fix: Unify creative URL extraction and update GAM macro mappings#1035
Open
BaiyuScope3 wants to merge 6 commits intomainfrom
Open
fix: Unify creative URL extraction and update GAM macro mappings#1035BaiyuScope3 wants to merge 6 commits intomainfrom
BaiyuScope3 wants to merge 6 commits intomainfrom
Conversation
- Consolidate URL extraction logic into shared helpers in creative_helpers.py
- extract_media_url_and_dimensions: prioritizes format spec, then fallback IDs
- extract_click_url: checks format spec for url_type='clickthrough', then fallback
- extract_impression_tracker_url: checks format spec for url_type='tracker_pixel'
- Remove duplicated extraction logic from creatives.py and media_buy_create.py
- Pass impression tracker URL in delivery_settings format expected by GAM adapter
- Update GAM macro mappings:
- Add ID macros: MEDIA_BUY_ID->%ebuy!, PACKAGE_ID->%eaid!, CREATIVE_ID->%ecid!
- Fix privacy macros: US_PRIVACY->${US_PRIVACY}, add GPP_SID
- Update AXEM->%%PATTERN:axem%%
- Update tests to match new macro mappings
Co-authored-by: Cursor <cursoragent@cursor.com>
Collaborator
Author
|
iskcache 5.6.3 vulnerability (GHSA-w8v5-vhqr-4h9v) has no patch available yet, this lib comes with fastmcp lib we're using , I already filed a issue on their github here 
Not directly used in the repo, ignored GHSA-w8v5-vhqr-4h9v in the scan |
- cryptography 46.0.3 -> 46.0.5 (GHSA-r6ph-v2qm-q3c2) - pillow 12.0.0 -> 12.1.1 (GHSA-cfh3-3jmp-rvhc) Note: diskcache 5.6.3 vulnerability (GHSA-w8v5-vhqr-4h9v) has no fix available yet. Co-authored-by: Cursor <cursoragent@cursor.com>
BaiyuScope3
force-pushed
the
fix/creative-url-extraction-and-macros
branch
from
d56b38f to
f8ce95a
Compare
BaiyuScope3
commented
Feb 12, 2026
| "{CREATIVE_ID}": None, # Creative ID (should already be filled) | ||
| "{MEDIA_BUY_ID}": "%ebuy!", # GAM Order ID | ||
| "{PACKAGE_ID}": "%eaid!", # GAM Line Item ID | ||
| "{CREATIVE_ID}": "%ecid!", # GAM Creative ID |
Collaborator
Author
There was a problem hiding this comment.
Flow of these values between buyer agent and sales agent:
- create_media_buy → returns media_buy_id (= GAM Order ID) to buyer agent → {MEDIA_BUY_ID} → %ebuy!
- create_media_buy → returns package_id per package to buyer agent (= GAM Line Item ID) → {PACKAGE_ID} → %eaid!
- add_creative_assets → returns creative_id (= GAM Creative ID) to buyer agent → {CREATIVE_ID} → %ecid!
BaiyuScope3
commented
Feb 12, 2026
| return MediaBuyStatus.active.value | ||
|
|
||
|
|
||
| def _extract_creative_url_and_dimensions( |
Collaborator
Author
There was a problem hiding this comment.
duplicated logic
BaiyuScope3
commented
Feb 12, 2026
| logger.debug( | ||
| f"[sync_creatives] Extracted URL from assets.{asset_id}.url for data storage (fallback)" | ||
| ) | ||
| break |
Collaborator
Author
There was a problem hiding this comment.
This is where the bug comes from
Previous flow:
- check common asset_ids
- fall back on first available url assets !! (issue here, the first url asset could be anything clickthough, impression tracker etc)
...
Fixed flow:
- dynamically get the asset id from format_spec (from creative agent), find asset type in
image,video,audio. - fallback to common media url id list [main, image, videos, etc]
- fallback to to root-level fields for simple creatives without assets (legacy)
When creative data has no 'assets' dict, fall back to root-level 'url', 'width', 'height' fields. This supports legacy/simple creative formats used in tests and basic creative submissions. Fixes integration test failures in test_creative_lifecycle_mcp.py Co-authored-by: Cursor <cursoragent@cursor.com>
GHSA-w8v5-vhqr-4h9v (CVE-2025-69872): diskcache pickle deserialization - Transitive dependency: fastmcp -> py-key-value-aio[disk] -> diskcache - Not exploitable: salesagent does not use diskcache or pickle serialization - Tracking upstream: jlowin/fastmcp#3166 Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1020 - Creative upload incorrectly uses click URL for image URL
creative_helpers.pyChanges
URL Extraction (creative_helpers.py)
extract_media_url_and_dimensions(): Prioritizes format spec asset types (image/video/audio), then fallback IDsextract_click_url(): Checks format spec forurl_type='clickthrough', then fallback IDsextract_impression_tracker_url(): Checks format spec forurl_type='tracker_pixel', then fallback IDsCode Cleanup
creatives.pyandmedia_buy_create.pydelivery_settings.tracking_urls.impressionformat expected by GAM adapterGAM Macro Mappings (macros.py)
{MEDIA_BUY_ID}→%ebuy!,{PACKAGE_ID}→%eaid!,{CREATIVE_ID}→%ecid!{US_PRIVACY}→${US_PRIVACY}, add{GPP_SID}→${GPP_SID}{AXEM}→%%PATTERN:axem%%Test plan
Made with Cursor