Unsanitized creative HTML injected into iframe with weakened sandbox #401

Summary

Creative HTML (bid.adm) from the upstream bidder response is injected into an iframe via srcdoc with no sanitization. The iframe sandbox includes both allow-scripts and allow-same-origin, which together allow script inside the iframe to remove its own sandbox attribute and gain full access to the publisher's page context, cookies, and localStorage.

Refs

• crates/js/lib/src/core/request.ts lines 77-102 — iframe.srcdoc = buildCreativeDocument(creativeHtml)
• crates/js/lib/src/core/render.ts lines 104-111 — sandbox with allow-scripts + allow-same-origin
• crates/js/lib/src/core/render.ts lines 133-137 — buildCreativeDocument does raw string replace
• crates/js/lib/src/core/auction.ts lines 141-172 — parseAuctionResponse passes adm straight through

Recommendation

Either (a) remove allow-same-origin if creatives don't need it, (b) serve creatives from a separate origin, or (c) sanitize adm with DOMPurify before injection.

Context

Production readiness audit — see #396