From 4d2a8acc388116c3ebe51cbd9f18d88959458fe8 Mon Sep 17 00:00:00 2001 From: Brian Sardo <1168933+bsardo@users.noreply.github.com> Date: Tue, 12 Jan 2021 10:19:17 -0500 Subject: [PATCH] Enforce GDPR privacy if there's an error parsing consent (#1593) * Enforce GDPR privacy if there's an error parsing consent * Update test with consent string variables to improve readability * Fix test typo * Update test variable names to follow go conventions --- exchange/utils.go | 12 +++++++----- exchange/utils_test.go | 41 +++++++++++++++++++++++++++++------------ 2 files changed, 36 insertions(+), 17 deletions(-) diff --git a/exchange/utils.go b/exchange/utils.go index 21c31a290b4..d574c2a6452 100644 --- a/exchange/utils.go +++ b/exchange/utils.go @@ -118,11 +118,13 @@ func cleanOpenRTBRequests(ctx context.Context, if gdprEnforced { var publisherID = req.LegacyLabels.PubID _, geo, id, err := gDPR.PersonalInfoAllowed(ctx, bidderRequest.BidderCoreName, publisherID, gdprSignal, consent) - privacyEnforcement.GDPRGeo = !geo && err == nil - privacyEnforcement.GDPRID = !id && err == nil - } else { - privacyEnforcement.GDPRGeo = false - privacyEnforcement.GDPRID = false + if err == nil { + privacyEnforcement.GDPRGeo = !geo + privacyEnforcement.GDPRID = !id + } else { + privacyEnforcement.GDPRGeo = true + privacyEnforcement.GDPRID = true + } } privacyEnforcement.Apply(bidderRequest.BidRequest) diff --git a/exchange/utils_test.go b/exchange/utils_test.go index f9a04f25e40..e13f956b46d 100644 --- a/exchange/utils_test.go +++ b/exchange/utils_test.go @@ -20,7 +20,8 @@ import ( // // It only allows appnexus for GDPR consent type permissionsMock struct { - personalInfoAllowed bool + personalInfoAllowed bool + personalInfoAllowedError error } func (p *permissionsMock) HostCookiesAllowed(ctx context.Context, consent string) (bool, error) { @@ -32,7 +33,7 @@ func (p *permissionsMock) BidderSyncAllowed(ctx context.Context, bidder openrtb_ } func (p *permissionsMock) PersonalInfoAllowed(ctx context.Context, bidder openrtb_ext.BidderName, PublisherID string, gdpr gdpr.Signal, consent string) (bool, bool, bool, error) { - return p.personalInfoAllowed, p.personalInfoAllowed, p.personalInfoAllowed, nil + return p.personalInfoAllowed, p.personalInfoAllowed, p.personalInfoAllowed, p.personalInfoAllowedError } func assertReq(t *testing.T, bidderRequests []BidderRequest, @@ -1045,6 +1046,8 @@ func TestCleanOpenRTBRequestsLMT(t *testing.T) { } func TestCleanOpenRTBRequestsGDPR(t *testing.T) { + tcf1Consent := "BONV8oqONXwgmADACHENAO7pqzAAppY" + tcf2Consent := "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA" trueValue, falseValue := true, false testCases := []struct { @@ -1054,6 +1057,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdpr string gdprConsent string gdprScrub bool + permissionsError error userSyncIfAmbiguous bool expectPrivacyLabels metrics.PrivacyLabels }{ @@ -1074,7 +1078,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: &trueValue, gdprHostEnabled: true, gdpr: "1", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: true, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: true, @@ -1086,7 +1090,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: &trueValue, gdprHostEnabled: true, gdpr: "1", - gdprConsent: "COzTVhaOzTVhaGvAAAENAiCIAP_AAH_AAAAAAEEUACCKAAA", + gdprConsent: tcf2Consent, gdprScrub: true, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: true, @@ -1098,7 +1102,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: &trueValue, gdprHostEnabled: true, gdpr: "0", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: false, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: false, @@ -1110,7 +1114,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: &trueValue, gdprHostEnabled: false, gdpr: "1", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: true, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: true, @@ -1122,7 +1126,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: &falseValue, gdprHostEnabled: true, gdpr: "1", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: false, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: false, @@ -1134,7 +1138,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: nil, gdprHostEnabled: true, gdpr: "1", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: true, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: true, @@ -1146,7 +1150,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: nil, gdprHostEnabled: false, gdpr: "1", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: false, expectPrivacyLabels: metrics.PrivacyLabels{ GDPREnforced: false, @@ -1158,7 +1162,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: nil, gdprHostEnabled: true, gdpr: "null", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: true, userSyncIfAmbiguous: false, expectPrivacyLabels: metrics.PrivacyLabels{ @@ -1171,7 +1175,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { gdprAccountEnabled: nil, gdprHostEnabled: true, gdpr: "null", - gdprConsent: "BONV8oqONXwgmADACHENAO7pqzAAppY", + gdprConsent: tcf1Consent, gdprScrub: false, userSyncIfAmbiguous: true, expectPrivacyLabels: metrics.PrivacyLabels{ @@ -1179,6 +1183,19 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { GDPRTCFVersion: "", }, }, + { + description: "Enforce - error while checking if personal info is allowed", + gdprAccountEnabled: nil, + gdprHostEnabled: true, + gdpr: "1", + gdprConsent: tcf1Consent, + gdprScrub: true, + permissionsError: errors.New("Some error"), + expectPrivacyLabels: metrics.PrivacyLabels{ + GDPREnforced: true, + GDPRTCFVersion: metrics.TCFVersionV1, + }, + }, } for _, test := range testCases { @@ -1214,7 +1231,7 @@ func TestCleanOpenRTBRequestsGDPR(t *testing.T) { context.Background(), auctionReq, nil, - &permissionsMock{personalInfoAllowed: !test.gdprScrub}, + &permissionsMock{personalInfoAllowed: !test.gdprScrub, personalInfoAllowedError: test.permissionsError}, test.userSyncIfAmbiguous, privacyConfig) result := results[0]