Repository navigation
Conversation
This reverts commit fa1f53a.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This PR introduces changes that may not work on all browsers. According to Babel, the following polyfills may be needed, and they are not automatically included:
The best way to address this is to provide good test coverage, as normal PR checks run unit tests on older browsers. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| export function receiveMessage(ev, cb) { | ||
| const data = parseMessage(ev); | ||
| if (data && isMessageAllowed(ev, data)) { | ||
| HANDLER_MAP[data.message](ensureAdId(data.adId, getReplier(ev)), data, getBidForMessage(data)); |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2d66347b5b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| fail(AD_RENDER_FAILED_REASON.CANNOT_FIND_AD, `Cannot find ad '${bid.adId}'`); | ||
| return; | ||
| } | ||
| const element = getAdUnitElement(actualBid); |
There was a problem hiding this comment.
🤖 This comment was written by an AI agent (GPT-5.6 Sol) on behalf of the requester.
When renderBid is called for an outstream/custom-renderer bid that has renderer but no safeRenderer, this path still creates the sandbox, but doRender.before later calls executeRenderer and bails before handleRenderRequest sends the iframe a response. Since that handler supplies no doc, executeRenderer falls back to the publisher's document, so bidder renderer code executes outside the promised isolation and the new iframe remains unanswered; reject this bid shape or route it through a safeRenderer before proceeding.
Useful? React with 👍 / 👎.
Barecheck - Code coverage reportTotal: 91.75%Your code coverage diff: 0.01% ▴ Uncovered files and lines
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This reverts commit ed47974.
Type of change
Description of change
This adds a new
safeRenderingmodule that exposes a new public API methodrenderBidand a single settingsafeRendering.exclusive.renderBid(bid, options)takes a bid (or just an object with an adId) and renders it in its.element, within an iframe that mimicks GAM safeframe isolation (there's no$sfyet, but the iframe cannot reach outside and has the same sandbox setup).optionsare the same options accepted byrenderAd.safeRendering.exclusiveturns off cross-origin messages that are not coming fromrenderBid. Currently any code that canpostMessageto Prebid's window and has a valid adId can get information about the ad and trigger some of prebid's rendering logic; withexclusive: true, any message that does not present the same token and source set up byrenderBidis ignored.Other information
Closes #15847