utils.getTopWindowLocation() returns exception object when Prebid is loaded in an unfriendly iframe

[taihwasong]

Type of issue

Bug

Description

When Prebid is loaded in an unfriendly iframe, utils.getTopWindowLocation() function is expected return a window object; however, the function returns an exception object instead.

Steps to reproduce

Load an iframe that its source contains a secure domain onto an insecure page. Prebid is loaded inside the secure iframe.

Example of exception thrown when utils.getTopWindowLocation().protocol is called:

Expected results

utils.getTopWindowLocation() should return the top-most window that it can possibly reach. In the above scenario from "Steps to reproduce" section, the function should return the iframe window because the iframe does now have access to its parent due to the cross-origin issue. At the very least, utils.getTopWindowLocation() should return the current window when it fails to get window.top.location object.

Actual results

utils.getTopWindowLocation() returns an exception object. This object throws an exception when used:

As a result of this issue, adapters that relies on this function to get the top most window do not participate in auction.

Platform details

Chrome Version 59.0.3071.115 (Official Build) (64-bit)

Other information

Note 1
This potentially breaks adapters that use this function:

grep -r 'utils.getTopWindowLocation()' .

./aardvarkBidAdapter.js:  var ref = utils.getTopWindowLocation();
./adbladeBidAdapter.js:    var loc = utils.getTopWindowLocation();
./beachfrontBidAdapter.js:        page: utils.getTopWindowLocation().host
./ucfunnelBidAdapter.js:    const host = utils.getTopWindowLocation().host;
./ucfunnelBidAdapter.js:    const page = utils.getTopWindowLocation().pathname;
./vertozBidAdapter.js:      let reqSrc = utils.getTopWindowLocation().href;
./adkernelBidAdapter.js:      if (utils.getTopWindowLocation().protocol === 'https:') {
./adkernelBidAdapter.js:    var location = utils.getTopWindowLocation();
./inneractiveBidAdapter.js:      this.pageProtocol = (utils.getTopWindowLocation().protocol === 'http:' ? 'http:' : 'https:');
./adbundBidAdapter.js:      domain: utils.getTopWindowLocation().hostname,
./quantcastBidAdapter.js:    let loc = utils.getTopWindowLocation();
./indexExchangeBidAdapter.js:      var url = utils.getTopWindowLocation().protocol === 'http:' ? 'http://as.casalemedia.com' : 'https://as-sec.casalemedia.com';
./indexExchangeBidAdapter.js:      scriptSrc = utils.getTopWindowLocation().protocol === 'http:' ? 'http://sandbox.ht.indexexchange.com' : 'https://sandbox.ht.indexexchange.com';
./indexExchangeBidAdapter.js:      scriptSrc = utils.getTopWindowLocation().protocol === 'http:' ? 'http://as.casalemedia.com' : 'https://as-sec.casalemedia.com';

Note 2
The current implementation suggests that the function should return current window location if it fails to reach the top window location. However, window.top.location returns an exception object instead of throwing an error; hence, the catch block was unreachable.

exports.getTopWindowLocation = function () {
  let location;
  try {
    location = window.top.location;
  } catch (e) {
    location = window.location;
  }

  return location;
};