[mrdevel2002-ui]

The page-attachment outlink/CTA UI renders its cta-image into an inline style string. For single page story ads that value is copied verbatim from the ad creative's meta tags by amp-story-auto-ads (createPageOutlink_ via getStoryAdMetadataFromDoc), so it crosses a trust boundary into the host story page.

Repro: serve a single page story ad whose amp-cta-image meta is https://x/i.png) !important; position: fixed; inset: 0; width: 100vw; height: 100vh; z-index: 2147483647; background: url(//evil. The outlink image chip ends up with those declarations applied, so the creative can overlay the whole story with its own target="_top" outlink.

Cause: style={{backgroundImage: ...url(${openImgAttr}) !important...}} is compiled by #core/dom/jsx (babel-plugin-jsx-style-object + jsxStylePropertyString) into setAttribute('style', ...), which accepts multiple declarations. A ) in the URL closes the url() and the rest becomes new declarations. The same shape appears in renderOutlinkUI, renderInlineUi, and buildOutlink_.

Fix: add cssUrl() in amp-story/1.0/utils.js (emits a quoted url("...") token with ", \ and newlines escaped) and route all three sinks through it, so the value stays a single background-image token regardless of input. Keeping the fix at the sink covers the ad path and any future caller rather than relying on each caller to pre-sanitize. Added a regression test that a position/z-index payload in cta-image is not parsed as separate declarations on the element.