[ParrableIdSystem] Ensure base64 payload is url-safe (#6258)

* Added url safe base64 encoding * Added url safe base64 encoding test Co-authored-by: Victor <victorigualada@gmail.com>
prebid · Feb 3, 2021 · 951f1e4 · 951f1e4
1 parent 8c0c7ab
commit 951f1e4
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 1 deletion.
diff --git a/modules/parrableIdSystem.js b/modules/parrableIdSystem.js
@@ -70,6 +70,15 @@ function isValidConfig(configParams) {
   return true;
 }
 
+function encodeBase64UrlSafe(base64) {
+  const ENC = {
+    '+': '-',
+    '/': '_',
+    '=': '.'
+  };
+  return base64.replace(/[+/=]/g, (m) => ENC[m]);
+}
+
 function readCookie() {
   const parrableIdStr = storage.getCookie(PARRABLE_COOKIE_NAME);
   if (parrableIdStr) {
@@ -182,7 +191,7 @@ function fetchId(configParams) {
   };
 
   const searchParams = {
-    data: btoa(JSON.stringify(data)),
+    data: encodeBase64UrlSafe(btoa(JSON.stringify(data))),
     _rand: Math.random()
   };
 

diff --git a/test/spec/modules/parrableIdSystem_spec.js b/test/spec/modules/parrableIdSystem_spec.js
@@ -136,6 +136,19 @@ describe('Parrable ID System', function() {
         expect(server.requests[0].url).to.contain('us_privacy=' + uspString);
       });
 
+      it('xhr base64 safely encodes url data object', function() {
+        const urlSafeBase64EncodedData = '-_.';
+        const btoaStub = sinon.stub(window, 'btoa').returns('+/=');
+        let getIdResult = parrableIdSubmodule.getId(P_CONFIG_MOCK);
+
+        getIdResult.callback(callbackSpy);
+
+        let request = server.requests[0];
+        let queryParams = utils.parseQS(request.url.split('?')[1]);
+        expect(queryParams.data).to.equal(urlSafeBase64EncodedData);
+        btoaStub.restore();
+      });
+
       it('should log an error and continue to callback if ajax request errors', function () {
         let callBackSpy = sinon.spy();
         let submoduleCallback = parrableIdSubmodule.getId({ params: {partner: 'prebid'} }).callback;