From f5170d9d173b0c11a431fa172e26e565273a409a Mon Sep 17 00:00:00 2001
From: Rich Snapp <rsnapp@rubiconproject.com>
Date: Mon, 23 Jul 2018 08:38:11 -0600
Subject: [PATCH] don't allow null or undefined bid properties (#2865)

---
 src/adapters/bidderFactory.js             |  2 +-
 test/spec/unit/core/bidderFactory_spec.js | 30 +++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/adapters/bidderFactory.js b/src/adapters/bidderFactory.js
index d8b55f94f9c..8e359d98259 100644
--- a/src/adapters/bidderFactory.js
+++ b/src/adapters/bidderFactory.js
@@ -381,7 +381,7 @@ function validBidSize(adUnitCode, bid, bidRequests) {
 export function isValid(adUnitCode, bid, bidRequests) {
   function hasValidKeys() {
     let bidKeys = Object.keys(bid);
-    return COMMON_BID_RESPONSE_KEYS.every(key => includes(bidKeys, key));
+    return COMMON_BID_RESPONSE_KEYS.every(key => includes(bidKeys, key) && !includes([undefined, null], bid[key]));
   }
 
   function errorMessage(msg) {
diff --git a/test/spec/unit/core/bidderFactory_spec.js b/test/spec/unit/core/bidderFactory_spec.js
index ca2a9afc103..d1422cb1496 100644
--- a/test/spec/unit/core/bidderFactory_spec.js
+++ b/test/spec/unit/core/bidderFactory_spec.js
@@ -427,6 +427,36 @@ describe('bidders created by newBidder', () => {
 
       expect(logErrorSpy.calledOnce).to.equal(true);
     });
+
+    it('should logError when required bid response params are undefined', () => {
+      const bidder = newBidder(spec);
+
+      const bid = {
+        'ad': 'creative',
+        'cpm': '1.99',
+        'width': 300,
+        'height': 250,
+        'requestId': '1',
+        'creativeId': 'some-id',
+        'currency': undefined,
+        'netRevenue': true,
+        'ttl': 360
+      };
+
+      spec.isBidRequestValid.returns(true);
+      spec.buildRequests.returns({
+        method: 'POST',
+        url: 'test.url.com',
+        data: {}
+      });
+      spec.getUserSyncs.returns([]);
+
+      spec.interpretResponse.returns(bid);
+
+      bidder.callBids(MOCK_BIDS_REQUEST, addBidResponseStub, doneStub, ajaxStub);
+
+      expect(logErrorSpy.calledOnce).to.equal(true);
+    });
   });
 
   describe('when the ajax call fails', () => {