Short description of your issue:

AMP A4A Format needs to include constraints around URL expansion support once anchor href expansion on click is merged PR #4773. In particular, need to ensure that ad creatives do not have access to publisher page information that would not normally be available when wrapped in a cross domain iframe.

How do we reproduce the issue?

PR #4773 adds the ability for the href of an anchor within the creative to expanded on click allowing for capture of click X/Y, in addition to other expansion macros. One concern is that when the creative has been injected within a shadow root, this would allow for leaking page level information to the creative (e.g. DOCUMENT_REFERRER, PAGE_LOAD_TIME, TOTAL_ENGAGED_TIME, etc). There are a couple of ways to handle this:

1. Have the validation service check for the existence of these macros on any anchor href attributes and if present either disallow the document entirely or rewrite the href such that they are removed.
2. Attempt to generate values for some or all of these as if the creative had been wrapped in an iframe (e.g. referrer = ad request, load time = delta from page navigation start to when shadow dom was inflated, etc).

I propose item 1 for now and we can move some macros over as the need arises. Should I include this as part of the PR or wait until it is completed and then add?

What browsers are affected?

All

Which AMP version is affected?

Those after which PR #4773 is merged.