Findings
Appendix B of the paper as one table: 86 findings, 78 in the open-source clients and 8 in Google IMA. Row anchors are the finding IDs (for example findings.html#F01).
One row per finding: one cause, located in source for the open-source clients. Requirements are catalog IDs with their graded strength. Locations are in the tested release, relative to the package root: vast-client-js 6.5.0 src/, video-ad-sdk 4.0.1 dist/ (the code that ran), iab-vast-loader 2.5.1 and its parser iab-vast-parser 1.2.1 lib/, vastlint-client 0.15.0 dist/, Shaka Player 5.2.12 lib/ads/, rmp-vast 17.2.0 src/js/ at commit 5975ead. "absent:" means the feature is not implemented and says what was searched. IMA is closed source: its rows give, in place of a location, the requests the server logged and the events of its public API (Online Resource 4). rmp-vast cells that come from its bundled vast-client are attributed to vast-client-js (F01, F02, F03, F05). "Releases" is the span of swept releases (Node.js sweep) in which the finding appears; Shaka, rmp-vast and IMA were not swept. "Platform scope" lists the layers and engines in which the finding's cells deviate (Node.js, and Chromium, Firefox and WebKit on Linux; Chrome, WebKit and Safari on macOS).
Table B. Findings in all seven clients (paper Tables B1 to B7).
showing 86 of 86CSV
| F01 | vast-client-js 6.5.0 | B1 | M12 (must) | Requests a Wrapper's VASTAdTagURI with [CACHEBUSTING] and [TIMESTAMP] still in brackets. | src/parser/vast_parser.js:391; src/parser/vast_parser.js:403-405 | all 9 (3.3.0 to 6.5.0) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
|---|---|---|---|---|---|---|---|
| F02 | vast-client-js 6.5.0 | B1 | P07 (must) | A pod in a Wrapper's target is returned in document order (3, 1, 2). | src/parser/vast_parser.js:258-315 (parse()) | not in the swept catalog | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F03 | vast-client-js 6.5.0 | B1 | R01 (obs.) | A Wrapper request timeout throws outside any promise: uncaught exception, Node.js process exits with code 1. | src/fetcher/url_handler.js:57-64 | 6.0.2 to 6.5.0 (of 3.3.0 to 6.5.0) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F04 | vast-client-js 6.5.0 | B1 | none: robustness (fuzz C4, D4) | A target that sends headers and stalls its body is waited on with no timeout at every hop. | src/fetcher/url_handler.js:66-72 | tested release only | - |
| F05 | vast-client-js 6.5.0 | B1 | W11 (must) | Non-well-formed Wrapper target reported as 301 (Node.js, Firefox) or 303 (Chromium, Chrome, WebKit, Safari), never 100. | src/parser/vast_parser.js:442, 170-187, 467-477 | all 9 (3.3.0 to 6.5.0) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F06 | vast-client-js 6.5.0 | B1 | none: robustness (fuzz C2) | An <Ad> with neither InLine nor Wrapper makes get() throw a TypeError; no Error URI; sibling ads lost. | src/parser/ad_parser.js:20-59; src/parser/vast_parser.js:226 | tested release only | - |
| F07 | vast-client-js 6.5.0 | B1 | none: macro grid (4.x macros) | Five pixel macros marked 4.x ([STOREID], [STOREURL], [PLAYBACKMETHODS], [GPPSTRING], [GPPSECTIONID]) sent literally. | src/util/macros.js:1-49; src/util/util.js:72-74; absent: STOREID, STOREURL, PLAYBACKMETHODS, GPPSTRING, GPPSECTIONID anywhere under src/ | tested release only | - |
| F08 | vast-client-js 6.5.0 | B1 | M10 (should) | [ASSETURI] carries the first MediaFile, overwriting the value the integrator passes; not the one played. | src/vast_tracker.js:899-906 | all 9 (3.3.0 to 6.5.0) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F09 | vast-client-js 6.5.0 | B1 | M09 (should) | [UNIVERSALADID] percent-encodes the separating comma (%2C). | src/vast_tracker.js:913-917; src/util/util.js:42 | 4.0.1 to 6.5.0 (of 3.3.0 to 6.5.0) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F10 | vast-client-js 6.5.0 | B1 | none: outside catalog | wrapperLimit accepts one Wrapper fewer than its value (decides rmp-vast's W03). | src/parser/vast_parser.js:369, :382, :74 | tested release only | - |
| F11 | vast-client-js 6.5.0 | B1 | none: outside catalog (fuzz D2) | An InLine with no usable MediaFile is reported with 303. | src/parser/vast_parser.js:467-477 | tested release only | - |
| F12 | rmp-vast 17.2.0 | B2 | W03 (must) | Stops a five-Wrapper chain after four documents with 302 (API reports 303). | src/js/helpers/utils.js:223; src/js/index.js:591; bundled vast-client 6.4.2 src/parser/vast_parser.js:362, 375 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F13 | rmp-vast 17.2.0 | B2 | W20 (should), W21 (should) | Passes allowMultipleAds: true, overriding the Wrapper attribute. | src/js/index.js:593; bundled vast-client 6.4.2 src/parser/vast_parser.js:389-392 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F14 | rmp-vast 17.2.0 | B2 | W23 (should), P05 (should) | Never falls back to the stand-alone ad (fallbackOnNoAd, failed pod ad). | absent: fallbackOnNoAd, remainingAds, getNextAds not used in rmp-vast's own modules (bundle search); src/js/index.js:364-367; bundled vast-client 6.4.2 src/parser/ad_parser.js:223-234, src/parser/vast_parser.js:304-315 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F15 | rmp-vast 17.2.0 | B2 | M01 (must) | [CACHEBUSTING] is eight alphanumeric characters. | src/js/framework/fw.js:194-201 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F16 | rmp-vast 17.2.0 | B2 | M03 (must), M06 (must) | [LIMITADTRACKING] only if the integrator passes it; [PODSEQUENCE], [IFA], [CLIENTUA] get no -1. | src/js/index.js:652-655; src/js/helpers/tracking.js:359-362, 438-442; absent: no rmp-vast code names [IFA] or [CLIENTUA] (only params.macros, tracking.js:214-222) | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F17 | rmp-vast 17.2.0 | B2 | M11 (must) | Error URIs skip macro replacement except [ERRORCODE]. | src/js/helpers/tracking.js:462-482 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F18 | rmp-vast 17.2.0 | B2 | M09 (should) | [UNIVERSALADID] starts with a comma and encodes the separators. | src/js/helpers/tracking.js:338-351 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F19 | rmp-vast 17.2.0 | B2 | E06 (must) | Undecodable media reported as 401, not 405. | src/js/creatives/linear.js:147-176 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F20 | rmp-vast 17.2.0 | B2 | T13 (must) | Resume tracker fires on every play event, including ad start. | src/js/helpers/tracking.js:176-180 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F21 | rmp-vast 17.2.0 | B2 | T23 (should) | Any volume change while unmuted fires unmute. | src/js/helpers/tracking.js:112-123 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F22 | rmp-vast 17.2.0 | B2 | T02 (should) | An about:blank Impression is requested. | src/js/index.js:460-466; src/js/helpers/tracking.js:82-110 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F23 | rmp-vast 17.2.0 | B2 | T05 (must), T06 (must), T07 (must) | macOS WebKit only: no progress tracker fires (quartiles do); T19 then n/a. | src/js/creatives/linear.js:67-108, :74-76 and :292; src/js/framework/fw.js:84-88; src/js/players/ad-player.js:53-58 | not swept | WebKit macOS only |
| F24 | rmp-vast 17.2.0 | B2 | T21 (must) | No rewind tracker when the element is seeked back (borderline: no seek control by default). | absent: no rewind tracker or handler in rmp-vast's own modules (bundle search for rewind, seeked, seeking); showControlsForAdPlayer is false by default (src/js/helpers/utils.js:230, used at src/js/players/ad-player.js:139) | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F25 | rmp-vast 17.2.0 | B2 | I03 (should) | Icon drawn on first playing event; offset and duration never read. | src/js/creatives/icons.js:186-190 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F26 | rmp-vast 17.2.0 | B2 | A01 (must), A03 (should) | With defaults, no AdVerifications handling: no verificationNotExecuted. | src/js/index.js:527-530 (verification handled only if omidSupport is set); src/js/verification/omsdk.js:41-54; src/js/helpers/utils.js:245 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F27 | video-ad-sdk 4.0.1 | B3 | P01 (must), P07 (must) | Pods play in document order: compareBySequence returns 0 for every pair. | dist/vastSelectors/index.js:13-18; :103; dist/vastRequest/helpers/getNextAd.js:3-5 | P01: 3.0.0 to 4.0.1 (of 2.1.0 to 4.0.1); P07: not in the swept catalog | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F28 | video-ad-sdk 4.0.1 | B3 | P06 (should) | Only the first ad of a pod plays; no error. | dist/runner/runWaterfall.js:90 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F29 | video-ad-sdk 4.0.1 | B3 | E05 (must), E06 (must) | Error URI requested with code=undefined for media 404 or decode failure, then 402. | dist/adUnit/VastAdUnit.js:34 | browser-only, not swept | all browsers (browser-only requirement) |
| F30 | video-ad-sdk 4.0.1 | B3 | E03 (must), E09 (must) | No playable MediaFile (or NonLinear-only ad) reported as 401 to InLine and every Wrapper. | dist/runner/helpers/startVideoAd.js:39 | all 9 (2.1.0 to 4.0.1); 2.1.0 to 2.5.1 request no Error URI, 401 from 2.6.3 | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F31 | video-ad-sdk 4.0.1 | B3 | I03 (should) | Icon with an offset is never drawn; no view tracker. | dist/adUnit/helpers/icons/addIcons.js:15 | browser-only, not swept | all browsers (browser-only requirement) |
| F32 | video-ad-sdk 4.0.1 | B3 | A01 (must), A03 (should) | AdVerifications never read; no verificationNotExecuted. | absent: no occurrence of "verification" (any case) in video-ad-sdk 4.0.1 dist/ or src/ | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F33 | video-ad-sdk 4.0.1 | B3 | X11 (must) | A URI split across CDATA sections is truncated to the first part. | dist/xml/helpers/xmlSelectors.js:36-38 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F34 | video-ad-sdk 4.0.1 | B3 | T07 (must) | Percentage progress offsets computed from the media element's duration before it is set become NaN; never fire in the tested setup. | dist/adUnit/helpers/metrics/handlers/onProgress.js:22-23, :19 and :29 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F35 | video-ad-sdk 4.0.1 | B3 | W07 (must) | Failed Wrapper fetch (404, 500, refused) reported as 502. | dist/vastRequest/requestAd.js:14-26 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F36 | video-ad-sdk 4.0.1 | B3 | W17 (must) | Wrapper ClickThrough not used when the InLine has none. | dist/adUnit/helpers/metrics/setupMetricHandlers.js:8; dist/vastSelectors/index.js:327 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F37 | video-ad-sdk 4.0.1 | B3 | M01 (must) | [CACHEBUSTING] has 1 to 10 digits. | dist/tracker/helpers/parseMacro.js:9 and :22-24 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F38 | video-ad-sdk 4.0.1 | B3 | M03 (must), M06 (must), M07 (should) | parseMacro fills only CACHEBUSTING and TIMESTAMP; other listed macros literal. | dist/tracker/helpers/parseMacro.js:19-35 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F39 | video-ad-sdk 4.0.1 | B3 | M12 (must) | Requests a Wrapper's VASTAdTagURI as written. | dist/vastRequest/requestAd.js:118 (the Wrapper's getVASTAdTagURI is requested unchanged) | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F40 | video-ad-sdk 4.0.1 | B3 | T18 (should) | Percentage skipoffset ignored. | dist/adUnit/helpers/metrics/handlers/onSkip.js:22; dist/vastSelectors/helpers/parseOffset.js:2-9; dist/vastSelectors/index.js:368-372 | 2.2.1 to 4.0.1 (of 2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F41 | video-ad-sdk 4.0.1 | B3 | T20 (should) | No loaded event. | dist/tracker/linearEvents.js:12-176; absent: no loaded event or handler in dist/tracker/ or dist/adUnit/helpers/metrics/ | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F42 | video-ad-sdk 4.0.1 | B3 | W20 (should), W21 (should) | allowMultipleAds defaults to true; false rejects the response with 203. | dist/vastRequest/requestAd.js:51 and :57-61 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F43 | video-ad-sdk 4.0.1 | B3 | T02 (should) | An about:blank Impression is passed to the pixel tracker. | dist/tracker/helpers/createVastEventTracker.js:13 | all 9 (2.1.0 to 4.0.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F44 | video-ad-sdk 4.0.1 | B3 | W11 (must) | Browser DOMParser partial tree (parsererror) accepted as VAST; ad accepted, then 401. | dist/xml/helpers/xml2js.js:5; sane-domparser-error 0.2.0 index.js:18-23 | none in sweep | Chromium, Chrome, WebKit Linux, WebKit macOS, Safari only |
| F45 | video-ad-sdk 4.0.1 | B3 | none: robustness (fuzz C3) | VPAID-marked MP4: unhandled rejection; 901 to Error URI, then impression and playback. | dist/runner/helpers/startVideoAd.js:33 (adUnit.start promise not handled; src startVideoAd.ts:74); dist/adUnit/helpers/vpaid/loadCreative.js:7 | tested release only | - |
| F46 | iab-vast-loader 2.5.1 | B4 | W02 (must), P07 (must) | The loader checks only vast.ads after a Wrapper: a lone <Ad sequence="1"> Wrapper, filed as a pod, is never followed (defaults only; no ad, no error), and a pod behind a Wrapper is reported as 303. | lib/loader.js:58-65; iab-vast-parser lib/factory/vast.js:53-55 | W02: all 6 (2.0.0 to 2.5.1); P07: not in the swept catalog | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F47 | iab-vast-loader 2.5.1 | B4 | X05 (must), X06 (must) | Valid 4.2 documents with repeated UniversalAdId or ClosedCaptionFile rejected with 101 (and four more elements, fuzz D3). | iab-vast-parser lib/vast/schema.js:13-33; lib/xml/unmarshaler.js:113-118 | all 6 (2.0.0 to 2.5.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F48 | iab-vast-loader 2.5.1 | B4 | W19 (should) | followAdditionalWrappers never consulted. | absent: followAdditionalWrappers is not read in iab-vast-loader lib/ (5 files); lib/loader.js:58-62 | all 6 (2.0.0 to 2.5.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F49 | iab-vast-loader 2.5.1 | B4 | W11 (must) | Node.js: xmldom recovers an ad from non-well-formed XML; Firefox: 101. | iab-vast-parser lib/index.js:7, 18-20; lib/parse.js:34-45; xmldom 0.1.31 dom-parser.js:30, 175-183 | all 6 (2.0.0 to 2.5.1) | Node.js, Firefox only |
| F50 | iab-vast-loader 2.5.1 | B4 | M12 (must) | Requests a Wrapper's VASTAdTagURI as written. | lib/loader.js:61, :81, :14 and :88 | all 6 (2.0.0 to 2.5.1) | all tested (Node.js, Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F51 | iab-vast-loader 2.5.1 | B4 | none: robustness (fuzz C5) | Empty response (HTTP 204 or empty 200): an internal TypeError with no VAST code. | iab-vast-parser lib/parse.js:39 | tested release only | - |
| F52 | iab-vast-loader 2.5.1 | B4 | none: robustness (fuzz C6) | A response that is not XML: rejected with 101 and an internal TypeError, where 100 applies. | iab-vast-parser lib/xml/unmarshaler.js:75 | tested release only | - |
| F53 | iab-vast-loader 2.5.1 | B4 | none: robustness (fuzz C7) | A root element other than VAST: rejected with 101 and an internal TypeError. | iab-vast-parser lib/factory/vast.js:38 | tested release only | - |
| F54 | iab-vast-loader 2.5.1 | B4 | none: robustness (fuzz C8) | A lower-case element name such as <creatives> rejects the whole response with an internal TypeError. | iab-vast-parser lib/inherit/ad.js:57, 85, 88; lib/xml/unmarshaler.js:19-25, 85 | tested release only | - |
| F55 | vastlint-client 0.15.0 | B5 | W03 (must) | maxWrapperDepth 5 counts documents: stops before the InLine of a five-Wrapper chain, no code. | dist/session.js:8 | all 12 (0.4.24 to 0.15.0) | all tested (Node.js) |
| F56 | vastlint-client 0.15.0 | B5 | W11 (must), X09 (should), X02 (must), X17 (must) | XML read with regular expressions: ads from malformed XML; commented-out URIs requested. | dist/resolved.js:106-148; dist/tracking.js:72-141 | W11, X09, X02: all 12 (0.4.24 to 0.15.0); X17: not in the swept catalog | all tested (Node.js) |
| F57 | vastlint-client 0.15.0 | B5 | X18 (should), X19 (should) | Entity-escaped VASTAdTagURI truncated at the first & (or &). | vastlint 0.15.0 upstream crates/vastlint-core/src/inspect.rs:110-117, 126, 156-158 (compiled into vastlint_wasm_bg.wasm); caller dist/session.js:461, 477 | not in the swept catalog | all tested (Node.js) |
| F58 | vastlint-client 0.15.0 | B5 | W19 (should), W20 (should), W21 (should) | followAdditionalWrappers and allowMultipleAds never read. | dist/resolved.js:457-459 | all 12 (0.4.24 to 0.15.0) | all tested (Node.js) |
| F59 | vastlint-client 0.15.0 | B5 | W23 (should) | A response that holds a Wrapper ad and a stand-alone InLine ad is classified as an InLine document; the Wrapper is never followed, and its target (noad.xml) is never requested. | dist/session.js:461 (buildHop takes the document type from inspectDocument) and :649-651 (a hop that is not a Wrapper ends resolution as resolved) | all 12 (0.4.24 to 0.15.0) | all tested (Node.js) |
| F60 | vastlint-client 0.15.0 | B5 | T05 (must), T06 (must), T07 (must), T21 (must), T20 (should) | Documented controller fires quartiles only: no progress, loaded or rewind. | dist/playback-queue.js:381-389 | all 12 (0.4.24 to 0.15.0) | all tested (Node.js) |
| F61 | vastlint-client 0.15.0 | B5 | M03 (must), M06 (must), M07 (should) | Only CACHEBUSTING and TIMESTAMP expanded; controller takes no macros. | dist/tracking.js:169-181 | all 12 (0.4.24 to 0.15.0) | all tested (Node.js) |
| F62 | vastlint-client 0.15.0 | B5 | M12 (must) | Requests a Wrapper's VASTAdTagURI as written. | dist/session.js:659 and :674 (fetchXmlFromUrl requests the URL as found) | all 12 (0.4.24 to 0.15.0) | all tested (Node.js) |
| F63 | vastlint-client 0.15.0 | B5 | none: delegated limit | After a mid-chain fetch failure the snapshot keeps only the root hop; intermediate Wrapper Error URIs unreachable. | dist/session.js:512-514, 629, 674, 682-689, 700-702 | tested release only | - |
| F64 | Shaka Player 5.2.12 | B6 | W01 (must), W02 (must) | Every <Ad> without an InLine is skipped: no Wrapper request, no ad, no error. | lib/ads/vast_interstitial_parser.js:29-33 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F65 | Shaka Player 5.2.12 | B6 | M01 (must), M02 (must), M03 (must), M06 (must), M07 (should), M11 (must) | No macro replaced in tracking or Error URLs. | absent: no CACHEBUSTING, TIMESTAMP, ERRORCODE, ASSETURI, ADSERVINGID or UNIVERSALADID in lib/ads/ (22 files); lib/ads/ad_utils.js:173-176 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F66 | Shaka Player 5.2.12 | B6 | E01 (must), E02 (must) | A no-ad response's document-level Error URIs are never requested. | lib/ads/ad_utils.js:49; lib/ads/vast_interstitial_parser.js:29-33; absent: no read of the <Error> children of <VAST> in lib/ads/ | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F67 | Shaka Player 5.2.12 | B6 | E03 (must), E05 (must), E06 (must) | The error code is never determined: Error URIs are requested with a literal [ERRORCODE]. | lib/ads/ad_utils.js:149-151, 173-176; lib/ads/interstitial_ad_manager.js:1226-1236; absent: no ERRORCODE in lib/ads/ | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F68 | Shaka Player 5.2.12 | B6 | E07 (must) | A media file that does not answer is never reported (no media timeout). | absent: no media-load timeout in lib/ads/interstitial_ad_manager.js | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F69 | Shaka Player 5.2.12 | B6 | T10 (should) | Impression and start fire when the ad is set up, before its media loads. | lib/ads/interstitial_ad_manager.js:1262-1263 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F70 | Shaka Player 5.2.12 | B6 | T05 (must), T06 (must), T07 (must), T20 (should), T21 (must) | No progress, loaded or rewind events: the tracking table has no such keys. | lib/ads/ad_utils.js:22-38, 95-109 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F71 | Shaka Player 5.2.12 | B6 | T18 (should) | A percentage skipoffset is not parsed; the ad is not skippable. | lib/ads/vast_interstitial_parser.js:81-87 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F72 | Shaka Player 5.2.12 | B6 | T23 (should) | A volume change fires unmute. | lib/ads/ad_utils.js:161 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F73 | Shaka Player 5.2.12 | B6 | S01 (should) | MediaFiles sorted by height; first used without checking type (FLV fails). | lib/ads/vast_interstitial_parser.js:117-138 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F74 | Shaka Player 5.2.12 | B6 | P03 (must) | Each pod ad's complete pixel is sent to the next ad. | lib/ads/interstitial_ad_manager.js:1237-1244, :892 and :2561-2567 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F75 | Shaka Player 5.2.12 | B6 | P01 (must) | Pods play in document order: the sequence attribute is never read. | lib/ads/vast_interstitial_parser.js:29-62 | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F76 | Shaka Player 5.2.12 | B6 | P05 (should) | A failed pod ad is not replaced by the stand-alone ad; that ad plays after the pod. | lib/ads/interstitial_ad_manager.js:1133-1140, 1207-1211; absent: no code in lib/ads/ handles stand-alone ads | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F77 | Shaka Player 5.2.12 | B6 | I01 (must), I03 (should) | Icons not drawn; trackers never fire. | absent: no "icon" (any case) in shaka-player 5.2.12 lib/ads/; lib/ads/vast_interstitial_parser.js:39-61 reads Linear and NonLinearAds only | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F78 | Shaka Player 5.2.12 | B6 | A01 (must) | AdVerifications never parsed: no verificationNotExecuted request. | lib/ads/vast_interstitial_parser.js:29-45 (an InLine yields Creatives only); lib/ads/ad_utils.js:44-69 (createTrackingFromInline reads Error and Impression only); absent: no "verification" in lib/ads/ | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS, Safari) |
| F79 | Google IMA HTML5 SDK 3.794.0 | B7 | W03 (must) | Rejects a chain of five Wrappers. | five Wrapper documents fetched, no InLine; Error URIs of all five requested with code 302; AdError 302 "The maximum number of VAST wrappers (4) has been reached." | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS) |
| F80 | Google IMA HTML5 SDK 3.794.0 | B7 | W17 (must) | Wrapper ClickThrough not used. | after a click on the ad, no click-tracking request and no landing page; probe PRB3 (InLine without ClickThrough): the click pauses the ad and sends no click-tracking request | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS) |
| F81 | Google IMA HTML5 SDK 3.794.0 | B7 | W20 (should), W21 (should) | A Wrapper target with a pod and a stand-alone ad is rejected with IMA code 2. | start.xml and pod.xml fetched, no Error URI requested, AdError 2 "Ad source cannot contain playlist response." | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS) |
| F82 | Google IMA HTML5 SDK 3.794.0 | B7 | W23 (should) | After a Wrapper that leads to no ad (303), no other ad is tried. | Error URIs requested with 303, AdError 900, the stand-alone ad of the same response never requested | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS) |
| F83 | Google IMA HTML5 SDK 3.794.0 | B7 | A03 (should) | The Wrapper's verification vendor is not reported; at most one verificationNotExecuted per ad in these probes. | InLine verificationNotExecuted requested with reason 2, Wrapper's never; probe PRB1: a Wrapper-only vendor is reported; probe PRB2: of two InLine vendors only the first is reported | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS) |
| F84 | Google IMA HTML5 SDK 3.794.0 | B7 | A05 (must) | A verification resource that answers 404 is not reported. | resource fetched with status 404, no verificationNotExecuted request | not swept | all tested (Chromium, Chrome, Firefox, WebKit Linux, WebKit macOS) |
| F85 | Google IMA HTML5 SDK 3.794.0 | B7 | I01 (must) | Icon view requested over 50 ms before the ad's start request: Linux Firefox and WebKit, macOS WebKit, some Linux Chromium runs. | icon view requested before the start request in every run; 20 repeats per Linux engine: 36 to 68 ms in Chromium (6 of 20 beyond the 50 ms tolerance; reference runs 122 and 90 ms), 54 to 111 ms in Firefox and 165 to 237 ms in WebKit (all beyond); macOS, 10 repeats per browser: 11 to 12 ms in Chromium, 10 to 13 ms in Chrome and 13 to 50 ms in Firefox (none beyond), 51 to 58 ms in WebKit (all beyond) | not swept | Chromium, Firefox, WebKit Linux only |
| F86 | Google IMA HTML5 SDK 3.794.0 | B7 | W11 (must) | Firefox: 303 for a malformed Wrapper target. | Firefox: Error URI requested with code 303; Chromium, Chrome and WebKit: 100 | not swept | Firefox only |