Ogury Bid Adapter: fix SecurityError in cross-origin iframes

[RemyLespagnol]

Type of change

• Bugfix
• Updated bidder adapter

Description of change

The Ogury bid adapter throws a SecurityError and returns noBid when it runs inside a cross-origin iframe, because of unguarded window.top access in three places.

1. site.page derivation — ortbConverterProps.request() no longer does deepSetValue(req, 'site.page', getWindowContext().location.href). The core already sets it: enrichFPD populates ortb2.site.page from refererInfo before every auction and merges it under the publisher's own ortb2, so a publisher-configured pageUrl already takes precedence, and the ORTB converter seeds the request from bidderRequest.ortb2. Overriding it here discarded publisher-configured URLs (custom pageUrl for SPAs, SafeFrames) and, when the top window was not readable, fell back to the iframe's own location instead of the real page.

2. onBidWon() — the nurl win ping now fires before the OG_PREBID_BID_OBJECT write, and the write is wrapped in try/catch. Previously a cross-origin write threw and prevented the win notification from being sent at all, losing billing/reporting.

3. onTimeout() — reports timeoutData[0].ortb2.site.page instead of the local frame's window.location.href, so timeout monitoring matches the URL actually sent in the bid request. Falls back to getRefererInfo().page, then window.location.href, for timeout events that carry no FPD.

ADAPTER_VERSION bumped 2.1.0 → 2.1.1.

No bidder parameters were added or changed, so no documentation PR is required.

Other information

Tests added to test/spec/modules/oguryBidAdapter_spec.js:

• the shared bidderRequestBase fixture now carries refererInfo;
• buildRequests — asserts no throw and the correct site.page when window.top.location throws a SecurityError;
• buildRequests — asserts a publisher-provided ortb2.site.page is preserved rather than overridden;
• onBidWon — asserts the nurl ping still fires when the top window is not writable (simulated with a frozen object, same failure shape as a cross-origin SecurityError);
• onTimeout — asserts the reported location is the top-level page URL from ortb2.site.page.

Each test was confirmed to fail against the pre-fix code for the expected reason before the fix was applied.

Results:

• npx eslint modules/oguryBidAdapter.js test/spec/modules/oguryBidAdapter_spec.js — clean, no issues found.
• npx gulp test --nolint --file test/spec/modules/oguryBidAdapter_spec.js — 92 tests completed, 0 failures.

[github-actions]

This PR introduces changes that may not work on all browsers. According to Babel, the following polyfills may be needed, and they are not automatically included:

• Changes to test/spec/modules/oguryBidAdapter_spec.js may need:
  • web.dom-exception.stack

The best way to address this is to provide good test coverage, as normal PR checks run unit tests on older browsers.

[barecheck]

Barecheck - Code coverage report

Total: 91.16%

Your code coverage diff: 0.00% ▴

✅ All code changes are covered