From 4899582e445ff55816d17fa4cbbcb8257bf8f84b Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Mon, 10 Aug 2026 18:29:47 +0000
Subject: [PATCH] fix: the constructmarkup function directly interpola... in
 mobileAndA...

The constructMarkup function directly interpolates the 'ad' parameter (creative HTML/JavaScript from bid response) into a template string without sanitization, allowing arbitrary script injection
---
 src/mobileAndAmpRender.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/mobileAndAmpRender.js b/src/mobileAndAmpRender.js
index 7e71140..cd0515a 100644
--- a/src/mobileAndAmpRender.js
+++ b/src/mobileAndAmpRender.js
@@ -185,8 +185,10 @@ function parseResponse(response) {
  */
 function constructMarkup(ad, width, height) {
   let id = getUUID();
+  const safeWidth = parseInt(width, 10) || 0;
+  const safeHeight = parseInt(height, 10) || 0;
   return `<div id="${id}" style="border-style: none; position: absolute; width:100%; height:100%;">
-      <div id="${id}_inner" style="margin: 0 auto; width:${width}px; height:${height}px; position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%);">${ad}</div>
+      <div id="${id}_inner" style="margin: 0 auto; width:${safeWidth}px; height:${safeHeight}px; position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%);">${ad}</div>
       </div>`;
 }