Allowlist bid-level metadata in ts-debug auction dump #925

Description

redact_bid_for_dump currently serializes the complete Bid and, in the default redacted mode, truncates only creative to MAX_BID_CREATIVE_DUMP_BYTES (512 bytes). Thus Bid.metadata, nurl, and burl can enter the on-page ts-debug HTML comment. Response-level metadata takes a narrower path through the validated allowlist. The current security comment in publisher.rs explicitly tracks the bid-field gap as #925.

Reproducible evidence

In crates/trusted-server-core/src/publisher.rs, redact_bid_for_dump starts with serde_json::to_value(bid) and only rewrites value["creative"]. A test bid with a metadata key and notification URLs will retain those fields in the redacted dump. This is source evidence of exposure in the debug mode, not evidence of a production incident.

Expected behavior

The redacted debug dump includes only deliberately approved bid fields and safe metadata keys. Notification URLs are omitted unless there is a documented debugging need and safe representation. Full/upstream debug modes should follow their separately documented visibility contract.

Actual behavior

All serialized bid fields survive in redacted mode, except that the creative is previewed. The dump is gated behind [debug].auction_html_comment, which is documented for non-production use. At the time of the original review, the only known Bid.metadata writer was APS with opaque targeting keys, and Prebid did not populate it; that limited impact is historical review context, not a guarantee for future providers.

Proposed fix

Construct the redacted bid view from an explicit allowlist, or remove Bid.metadata entirely until approved keys are named. Drop nurl and burl in redacted mode. Keep the existing creative preview and overall dump bound. Review whether the upstream/full modes should preserve these fields, and document the chosen policy rather than silently changing them.

Done when

• Redacted-mode tests show an unapproved metadata key and nurl/burl are absent from the emitted comment.
• Any approved bid metadata keys are named, justified, and covered by tests; absent approval, the metadata map is omitted.
• The 512-byte creative preview and total dump limit remain covered by tests.
• Full/upstream mode behavior and the security comment match the chosen visibility policy.

Context

Follow-up from PR #890 review.