Prevent double-escaping of HTML-encoded ampersands in createTrackPixelHtml and add tests - #15327
Merged
patmmccann merged 2 commits intoJul 8, 2026
Conversation
### Motivation - Tracker image URLs coming from ad markup or XML can already contain HTML-entity encoded separators like `&`, and passing them through the existing encode+escape path produced `&` in emitted HTML which breaks server-side parameter parsing. ### Description - Add a small helper `decodeAmpersandEntities(url)` that converts existing `&` back to `&` before encoding. - Normalize URLs by calling `encode(decodeAmpersandEntities(url))` inside `createTrackPixelHtml` so already-encoded query separators are not double-escaped. - Add a unit test in `test/spec/utils_spec.js` that asserts `createTrackPixelHtml` preserves `&` separators in emitted `src` for an input URL containing `&`. - Fix nearby missing semicolons in `test/spec/utils_spec.js` to satisfy linting for the changed file. ### Testing - Ran lint on the changed files with `npx eslint src/utils.js test/spec/utils_spec.js --cache --cache-strategy content` and it passed for the final change set. - Ran the targeted unit tests with `npx gulp test --nolint --file test/spec/utils_spec.js` and the test chunk completed successfully (`185 tests completed`).
…e' into codex/fix-double-escaping-of-html-encoded-urls
patmmccann
merged commit Jul 8, 2026
87ce655
into
codex/fix-unsanitized-nurl-tracking-pixel-security-issue
5 checks passed
patmmccann
added a commit
that referenced
this pull request
Jul 28, 2026
…15049) * Core: escape tracking pixel URLs in HTML attributes * Core: avoid double-escaping tracker query separators (#15325) * Core: avoid double-escaping tracker query separators (#15327) ### Motivation - Tracker image URLs coming from ad markup or XML can already contain HTML-entity encoded separators like `&`, and passing them through the existing encode+escape path produced `&amp;` in emitted HTML which breaks server-side parameter parsing. ### Description - Add a small helper `decodeAmpersandEntities(url)` that converts existing `&` back to `&` before encoding. - Normalize URLs by calling `encode(decodeAmpersandEntities(url))` inside `createTrackPixelHtml` so already-encoded query separators are not double-escaped. - Add a unit test in `test/spec/utils_spec.js` that asserts `createTrackPixelHtml` preserves `&` separators in emitted `src` for an input URL containing `&`. - Fix nearby missing semicolons in `test/spec/utils_spec.js` to satisfy linting for the changed file. ### Testing - Ran lint on the changed files with `npx eslint src/utils.js test/spec/utils_spec.js --cache --cache-strategy content` and it passed for the final change set. - Ran the targeted unit tests with `npx gulp test --nolint --file test/spec/utils_spec.js` and the test chunk completed successfully (`185 tests completed`). * Kimberlite Bid Adapter: fix nurl pixel test expectation (#15338) * TrustX Bid Adapter: fix tracking URL test assertion (#15337) * Adkernel Bid Adapter: fix banner nurl pixel test (#15339) * Core: preserve tracking pixel URL behavior (#15390) --------- Co-authored-by: Demetrio Girardi <dgirardi@prebid.org>
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
&,&,&) are not double-escaped when building a tracking pixelimgsrcattribute, which can produce incorrect URLs or broken attributes.Description
decodeAmpersandEntitiesthat converts&,&, and&to the literal&before further processing.createTrackPixelHtmlto calldecodeAmpersandEntities(url)before applying the providedencodefunction and HTML-escaping, preventing double-encoding of already-encoded separators.test/spec/utils_spec.jswith cases verifying thatcreateTrackPixelHtmlpreserves or normalizes encoded query separators and does not double-escape them.encodeMacroURItest block for consistency.Testing
test/spec/utils_spec.jsspecs; the tests coveringcreateTrackPixelHtmlandencodeMacroURIpassed.&,&, and&were executed as part of the automated tests and succeeded.Codex Task