CVE-2025-59038

@@ -114,19 +114,21 @@ export const spec = {
     return [];
   },
   onTimeout: function(timeoutData) {
-    if (timeoutData === null || typeof timeoutData === 'undefined' || Object.keys(timeoutData).length === 0) {
+    if (!Array.isArray(timeoutData) || timeoutData.length === 0) {
       return;
     }
 
-    const trackingParams = buildTrackingParams(timeoutData, 'timeout', timeoutData.timeout);
+    timeoutData.forEach((timeout) => {
+      const trackingParams = buildTrackingParams(timeout, 'timeout', timeout.timeout);
 
-    logWarn(BIDDER_CODE + ': timed out request');
-    triggerPixel(buildUrl({
-      protocol: 'https',
-      hostname: 't.collectiveaudience.co',
-      pathname: '/bid',
-      search: trackingParams
-    }));
+      logWarn(BIDDER_CODE + ': timed out request for adUnitCode ' + timeout.adUnitCode);
+      triggerPixel(buildUrl({
+        protocol: 'https',
+        hostname: 't.collectiveaudience.co',
+        pathname: '/bid',
+        search: trackingParams
+      }));
+    });
   },
   onBidWon: function(bid) {
     if (bid === null || typeof bid === 'undefined' || Object.keys(bid).length === 0) {
@@ -174,7 +176,7 @@ export const spec = {
 }
 
 function buildTrackingParams(data, info, value) {
-  const params = Array.isArray(data.params) ? data.params[0] : data.params;
+  const params = Array.isArray(data.params) ? data.params[0] : data.params || {};
   const pageUrl = getPageUrl(null, window);
   return {
     pid: params.accountId ?? (data.ad?.match(/account: “([a-f\d]{24})“/)?.[1] ?? ''),

@@ -236,15 +236,54 @@ describe('BeOp Bid Adapter tests', () => {
     it('should call triggerPixel utils function when timed out is filled', function () {
       spec.onTimeout({});
       spec.onTimeout();
+      spec.onTimeout(null);
+      spec.onTimeout([]);
       expect(triggerPixelStub.getCall(0)).to.be.null;
-      spec.onTimeout({params: {accountId: '5a8af500c9e77c00017e4cad'}, timeout: 2000});
+      spec.onTimeout([{
+        bidder: 'beop',
+        bidId: 'abc123',
+        params: { accountId: '5a8af500c9e77c00017e4cad' },
+        adUnitCode: 'div-1',
+        timeout: 2000,
+        auctionId: 'some-auction-id'
+      }]);
       expect(triggerPixelStub.getCall(0)).to.not.be.null;
       expect(triggerPixelStub.getCall(0).args[0]).to.exist.and.to.include('https://t.collectiveaudience.co');
       expect(triggerPixelStub.getCall(0).args[0]).to.include('se_ca=bid');
       expect(triggerPixelStub.getCall(0).args[0]).to.include('se_ac=timeout');
       expect(triggerPixelStub.getCall(0).args[0]).to.include('pid=5a8af500c9e77c00017e4cad');
     });
 
+    it('should call triggerPixel for each entry in the timeout array', function () {
+      const timeoutData = [
+        {
+          bidder: 'beop',
+          bidId: 'abc123',
+          params: { accountId: '5a8af500c9e77c00017e4cad' },
+          adUnitCode: 'div-1',
+          timeout: 3000,
+          auctionId: 'auction-1'
+        },
+        {
+          bidder: 'beop',
+          bidId: 'def456',
+          params: { accountId: '5a8af500c9e77c00017e4cad' },
+          adUnitCode: 'div-2',
+          timeout: 3000,
+          auctionId: 'auction-2'
+        }
+      ];
+
+      spec.onTimeout(timeoutData);
+
+      expect(triggerPixelStub.callCount).to.equal(2);
+      const firstCall = triggerPixelStub.getCall(0).args[0];
+      const secondCall = triggerPixelStub.getCall(1).args[0];
+
+      expect(firstCall).to.include('se_ac=timeout');
+      expect(firstCall).to.include('bid=abc123');
+      expect(secondCall).to.include('bid=def456');
+    });
     it('should call triggerPixel utils function on bid won', function () {
       spec.onBidWon({});
       spec.onBidWon();