Bug 1931859 - Newtab ensure if Unified ads API is turned on and off, …

…we keep the state and experience consistent. a=dmeehan

Original Revision: https://phabricator.services.mozilla.com/D229341

Differential Revision: https://phabricator.services.mozilla.com/D229351

browser/components/newtab/lib/TelemetryFeed.sys.mjs

@@ -65,6 +65,7 @@ export const TELEMETRY_PREF = "telemetry";
 export const EVENTS_TELEMETRY_PREF = "telemetry.ut.events";
 export const PREF_UNIFIED_ADS_SPOCS_ENABLED = "unifiedAds.spocs.enabled";
 export const PREF_UNIFIED_ADS_TILES_ENABLED = "unifiedAds.tiles.enabled";
+const PREF_ENDPOINTS = "discoverystream.endpoints";
 const PREF_SHOW_SPONSORED_STORIES = "showSponsored";
 const PREF_SHOW_SPONSORED_TOPSITES = "showSponsoredTopSites";
 
@@ -978,6 +979,14 @@ export class TelemetryFeed {
       );
     }
 
+    // Make sure the callback endpoint is allowed
+    const allowed = this._prefs.get(PREF_ENDPOINTS).split(",");
+    if (!allowed.some(prefix => data.url.startsWith(prefix))) {
+      throw new Error(
+        `[Unified ads callback] Not one of allowed prefixes (${allowed})`
+      );
+    }
+
     const url = new URL(data.url);
     url.searchParams.append("position", data.position);
 

browser/components/newtab/lib/TopSitesFeed.sys.mjs

@@ -2051,6 +2051,7 @@ export class TopSitesFeed {
             this.refresh({ broadcast: true });
             break;
           case SHOW_SPONSORED_PREF:
+          case PREF_UNIFIED_ADS_TILES_ENABLED:
             if (
               lazy.NimbusFeatures.newtab.getVariable(
                 NIMBUS_VARIABLE_CONTILE_ENABLED