds {} byte cap; rejecting",
+ raw.len(),
+ MAX_CREATIVE_SIZE
+ );
+ return String::new();
+ }
+ let sanitized = if settings.auction.sanitize_creatives {
+ sanitize_creative_html(raw)
+ } else {
+ raw.to_owned()
+ };
if settings.auction.rewrite_creatives {
rewrite(&sanitized)
} else {
@@ -629,13 +652,32 @@ fn rewrite_creative_html_impl(
) -> String {
// No size parsing needed now; all absolute/protocol-relative URLs are proxied uniformly.
let mut out = Vec::with_capacity(markup.len() + 64);
- let injected_ts_creative = std::cell::Cell::new(false);
+ // Shared with the `body` handler through an `Rc` so the outcome is readable
+ // here after rewriting: cloning a bare `Cell` would hand the handler an
+ // independent copy and always report "not injected".
+ let injected_ts_creative = std::rc::Rc::new(std::cell::Cell::new(false));
+ // Rewriting amplifies: every short URL becomes a signed proxy/click URL and
+ // anchors gain a `data-tsclick` copy, so an input comfortably under the cap
+ // can expand well past it. Bound the OUTPUT too, and stop accumulating once
+ // the limit trips, so a bidder cannot drive unbounded allocation in the
+ // WASM runtime by packing a creative with URL-bearing elements.
+ let overflowed = std::cell::Cell::new(false);
let mut rewriter = HtmlRewriter::new(
HtmlSettings {
element_content_handlers: vec
"#;
let processed = process_auction_creative(&settings, html);
@@ -1564,8 +1658,9 @@ mod tests {
}
#[test]
- fn process_auction_creative_can_skip_rewriting_but_not_sanitization() {
+ fn process_auction_creative_can_skip_rewriting_while_sanitizing() {
let mut settings = crate::test_support::tests::create_test_settings();
+ settings.auction.sanitize_creatives = true;
settings.auction.rewrite_creatives = false;
let html = r#""#;
@@ -1589,6 +1684,172 @@ mod tests {
);
}
+ #[test]
+ fn process_auction_creative_passes_through_byte_for_byte_when_disabled() {
+ let mut settings = crate::test_support::tests::create_test_settings();
+ settings.auction.sanitize_creatives = false;
+ settings.auction.rewrite_creatives = false;
+ let html = r#""#;
+
+ let processed = process_auction_creative(&settings, html);
+
+ assert_eq!(
+ processed, html,
+ "should return the creative exactly as the bidder sent it when both controls are disabled"
+ );
+ }
+
+ #[test]
+ fn process_auction_creative_rewrites_raw_markup_without_sanitizing() {
+ // The fourth mode: rewriting enabled, sanitization disabled. Eligible
+ // URLs are rewritten while executable markup is preserved.
+ let mut settings = crate::test_support::tests::create_test_settings();
+ settings.auction.sanitize_creatives = false;
+ settings.auction.rewrite_creatives = true;
+ let html = r#"x
"#;
+
+ let processed = process_auction_creative(&settings, html);
+
+ assert!(
+ processed.contains("/first-party/proxy?tsurl="),
+ "should rewrite accepted resource URLs: {processed}"
+ );
+ assert!(
+ processed.contains("marker"),
+ "should preserve script content when sanitization is disabled: {processed}"
+ );
+ assert!(
+ processed.contains("onclick"),
+ "should preserve event handlers when sanitization is disabled: {processed}"
+ );
+ }
+
+ #[test]
+ fn rewrite_only_mode_strips_base_elements() {
+ // Rewriting emits root-relative `/first-party/…` and `/static/tsjs=…`
+ // URLs, so a bidder-supplied x"#;
+
+ let processed = process_auction_creative(&settings, html);
+
+ assert!(
+ !processed.contains(""#;
+
+ let processed = super::process_inline_auction_creative(
+ &settings,
+ "https://news.publisher.example",
+ html,
+ );
+
+ assert!(
+ !processed.contains("{}
", "a".repeat(super::MAX_CREATIVE_SIZE + 1));
+ for (sanitize, rewrite) in [(false, false), (true, false), (false, true), (true, true)] {
+ let mut settings = crate::test_support::tests::create_test_settings();
+ settings.auction.sanitize_creatives = sanitize;
+ settings.auction.rewrite_creatives = rewrite;
+
+ let processed = process_auction_creative(&settings, &oversized);
+
+ assert!(
+ processed.is_empty(),
+ "should reject oversized creative with sanitize={sanitize} rewrite={rewrite}"
+ );
+ }
+ }
+
#[test]
fn to_abs_additional_cases() {
let settings = crate::test_support::tests::create_test_settings();
diff --git a/crates/trusted-server-core/src/proxy.rs b/crates/trusted-server-core/src/proxy.rs
index 38c90c350..274a5ab27 100644
--- a/crates/trusted-server-core/src/proxy.rs
+++ b/crates/trusted-server-core/src/proxy.rs
@@ -657,6 +657,27 @@ fn finalize_proxied_response_streaming(
beresp
}
+/// Allow proxied assets to load into opaque-origin creative frames.
+///
+/// Creative iframes are sandboxed without `allow-same-origin`, so their requests
+/// to `/first-party/proxy` are cross-origin with `Origin: null`. CORS-mode
+/// subresources — ES modules, `crossorigin` fonts, `fetch`/XHR — are blocked
+/// without an allow header, even though plain `{}
", "a".repeat(1024 * 1024 + 1)),
+ "oversized",
+ );
+ // An explicit empty `adm` is a supplied creative, not an absent one:
+ // classifying it as absent would re-enable the raw cache fallback.
+ assert_no_render_source(&test_settings(), String::new(), "explicit-empty");
+ }
+
+ #[test]
+ fn build_bid_map_keeps_cache_fallback_for_absent_creatives() {
+ // A bid with no supplied creative is the legitimate PBS Cache case:
+ // the coordinates are the only render source.
+ let mut winning_bids = HashMap::new();
+ let mut bid = cached_bid_with_creative("");
+ bid.creative = None;
+ winning_bids.insert("atf_sidebar_ad".to_string(), bid);
+
+ let map = build_bid_map(
+ &winning_bids,
+ PriceGranularity::Dense,
+ &test_settings(),
+ "",
+ false,
+ );
+ let obj = map
+ .get("atf_sidebar_ad")
+ .and_then(|v| v.as_object())
+ .expect("should have a bid entry");
+
+ assert_eq!(
+ obj.get("hb_cache_host").and_then(|v| v.as_str()),
+ Some("prebid-cache.example.com"),
+ "absent creative should keep hb_cache_host"
+ );
+ assert_eq!(
+ obj.get("hb_cache_path").and_then(|v| v.as_str()),
+ Some("/cache"),
+ "absent creative should keep hb_cache_path"
+ );
+ }
+
#[test]
fn build_bid_map_rewrites_inline_adm_to_absolute_first_party_urls() {
// The inline `adm` is rendered by the Prebid Universal Creative inside
@@ -7760,6 +7883,7 @@ mod tests {
// root-relative `/first-party/proxy` would resolve against GAM and 404.
// The tsjs bundle must NOT be injected into that foreign-origin iframe.
let mut settings = test_settings();
+ settings.auction.rewrite_creatives = true;
settings.publisher.domain = "example.com".to_string();
let mut winning_bids = HashMap::new();
@@ -7809,6 +7933,7 @@ mod tests {
// origin the visitor is on (here an HTTP dev host with a port), not the
// configured publisher domain.
let mut settings = test_settings();
+ settings.auction.rewrite_creatives = true;
settings.publisher.domain = "example.com".to_string();
let mut winning_bids = HashMap::new();
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index e193a70aa..6f623a630 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -3914,7 +3914,7 @@ origin_host_header_overide = "www.example.com""#,
}
#[test]
- fn test_auction_rewrite_creatives_defaults_to_true_when_omitted() {
+ fn test_auction_creative_processing_defaults_when_omitted() {
let toml_str = crate_test_settings_str()
+ r#"
[auction]
@@ -3926,7 +3926,11 @@ origin_host_header_overide = "www.example.com""#,
assert!(
settings.auction.rewrite_creatives,
- "should preserve creative rewriting when the setting is omitted"
+ "creative rewriting stays enabled when the setting is omitted"
+ );
+ assert!(
+ !settings.auction.sanitize_creatives,
+ "creative sanitization is opt-in when the setting is omitted"
);
}
diff --git a/crates/trusted-server-integration-tests/browser/tests/shared/creative-sandbox.spec.ts b/crates/trusted-server-integration-tests/browser/tests/shared/creative-sandbox.spec.ts
new file mode 100644
index 000000000..517aeb403
--- /dev/null
+++ b/crates/trusted-server-integration-tests/browser/tests/shared/creative-sandbox.spec.ts
@@ -0,0 +1,94 @@
+import { test, expect } from "@playwright/test";
+import { runtimeUrl } from "../../helpers/state.js";
+
+// Creative iframes are sandboxed WITHOUT `allow-same-origin`, so the creative
+// runtime executes in an opaque origin whose `location.href` is `about:srcdoc`.
+// jsdom cannot reproduce either condition, so the recovery path these tests
+// cover — resolve against the stamped first-party origin, skip the CORS-doomed
+// POST, navigate the GET rebuild fallback — is only observable in a real
+// browser.
+const CREATIVE_SANDBOX_TOKENS = [
+ "allow-forms",
+ "allow-popups",
+ "allow-popups-to-escape-sandbox",
+ "allow-scripts",
+ "allow-top-navigation-by-user-activation",
+].join(" ");
+
+// Mirrors the srcdoc document the client builds: the first-party parent stamps
+// its own origin ahead of any creative markup, then the runtime, then the
+// creative. The anchor carries a root-relative signed click exactly as the
+// server-side rewriter emits it.
+function creativeDocument(origin: string, bundleUrl: string): string {
+ const signedClick =
+ "/first-party/click?tsurl=https%3A%2F%2Fadvertiser.example%2Flanding&foo=1&tstoken=browser-test-token";
+ return `
+
+
+
+
+
+
+ ad
+
+`;
+}
+
+test.describe("Sandboxed creative iframe", () => {
+ test("recovers a mutated click through the GET rebuild fallback", async ({
+ page,
+ }) => {
+ await page.goto(runtimeUrl("/"), { waitUntil: "domcontentloaded" });
+
+ // Prefer whichever hashed bundle URL the server injected into the page so
+ // this test never has to know the current content hash; fall back to the
+ // stable unified path if the fixture page carries no injected script.
+ const injectedBundle = await page.evaluate(() => {
+ const script = Array.from(document.querySelectorAll("script[src]")).find(
+ (element) => (element as HTMLScriptElement).src.includes("/static/tsjs="),
+ );
+ return script ? (script as HTMLScriptElement).src : null;
+ });
+ const bundleUrl =
+ injectedBundle ?? runtimeUrl("/static/tsjs=tsjs-unified.min.js");
+
+ const rebuildRequest = page.waitForRequest(
+ (request) => request.url().includes("/first-party/proxy-rebuild"),
+ { timeout: 15_000 },
+ );
+
+ await page.evaluate(
+ ({ sandbox, html }) => {
+ const iframe = document.createElement("iframe");
+ iframe.setAttribute("sandbox", sandbox);
+ iframe.srcdoc = html;
+ iframe.style.width = "300px";
+ iframe.style.height = "250px";
+ document.body.appendChild(iframe);
+ },
+ {
+ sandbox: CREATIVE_SANDBOX_TOKENS,
+ html: creativeDocument(new URL(runtimeUrl("/")).origin, bundleUrl),
+ },
+ );
+
+ const frame = page.frameLocator("iframe");
+ const link = frame.locator("#creative-link");
+ await link.waitFor({ state: "attached", timeout: 10_000 });
+
+ // The creative mutates its own click target, the shape the click guard
+ // exists to repair.
+ await link.evaluate((element) => {
+ element.setAttribute(
+ "href",
+ "https://advertiser.example/landing?foo=1&bar=2",
+ );
+ });
+
+ await link.click({ force: true });
+
+ const request = await rebuildRequest;
+ expect(request.url()).toContain("tsclick=");
+ expect(decodeURIComponent(request.url())).toContain("bar");
+ });
+});
diff --git a/crates/trusted-server-js/lib/src/core/render.ts b/crates/trusted-server-js/lib/src/core/render.ts
index ee08ef288..586343402 100644
--- a/crates/trusted-server-js/lib/src/core/render.ts
+++ b/crates/trusted-server-js/lib/src/core/render.ts
@@ -7,15 +7,21 @@ import NORMALIZE_CSS from './styles/normalize.css?inline';
import IFRAME_TEMPLATE from './templates/iframe.html?raw';
// Sandbox permissions granted to creative iframes.
+//
// Ad creatives routinely contain scripts for tracking, click handling, and
-// viewability measurement, so allow-scripts and allow-same-origin are required
-// for creatives to render correctly. Server-side sanitization is the primary
-// defense against malicious markup; the sandbox provides defense-in-depth.
+// viewability measurement, so `allow-scripts` is required for them to render.
+//
+// `allow-same-origin` is deliberately excluded: combined with `allow-scripts` on
+// srcdoc (or first-party src) content, that pair effectively removes the sandbox's
+// origin isolation and would let SSP-provided markup run with the publisher
+// origin's privileges — cookies, storage, and same-origin fetches. The origin
+// boundary must not depend on server-side sanitization, which is optional
+// (`auction.sanitize_creatives`) and cannot run at all for renderer-based bids.
+// Matches APS_RENDERER_SANDBOX and ADM_IFRAME_SANDBOX, which already omit it.
const CREATIVE_SANDBOX_TOKENS = [
'allow-forms',
'allow-popups',
'allow-popups-to-escape-sandbox',
- 'allow-same-origin',
'allow-scripts',
'allow-top-navigation-by-user-activation',
] as const;
@@ -26,8 +32,10 @@ export type AcceptedCreativeHtml = {
kind: 'accepted';
originalLength: number;
sanitizedHtml: string;
- // Always equal to originalLength: the client validates type/emptiness only;
- // server-side sanitization has already run before adm reaches this function.
+ // Always equal to originalLength: the client validates type/emptiness only
+ // and never removes content. Server-side sanitization is opt-in
+ // (`auction.sanitize_creatives`); the origin boundary for this markup is the
+ // iframe sandbox, not this function.
// Retained so both union members of SanitizeCreativeHtmlResult have consistent fields.
sanitizedLength: number;
// Always 0 for the same reason — no content is removed client-side.
@@ -53,9 +61,12 @@ function normalizeId(raw: string): string {
}
// Validate the untrusted creative fragment before embedding it in the sandboxed iframe.
-// Dangerous markup is stripped server-side before adm reaches the client; this function
-// only guards against type errors and empty payloads. As a result, sanitizedLength always
-// equals originalLength and removedCount is always 0 for accepted creatives — these fields
+// This is validation-only, not sanitization: it guards against type errors and empty
+// payloads and never removes content. Server-side stripping of executable markup is
+// opt-in (`auction.sanitize_creatives`), so the adm arriving here may be raw bidder
+// markup — the origin boundary is the iframe sandbox (no `allow-same-origin`), which
+// does not depend on any sanitization having run. sanitizedLength always equals
+// originalLength and removedCount is always 0 for accepted creatives — these fields
// exist for structural consistency with the shared result type but carry no signal here.
export function sanitizeCreativeHtml(creativeHtml: unknown): SanitizeCreativeHtmlResult {
if (typeof creativeHtml !== 'string') {
@@ -163,7 +174,9 @@ export function renderAllAdUnits(): void {
type IframeOptions = { name?: string; title?: string; width?: number; height?: number };
-// Construct a sandboxed iframe sized for sanitized, non-executable creative HTML.
+// Construct a sandboxed iframe for creative HTML. The markup may be raw bidder
+// output (server-side sanitization is opt-in); the sandbox's origin isolation,
+// not any sanitization, is the security boundary.
export function createAdIframe(
container: HTMLElement,
opts: IframeOptions = {}
@@ -205,10 +218,29 @@ export function createAdIframe(
return iframe;
}
-// Build a complete HTML document for a sanitized creative fragment, suitable for iframe.srcdoc.
+// Origin the creative runtime resolves root-relative first-party URLs against.
+//
+// The srcdoc document has an opaque origin and an `about:srcdoc` location, so it
+// has no usable origin of its own; `document.baseURI` would work but is
+// inherited and honours a publisher `creative
';
+ const documentHtml = buildCreativeDocument(creativeHtml);
+
+ expect(documentHtml).toContain(`window.__tsCreativeOrigin = '${location.origin}'`);
+ expect(documentHtml.indexOf('__tsCreativeOrigin')).toBeLessThan(
+ documentHtml.indexOf(creativeHtml)
+ );
+ });
+
it('accepts safe static markup during sanitization', async () => {
const { sanitizeCreativeHtml } = await import('../../src/core/render');
const sanitization = sanitizeCreativeHtml(
diff --git a/crates/trusted-server-js/lib/test/integrations/creative/click.test.ts b/crates/trusted-server-js/lib/test/integrations/creative/click.test.ts
index 7cf31afa3..314123c16 100644
--- a/crates/trusted-server-js/lib/test/integrations/creative/click.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/creative/click.test.ts
@@ -4,6 +4,11 @@ import { FIRST_PARTY_CLICK, MUTATED_CLICK, PROXY_RESPONSE, importCreativeModule
const ORIGINAL_FETCH = global.fetch;
+// The guard persists validated, absolutized URLs (resolved against the pinned
+// trusted base), so expectations compare against the absolute forms.
+const absolute = (url: string): string => new URL(url, location.href).toString();
+const REBUILD_PREFIX = absolute('/first-party/proxy-rebuild?');
+
describe('creative/click.ts', () => {
beforeEach(() => {
vi.resetModules();
@@ -32,7 +37,7 @@ describe('creative/click.ts', () => {
await vi.runAllTimersAsync();
const finalHref = anchor.getAttribute('href') ?? '';
- expect(finalHref.startsWith('/first-party/proxy-rebuild?')).toBe(true);
+ expect(finalHref.startsWith(REBUILD_PREFIX)).toBe(true);
expect(finalHref).toContain('add=%7B%22bar%22%3A%222%22%7D');
expect(finalHref).toContain('del=%5B%22foo%22%5D');
});
@@ -68,7 +73,170 @@ describe('creative/click.ts', () => {
del: ['foo'],
});
- expect(anchor.getAttribute('href')).toBe(PROXY_RESPONSE);
- expect(anchor.getAttribute('data-tsclick')).toBe(PROXY_RESPONSE);
+ expect(anchor.getAttribute('href')).toBe(absolute(PROXY_RESPONSE));
+ expect(anchor.getAttribute('data-tsclick')).toBe(absolute(PROXY_RESPONSE));
+ });
+
+ it('skips the doomed POST and uses the GET fallback in an opaque origin', async () => {
+ // A sandboxed srcdoc creative without `allow-same-origin` has origin
+ // "null": its JSON POST preflights and fails, so the guard must go
+ // straight to the GET navigation fallback instead of fetching.
+ vi.useFakeTimers();
+
+ const originDescriptor = Object.getOwnPropertyDescriptor(window, 'origin');
+ Object.defineProperty(window, 'origin', { value: 'null', configurable: true });
+
+ const fetchMock = vi.fn().mockResolvedValue({
+ ok: true,
+ json: async () => ({ href: PROXY_RESPONSE }),
+ });
+ global.fetch = fetchMock as unknown as typeof fetch;
+
+ try {
+ const anchor = document.createElement('a');
+ anchor.setAttribute('data-tsclick', FIRST_PARTY_CLICK);
+ anchor.setAttribute('href', FIRST_PARTY_CLICK);
+ document.body.appendChild(anchor);
+
+ await importCreativeModule();
+
+ anchor.setAttribute('href', MUTATED_CLICK);
+
+ await Promise.resolve();
+ await vi.runAllTimersAsync();
+
+ expect(fetchMock).not.toHaveBeenCalled();
+ const finalHref = anchor.getAttribute('href') ?? '';
+ expect(finalHref.startsWith(REBUILD_PREFIX)).toBe(true);
+ expect(finalHref).toContain('add=%7B%22bar%22%3A%222%22%7D');
+ expect(finalHref).toContain('del=%5B%22foo%22%5D');
+ // The fallback must never become the canonical click: data-tsclick is
+ // what future mutation diffs compare against.
+ expect(anchor.getAttribute('data-tsclick')).toBe(FIRST_PARTY_CLICK);
+ } finally {
+ if (originDescriptor) {
+ Object.defineProperty(window, 'origin', originDescriptor);
+ } else {
+ delete (window as { origin?: string }).origin;
+ }
+ }
+ });
+
+ it('rebuilds a second mutation wave after an opaque-origin fallback', async () => {
+ // Wave 1 replaces href with the GET fallback; the canonical signed click in
+ // data-tsclick must survive so wave 2's mutation is still diffed and
+ // rebuilt instead of being lost.
+ vi.useFakeTimers();
+
+ const originDescriptor = Object.getOwnPropertyDescriptor(window, 'origin');
+ Object.defineProperty(window, 'origin', { value: 'null', configurable: true });
+ global.fetch = undefined as unknown as typeof fetch;
+
+ try {
+ const anchor = document.createElement('a');
+ anchor.setAttribute('data-tsclick', FIRST_PARTY_CLICK);
+ anchor.setAttribute('href', FIRST_PARTY_CLICK);
+ document.body.appendChild(anchor);
+
+ await importCreativeModule();
+
+ anchor.setAttribute('href', MUTATED_CLICK);
+ await Promise.resolve();
+ await vi.runAllTimersAsync();
+
+ expect(anchor.getAttribute('data-tsclick')).toBe(FIRST_PARTY_CLICK);
+
+ anchor.setAttribute('href', 'https://example.com/landing?baz=3');
+ await Promise.resolve();
+ await vi.runAllTimersAsync();
+
+ const finalHref = anchor.getAttribute('href') ?? '';
+ expect(finalHref.startsWith(REBUILD_PREFIX)).toBe(true);
+ expect(finalHref).toContain('baz');
+ expect(anchor.getAttribute('data-tsclick')).toBe(FIRST_PARTY_CLICK);
+ } finally {
+ if (originDescriptor) {
+ Object.defineProperty(window, 'origin', originDescriptor);
+ } else {
+ delete (window as { origin?: string }).origin;
+ }
+ }
+ });
+
+ it('navigates the observer-repaired fallback, not the pre-mutation click', async () => {
+ // Mutations made before any user interaction are repaired by the mutation
+ // observer, which writes the GET fallback to href while keeping the
+ // canonical signed click in data-tsclick. A later click must navigate the
+ // repaired URL — canonicalizing the fallback against the canonical click
+ // would fail the base comparison and silently navigate the original.
+ vi.useFakeTimers();
+
+ const originDescriptor = Object.getOwnPropertyDescriptor(window, 'origin');
+ Object.defineProperty(window, 'origin', { value: 'null', configurable: true });
+ global.fetch = undefined as unknown as typeof fetch;
+ const openMock = vi.fn();
+ const originalOpen = window.open;
+ window.open = openMock as unknown as typeof window.open;
+
+ try {
+ const anchor = document.createElement('a');
+ anchor.setAttribute('data-tsclick', FIRST_PARTY_CLICK);
+ anchor.setAttribute('href', FIRST_PARTY_CLICK);
+ // Force the middle-click branch so navigation lands in window.open,
+ // which jsdom can observe.
+ anchor.setAttribute('target', '_blank');
+ document.body.appendChild(anchor);
+
+ await importCreativeModule();
+
+ // Wave 1: creative mutates the link, observer repairs it.
+ anchor.setAttribute('href', MUTATED_CLICK);
+ await Promise.resolve();
+ await vi.runAllTimersAsync();
+
+ const repaired = anchor.getAttribute('href') ?? '';
+ expect(repaired.startsWith(REBUILD_PREFIX)).toBe(true);
+
+ // Now the user clicks.
+ anchor.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true }));
+ await Promise.resolve();
+ await vi.runAllTimersAsync();
+
+ expect(openMock).toHaveBeenCalled();
+ const navigated = String(openMock.mock.calls[0][0]);
+ expect(navigated.startsWith(REBUILD_PREFIX)).toBe(true);
+ expect(navigated).toContain('add=%7B%22bar%22%3A%222%22%7D');
+ expect(navigated).not.toBe(absolute(FIRST_PARTY_CLICK));
+ } finally {
+ window.open = originalOpen;
+ if (originDescriptor) {
+ Object.defineProperty(window, 'origin', originDescriptor);
+ } else {
+ delete (window as { origin?: string }).origin;
+ }
+ }
+ });
+
+ it('refuses to navigate to or persist non-http(s) URLs', async () => {
+ // The guard reads creative-controlled attributes; a javascript: value must
+ // never reach location.href or an href write.
+ vi.useFakeTimers();
+ global.fetch = undefined as unknown as typeof fetch;
+
+ const anchor = document.createElement('a');
+ anchor.setAttribute('data-tsclick', 'javascript:evil()');
+ anchor.setAttribute('href', 'javascript:evil()');
+ document.body.appendChild(anchor);
+
+ await importCreativeModule();
+
+ anchor.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true }));
+ await Promise.resolve();
+ await vi.runAllTimersAsync();
+
+ expect(anchor.getAttribute('href')).toBe('javascript:evil()');
+ // jsdom throws on real navigation, so reaching this point without an
+ // unhandled navigation error is the assertion that location.href was
+ // never assigned the javascript: URL.
});
});
diff --git a/crates/trusted-server-js/lib/test/integrations/creative/proxy_sign.test.ts b/crates/trusted-server-js/lib/test/integrations/creative/proxy_sign.test.ts
index 7f31dbed9..867c2b74e 100644
--- a/crates/trusted-server-js/lib/test/integrations/creative/proxy_sign.test.ts
+++ b/crates/trusted-server-js/lib/test/integrations/creative/proxy_sign.test.ts
@@ -51,4 +51,26 @@ describe('creative/proxy_sign.ts', () => {
const result = await signProxyUrl('https://cdn.example/asset.js');
expect(result).toBeNull();
});
+
+ it('skips the doomed POST in an opaque origin and returns null', async () => {
+ // A sandboxed srcdoc creative without `allow-same-origin` has origin
+ // "null": the JSON POST would preflight and fail, so signing bails out
+ // without issuing the request.
+ const originDescriptor = Object.getOwnPropertyDescriptor(window, 'origin');
+ Object.defineProperty(window, 'origin', { value: 'null', configurable: true });
+ const fetchMock = vi.fn();
+ global.fetch = fetchMock as unknown as typeof fetch;
+
+ try {
+ const result = await signProxyUrl('https://cdn.example/asset.js');
+ expect(result).toBeNull();
+ expect(fetchMock).not.toHaveBeenCalled();
+ } finally {
+ if (originDescriptor) {
+ Object.defineProperty(window, 'origin', originDescriptor);
+ } else {
+ delete (window as { origin?: string }).origin;
+ }
+ }
+ });
});
diff --git a/docs/guide/auction-orchestration.md b/docs/guide/auction-orchestration.md
index 7111d80dd..e11ae8f07 100644
--- a/docs/guide/auction-orchestration.md
+++ b/docs/guide/auction-orchestration.md
@@ -12,7 +12,7 @@ Key capabilities:
- **Strategy-based winner selection** — Automatic strategy detection based on configuration
- **Mediator support** — Optional external mediator for decoding encoded prices (e.g., APS) and applying unified floor pricing
- **Provider abstraction** — Pluggable provider interface for adding new demand sources
-- **Creative rewriting** — Winning creatives are sanitized and rewritten with first-party proxy URLs by default
+- **Creative processing** — Winning creatives are rewritten to first-party proxy URLs by default, with opt-in sanitization
## System Flow (Prebid + APS)
@@ -147,7 +147,7 @@ sequenceDiagram
Note over Client,Mock: Response Assembly
activate TS
activate Client
- Orch->>Orch: Transform to OpenRTB responseSanitize creative HTML
Optionally rewrite creative URLs
Add orchestrator metadata + Orch->>Orch: Transform to OpenRTB response
Optionally sanitize creative HTML
Optionally rewrite creative URLs
Add orchestrator metadata Orch-->>TS: OpenRTB BidResponse Note right of Orch: { "id": "auction-response",
"seatbid": [{ "seat": "amazon-aps",
"bid": [{ "price": 2.50,
"adm": "