merged with upstream

.github/PULL_REQUEST_TEMPLATE.md

@@ -41,7 +41,7 @@ For any user facing change, submit a link to a PR on the docs repo at https://gi
 }
 ```
 
-Be sure to test the integration with your adserver using the [Hello World](/integrationExamples/gpt/hello_world.html) sample page. -->
+Be sure to test the integration with your adserver using the [Hello World](https://github.com/prebid/Prebid.js/blob/master/integrationExamples/gpt/hello_world.html) sample page. -->
 
 
 ## Other information

.github/codeql/codeql-config.yml

@@ -2,3 +2,6 @@ paths:
   - src
   - modules
   - libraries
+queries:
+  - name: Prebid queries
+    uses: ./.github/codeql/queries

.github/codeql/queries/deviceMemory.ql

@@ -0,0 +1,14 @@
+/**
+ * @id prebid/device-memory
+ * @name Access to navigator.deviceMemory
+ * @kind problem
+ * @problem.severity warning
+ * @description Finds uses of deviceMemory
+ */
+
+import prebid
+
+from SourceNode nav
+where
+ nav = windowPropertyRead("navigator")
+select nav.getAPropertyRead("deviceMemory"), "deviceMemory is an indicator of fingerprinting"

.github/codeql/queries/hardwareConcurrency.ql

@@ -0,0 +1,14 @@
+/**
+ * @id prebid/hardware-concurrency
+ * @name Access to navigator.hardwareConcurrency
+ * @kind problem
+ * @problem.severity warning
+ * @description Finds uses of hardwareConcurrency
+ */
+
+import prebid
+
+from SourceNode nav
+where
+ nav = windowPropertyRead("navigator")
+select nav.getAPropertyRead("hardwareConcurrency"), "hardwareConcurrency is an indicator of fingerprinting"

.github/codeql/queries/prebid.qll

@@ -0,0 +1,36 @@
+import javascript
+import DataFlow
+
+SourceNode otherWindow() {
+ result = globalVarRef("top") or
+ result = globalVarRef("self") or
+ result = globalVarRef("parent") or
+ result = globalVarRef("frames").getAPropertyRead() or
+ result = DOM::documentRef().getAPropertyRead("defaultView")
+}
+
+SourceNode connectedWindow(SourceNode win) {
+  result = win.getAPropertyRead("self") or
+  result = win.getAPropertyRead("top") or
+  result = win.getAPropertyRead("parent") or
+  result = win.getAPropertyRead("frames").getAPropertyRead() or
+  result = win.getAPropertyRead("document").getAPropertyRead("defaultView")
+}
+
+SourceNode relatedWindow(SourceNode win) {
+  result = connectedWindow(win) or
+  result = relatedWindow+(connectedWindow(win))
+}
+
+SourceNode anyWindow() {
+  result = otherWindow() or
+  result = relatedWindow(otherWindow())
+}
+
+/*
+ Matches uses of property `prop` done on any window object.
+*/
+SourceNode windowPropertyRead(string prop) {
+  result = globalVarRef(prop) or
+  result = anyWindow().getAPropertyRead(prop)
+}

.github/codeql/queries/qlpack.yml

@@ -0,0 +1,8 @@
+---
+library: false
+warnOnImplicitThis: false
+name: queries
+version: 0.0.1
+dependencies:
+  codeql/javascript-all: ^1.1.1
+  codeql/javascript-queries: ^1.1.0

.github/release-drafter.yml

@@ -1,6 +1,10 @@
 
 name-template: 'Prebid $RESOLVED_VERSION Release'
 tag-template: '$RESOLVED_VERSION'
+autolabeler:
+  - label: 'maintenance'
+    title:
+      - '/^(?!.*(bug|initial|release|fix)).*$/i'
 categories:
   - title: '🚀 New Features'
     label: 'feature'

.github/workflows/jscpd.yml

@@ -29,7 +29,7 @@ jobs:
       run: |
         echo '{
           "threshold": 20,
-          "minTokens": 50,
+          "minTokens": 100,
           "reporters": [
             "json"
           ],
@@ -109,7 +109,7 @@ jobs:
             const lines = duplication.lines;
             comment += `- [\`${firstFile.name}\`](${link(firstFile)}) has ${lines} duplicated lines with [\`${secondFile.name}\`](${link(secondFile)})\n`;
           });
-          comment += "\nReducing code duplication by importing common functions from a library not only makes our code cleaner but also easier to maintain. Please move the common code from both files into a library and import it in each. Keep up the great work! 🚀";
+          comment += "\nReducing code duplication by importing common functions from a library not only makes our code cleaner but also easier to maintain. Please move the common code from both files into a library and import it in each. We hate that we have to mention this, however, commits designed to hide from this utility by renaming variables or reordering an object are poor conduct. We will not look upon them kindly! Keep up the great work! 🚀";
           github.rest.issues.createComment({
             owner: context.repo.owner,
             repo: context.repo.repo,

.github/workflows/linter.yml

@@ -30,14 +30,17 @@ jobs:
         run: npm ci
 
       - name: Get the diff
-        run: git diff --name-only origin/${{ github.event.pull_request.base.ref }}...refs/remotes/pull/${{ github.event.pull_request.number }}/merge > __changed_files.txt
+        run: git diff --name-only origin/${{ github.event.pull_request.base.ref }}...refs/remotes/pull/${{ github.event.pull_request.number }}/merge | grep '^\(modules\|src\|libraries\|creative\)/.*\.js$' > __changed_files.txt || true
 
       - name: Run linter on base branch
         run: npx eslint --no-inline-config --format json $(cat __changed_files.txt | xargs stat --printf '%n\n' 2> /dev/null) > __base.json || true
 
       - name: Check out PR
         run: git checkout ${{ github.event.pull_request.head.sha }}
 
+      - name: Install dependencies
+        run: npm ci
+
       - name: Run linter on PR
         run: npx eslint --no-inline-config --format json $(cat __changed_files.txt | xargs stat --printf '%n\n' 2> /dev/null) > __pr.json || true
 

README.md

@@ -1,14 +1,14 @@
 [![Build Status](https://circleci.com/gh/prebid/Prebid.js.svg?style=svg)](https://circleci.com/gh/prebid/Prebid.js)
-[![Percentage of issues still open](http://isitmaintained.com/badge/open/prebid/Prebid.js.svg)](http://isitmaintained.com/project/prebid/Prebid.js "Percentage of issues still open")
+[![Percentage of issues still open](http://isitmaintained.com/badge/open/prebid/Prebid.js.svg)](https://isitmaintained.com/project/prebid/Prebid.js "Percentage of issues still open")
 [![Coverage Status](https://coveralls.io/repos/github/prebid/Prebid.js/badge.svg)](https://coveralls.io/github/prebid/Prebid.js)
 
 # Prebid.js
 
 > A free and open source library for publishers to quickly implement header bidding.
 
 This README is for developers who want to contribute to Prebid.js.
-Additional documentation can be found at [the Prebid homepage](http://prebid.org).
-Working examples can be found in [the developer docs](http://prebid.org/dev-docs/getting-started.html).
+Additional documentation can be found at [the Prebid.js documentation homepage](https://docs.prebid.org/prebid/prebidjs.html).
+Working examples can be found in [the developer docs](https://prebid.org/dev-docs/getting-started.html).
 
 Prebid.js is open source software that is offered for free as a convenience. While it is designed to help companies address legal requirements associated with header bidding, we cannot and do not warrant that your use of Prebid.js will satisfy legal requirements. You are solely responsible for ensuring that your use of Prebid.js complies with all applicable laws.  We strongly encourage you to obtain legal advice when using Prebid.js to ensure your implementation complies with all laws where you operate.
 
@@ -26,7 +26,7 @@ Prebid.js is open source software that is offered for free as a convenience. Whi
 
 *Note:* Requires Prebid.js v1.38.0+
 
-Prebid.js depends on Babel and some Babel Plugins in order to run correctly in the browser.  Here are some examples for 
+Prebid.js depends on Babel and some Babel Plugins in order to run correctly in the browser.  Here are some examples for
 configuring webpack to work with Prebid.js.
 
 With Babel 7:
@@ -37,7 +37,7 @@ module.exports = {
   mode: 'production',
   module: {
     rules: [
-      
+
       // this rule can be excluded if you don't require babel-loader for your other application files
       {
         test: /\.m?js$/,
@@ -46,7 +46,7 @@ module.exports = {
           loader: 'babel-loader',
         }
       },
-      
+
       // this separate rule is required to make sure that the Prebid.js files are babel-ified.  this rule will
       // override the regular exclusion from above (for being inside node_modules).
       {
@@ -71,15 +71,15 @@ Or for Babel 6:
             // you must manually install and specify the presets and plugins yourself
             options: {
               plugins: [
-                "transform-object-assign", // required (for IE support) and "babel-plugin-transform-object-assign" 
+                "transform-object-assign", // required (for IE support) and "babel-plugin-transform-object-assign"
                                            // must be installed as part of your package.
                 require('prebid.js/plugins/pbjsGlobals.js') // required!
               ],
               presets: [
                 ["env", {                 // you can use other presets if you wish.
                   "targets": {            // this example is using "babel-presets-env", which must be installed if you
                     "browsers": [         // follow this example.
-                      ... // your browser targets. they should probably match the targets you're using for the rest 
+                      ... // your browser targets. they should probably match the targets you're using for the rest
                           // of your application
                     ]
                   }
@@ -143,7 +143,7 @@ This will run testing but not linting. A web server will start at `http://localh
 
 Development may be a bit slower but if you prefer linting and additional watch files you can also still run just:
 
-    $ gulp serve 
+    $ gulp serve
 
 
 ### Build Optimization
@@ -162,11 +162,11 @@ Building with just these adapters will result in a smaller bundle which should a
 - Then run the build:
 
         $ gulp build --modules=openxBidAdapter,rubiconBidAdapter,sovrnBidAdapter
-        
+
 Alternatively, a `.json` file can be specified that contains a list of modules you would like to include.
 
     $ gulp build --modules=modules.json
-        
+
 With `modules.json` containing the following
 ```json modules.json
 [
@@ -202,7 +202,7 @@ gulp bundle --tag one --modules=one.json
 gulp bundle --tag two --modules=two.json
 ```
 
-This generates slightly larger files, but has the advantage of being much faster to run (after the initial `gulp build`). It's also the method used by [the Prebid.org download page](https://docs.prebid.org/download.html).  
+This generates slightly larger files, but has the advantage of being much faster to run (after the initial `gulp build`). It's also the method used by [the Prebid.org download page](https://docs.prebid.org/download.html).
 
 <a name="Run"></a>
 
@@ -374,11 +374,11 @@ The results will be in
 
 *Note*: Starting in June 2016, all pull requests to Prebid.js need to include tests with greater than 80% code coverage before they can be merged.  For more information, see [#421](https://github.com/prebid/Prebid.js/issues/421).
 
-For instructions on writing tests for Prebid.js, see [Testing Prebid.js](http://prebid.org/dev-docs/testing-prebid.html).
+For instructions on writing tests for Prebid.js, see [Testing Prebid.js](https://prebid.org/dev-docs/testing-prebid.html).
 
 ### Supported Browsers
 
-Prebid.js is supported on IE11 and modern browsers until 5.x. 6.x+ transpiles to target >0.25%; not Opera Mini; not IE11. 
+Prebid.js is supported on IE11 and modern browsers until 5.x. 6.x+ transpiles to target >0.25%; not Opera Mini; not IE11.
 
 ### Governance
 Review our governance model [here](https://github.com/prebid/Prebid.js/tree/master/governance.md).

creative/crossDomain.js

@@ -32,10 +32,13 @@ function isPrebidWindow(win) {
 
 export function renderer(win) {
   let target = win.parent;
-  while (target !== win.top && !isPrebidWindow(target)) {
-    target = target.parent;
+  try {
+    while (target !== win.top && !isPrebidWindow(target)) {
+      target = target.parent;
+    }
+    if (!isPrebidWindow(target)) target = win.parent;
+  } catch (e) {
   }
-  if (!isPrebidWindow(target)) target = win.parent;
 
   return function ({adId, pubUrl, clickUrl}) {
     const pubDomain = new URL(pubUrl, window.location).origin;

integrationExamples/gpt/51DegreesRtdProvider_example.html

@@ -92,7 +92,7 @@
                             name: '51Degrees',
                             waitForIt: true,
                             params: {
-                                // Get your resource key from https://configure.51degrees.com/tWrhNfY6
+                                // Get your resource key from https://configure.51degrees.com/HNZ75HT1
                                 resourceKey: '<YOUR_RESOURCE_KEY>',
                                 // alternatively, you can use the on-premise version of the 51Degrees service and connect to your chosen end point
                                 // onPremiseJSUrl: 'https://localhost/51Degrees.core.js'
@@ -181,12 +181,11 @@ <h3>div-banner-native-2</h3>
         <h3>Testing/Debugging Guidance</h3>
         <ol>
             <li>Make sure you have <code>debug: true</code> under <code>pbjs.setConfig</code> in this example code (be sure to remove it for production!)
-            <li>Make sure you have replaced <code>&lt;YOUR RESOURCE KEY&gt;</code> in this example code with the one you have obtained 
-            from the <a href="https://configure.51degrees.com/tWrhNfY6" target="blank;">51Degrees Configurator Tool</a></li>
+            <li>Make sure you have replaced <code>&lt;YOUR RESOURCE KEY&gt;</code> in this example code with the one you have obtained
+            from the <a href="https://configure.51degrees.com/HNZ75HT1" target="blank;">51Degrees Configurator Tool</a></li>
             <li>Open DevTools Console in your browser and refresh the page</li>
             <li>Observe the enriched ortb device data shown below and also in the console as part of the <code>[51Degrees RTD Submodule]: reqBidsConfigObj:</code> message (under <code>reqBidsConfigObj.global.device</code>)</li>
         </ol>
-
     </div>
     <div id="enriched-51" style="display: none">
         <h3>Enriched ORTB2 device data</h3>