From 7d8fc0946ed26ff4fd806196e047fe247c0a9782 Mon Sep 17 00:00:00 2001
From: francesco <f.orazini@onetag.com>
Date: Tue, 14 Nov 2023 12:08:18 +0100
Subject: [PATCH] Onetag Bid Adapter: address auctionId/transactionId leak

---
 modules/onetagBidAdapter.js                |  5 ++---
 test/spec/modules/onetagBidAdapter_spec.js | 20 +++++++++++++++++---
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/modules/onetagBidAdapter.js b/modules/onetagBidAdapter.js
index 801bb747e34..eb381727a3b 100644
--- a/modules/onetagBidAdapter.js
+++ b/modules/onetagBidAdapter.js
@@ -267,9 +267,8 @@ function setGeneralInfo(bidRequest) {
   this['adUnitCode'] = bidRequest.adUnitCode;
   this['bidId'] = bidRequest.bidId;
   this['bidderRequestId'] = bidRequest.bidderRequestId;
-  // TODO: fix auctionId leak: https://github.com/prebid/Prebid.js/issues/9781
-  this['auctionId'] = bidRequest.auctionId;
-  this['transactionId'] = bidRequest.ortb2Imp?.ext?.tid;
+  this['auctionId'] = deepAccess(bidRequest, 'ortb2.source.tid');
+  this['transactionId'] = deepAccess(bidRequest, 'ortb2Imp.ext.tid');
   this['gpid'] = deepAccess(bidRequest, 'ortb2Imp.ext.gpid') || deepAccess(bidRequest, 'ortb2Imp.ext.data.pbadslot');
   this['pubId'] = params.pubId;
   this['ext'] = params.ext;
diff --git a/test/spec/modules/onetagBidAdapter_spec.js b/test/spec/modules/onetagBidAdapter_spec.js
index df6456db82e..6d43dd2e40e 100644
--- a/test/spec/modules/onetagBidAdapter_spec.js
+++ b/test/spec/modules/onetagBidAdapter_spec.js
@@ -15,9 +15,14 @@ describe('onetag', function () {
       'bidId': '30b31c1838de1e',
       'bidderRequestId': '22edbae2733bf6',
       'auctionId': '1d1a030790a475',
-      ortb2Imp: {
-        ext: {
-          tid: 'qwerty123'
+      'ortb2Imp': {
+        'ext': {
+          'tid': '0000'
+        }
+      },
+      'ortb2': {
+        'source': {
+          'tid': '1111'
         }
       },
       'schain': {
@@ -256,6 +261,15 @@ describe('onetag', function () {
         expect(dataObj.bids).to.be.an('array').that.is.empty;
       } catch (e) { }
     });
+    it('Should pick each bid\'s auctionId and transactionId from ortb2 related fields', function () {
+      const serverRequest = spec.buildRequests([bannerBid]);
+      const payload = JSON.parse(serverRequest.data);
+
+      expect(payload).to.exist;
+      expect(payload.bids).to.exist.and.to.have.length(1);
+      expect(payload.bids[0].auctionId).to.equal(bannerBid.ortb2.source.tid);
+      expect(payload.bids[0].transactionId).to.equal(bannerBid.ortb2Imp.ext.tid);
+    });
     it('should send GDPR consent data', function () {
       let consentString = 'consentString';
       let bidderRequest = {