Whitelist embed types that are allowed to use amp-embed.

3p/integration.js

@@ -36,6 +36,14 @@ import {register, run} from '../src/3p';
 import {parseUrl} from '../src/url';
 import {assert} from '../src/asserts';
 
+/**
+ * Whether the embed type may be used with amp-embed tag.
+ * @const {!Object<string: boolean>}
+ */
+const AMP_EMBED_ALLOWED = {
+  /* embed type: true */
+};
+
 register('a9', a9);
 register('adreactor', adreactor);
 register('adsense', adsense);
@@ -62,6 +70,9 @@ export function draw3p(win, data, configCallback) {
   const type = data.type;
   assert(win.context.location.originValidated != null,
       'Origin should have been validated');
+
+  assert(isTagNameAllowed(data.type, win.context.tagName),
+      'Embed type %s not allowed with tag %s', data.type, win.context.tagName);
   if (configCallback) {
     configCallback(data, data => {
       assert(data, 'Expected configuration to be passed as first argument');
@@ -257,3 +268,18 @@ export function parseFragment(fragment) {
   }
   return json ? JSON.parse(json) : {};
 }
+
+/**
+ * Not all types of embeds are allowed to be used with all tag names on the
+ * AMP side. This function checks whether the current usage is permissible.
+ * @param {string} type
+ * @param {string|undefined} tagName The tagName that was used to embed this
+ *     3p-frame.
+ * @return {boolean}
+ */
+export function isTagNameAllowed(type, tagName) {
+  if (tagName == 'AMP-EMBED') {
+    return !!AMP_EMBED_ALLOWED[type];
+  }
+  return true;
+}

builtins/amp-embed.md

@@ -19,8 +19,8 @@ The `amp-embed` element is used to allow embedding elements in to the AMP page.
 
 #### Implementation
 
-The `<amp-embed>` is actually an alias to the [`<amp-ad>`](amp-ad.md)  tag, deriving all of it's functionality with a different tag name. 
-Can be used instead of `<amp-ad>` when that would be semanitcally more accurate.  
+The `<amp-embed>` is actually an alias to the [`<amp-ad>`](amp-ad.md)  tag, deriving all of it's functionality with a different tag name.
+Can be used instead of `<amp-ad>` when that would be semantically more accurate.
 
 ```html
 <amp-embed width=400 height=300

examples/ads.amp.html

@@ -121,13 +121,5 @@ <h2>Challenging ad.</h2>
       data-slot="/35096353/amptesting/badvideoad">
     </amp-ad>
 
-  <h2>A9 as amp-embed</h2>
-  <amp-embed width=300 height=250
-      type="a9"
-      data-aax_size="300x250"
-      data-aax_pubname="test123"
-      data-aax_src="302">
-  </amp-embed>
-
 </body>
 </html>

src/3p-frame.js

@@ -70,6 +70,7 @@ function getFrameAttributes(parentWindow, element, opt_type) {
     location: {
       href: locationHref
     },
+    tagName: element.tagName,
     mode: getMode()
   };
   const adSrc = element.getAttribute('src');

test/functional/test-3p-frame.js

@@ -71,7 +71,7 @@ describe('3p-frame', () => {
     link.setAttribute('href', 'https://foo.bar/baz');
     document.head.appendChild(link);
 
-    const div = document.createElement('div');
+    const div = document.createElement('my-element');
     div.setAttribute('data-test-attr', 'value');
     div.setAttribute('data-ping', 'pong');
     div.setAttribute('width', '50');
@@ -99,8 +99,8 @@ describe('3p-frame', () => {
         ',"_context":{"referrer":"' + referrer + '",' +
         '"canonicalUrl":"https://foo.bar/baz",' +
         '"pageViewId":"' + docInfo.pageViewId + '","clientId":"cidValue",' +
-        '"location":{"href":"' + locationHref + '"},"mode":{"localDev":true,' +
-        '"development":false,"minified":false}}}';
+        '"location":{"href":"' + locationHref + '"},"tagName":"MY-ELEMENT",' +
+        '"mode":{"localDev":true,"development":false,"minified":false}}}';
     expect(src).to.equal(
         'http://ads.localhost:9876/dist.3p/current/frame.max.html' +
         fragment);

test/functional/test-integration.js

@@ -187,4 +187,22 @@ describe('3p integration.js', () => {
       draw3p(win, data);
     }).to.throw(/Origin should have been validated/);
   });
+
+  it('should throw if origin was never validated', () => {
+    const data = {
+      type: 'testAction',
+    };
+    const win = {
+      context: {
+        location: {
+          originValidated: true
+        },
+        data: data,
+        tagName: 'AMP-EMBED',
+      }
+    };
+    expect(() => {
+      draw3p(win, data);
+    }).to.throw(/Embed type testAction not allowed with tag AMP-EMBED/);
+  });
 });