This made sense when Chromium's //c/b/resources/tools/rollup_plugin.js
considered that source JS files could come from both the sources and
the generated directories, but this is no longer the case as all those
JS files are under <root_gen_dir>/ui/webui/resources/webui_preprocessed
now, so we need to update Brave's code to adapt to this new scenario.
Chromium change:
https://chromium.googlesource.com/chromium/src/+/efc282784459e1ec69a524d901d8694cce5230c5
commit efc282784459e1ec69a524d901d8694cce5230c5
Author: rbpotter <rbpotter@chromium.org>
Date: Tue Sep 1 04:37:15 2020 +0000
Web UI: Add preprocessed resources and use in rollup
Preprocess all shared JS module resources into:
<root_gen_dir>/ui/webui/resources/webui_preprocessed
and read all these resources from this directory when bundling with
rollup.
Bug: 1071641
JS code in Brave's Welcome and Rewards WebUI pages is not ready yet
to migrated to a world where Trusted Types are enforced, so we need
to disable the Content Security Policy for Trusted types in those
pages for now and return to a pre-Chromium 87 point in order to keep
them working.
As mentioned above, this affects mainly Brave Rewards, but also
Brave's welcome page. Search for 'dangerouslySetInnerHTML' in *.tsx
files to find where exactly this is a problem.
Chromium change:
https://chromium.googlesource.com/chromium/src/+/5cb72d5f4fe919cfff22f3f51a6fc5e690588836
commit 5cb72d5f4fe919cfff22f3f51a6fc5e690588836
Author: Jun Kokatsu <Jun.Kokatsu@microsoft.com>
Date: Fri Aug 21 21:27:19 2020 +0000
Enable Trusted Types mitigation on WebUI by default
This change enables Trusted Types mitigation on WebUI by default.
It enforces use of safe API by default, and any use of unsafe API
(e.g. innerHTML, document.write, etc) has to overwrite Trusted Types
directives in the CSP header. Therefore this change makes security
review or audit of JavaScript code on WebUI a lot easier. Because
JavaScript could introduce XSS only by using
`trustedTypes.createPolicy` to generate untrusted html or script as
Trusted Types, or removing Trusted Types mitigation. And all of
those has to be carefully reviewed going forward.
Bug: 41905
Chromium change:
https://chromium.googlesource.com/chromium/src/+/3cd99aa27b47b24b44133959607b35380ed4633f
[Android] Fix material design package in resource exclusion regexes
Downstream material design targets are named slightly differently than
upstream material design. Remove the final "_material" from the regex in
order to also match downstream package names.
TBR=just bringing weblayer exclusions in line with chrome's
Bug: 1110346
Chromium change:
https://chromium.googlesource.com/chromium/src/+/fe08628fc210fd506cbb5d2fbc79193cbac2a342
commit fe08628fc210fd506cbb5d2fbc79193cbac2a342
Author: Peter Boström <pbos@chromium.org>
Date: Fri Aug 28 22:41:00 2020 +0000
Merge body-text text contexts
Renames CONTEXT_MESSAGE_BOX_BODY_TEXT => CONTEXT_DIALOG_BODY_TEXT.
Replaces ChromeTextContext::CONTEXT_DIALOG_BODY_TEXT_LARGE uses
CONTEXT_DIALOG_BODY_TEXT. For consistency with the rename above,
CONTEXT_BODY_TEXT_SMALL is renamed CONTEXT_DIALOG_BODY_TEXT_SMALL.
What this functionally means is that CONTEXT_MESSAGE_BODY_TEXT takes on
the old style of CONTEXT_DIALOG_BODY_TEXT_LARGE, so one style of dialog
text is dropped and the new style can be used from views code. As a
result dialog body text looks more uniform.
Bug: 1122602
Chromium change:
https://source.chromium.org/chromium/chromium/src/+/b63857b27c74a69b28575c514bac9f5a237caaf1
commit b63857b27c74a69b28575c514bac9f5a237caaf1
Author: nuwanda <nuwanda@google.com>
Date: Tue Aug 25 22:48:51 2020 +0000
Add support for logging UMA histogram samples from trace config
Now when histogram_samples category is set only the histograms listed
in a trace config will be monitored. If there are no histograms in a
trace config, the effect of enabling the histogram_samples category will
remain the same: all the histograms will be monitored.
Monitoring all the histograms results in a significant increase in
trace size and processing time, that's why we need a way to monitor
only a subset of histograms.
Based on the events added to trace when enabling the histogram_samples
category TBMv3 UMA metrics will be implemented.
Bug: 1119834
Chromium change:
https://chromium.googlesource.com/chromium/src/+/25eaa43022a6ac52292434e1b03cb72f8f98c74b
commit 25eaa43022a6ac52292434e1b03cb72f8f98c74b
Author: Matt Menke <mmenke@chromium.org>
Date: Tue Aug 25 00:10:00 2020 +0000
Remove net::LOAD_DO_NOT_SEND_COOKIES and net::LOAD_DO_NOT_SEND_AUTH_DATA.
These two net::LoadFlags (along with net::LOAD_DO_NOT_SAVE_COOKIES) are
being combined into network::mojom::CredentialMode::kOmit. This CL
updates the remaining consumers of the two cookies to use
CredentialsMode / allow_credentials / PrivacyMode instead.
Unfortunately, there are still a bunch of consumers that are setting
net::LOAD_DO_NOT_SAVE_COOKIES without either of the other two flags,
so this CL leaves that one in place, for now.
This CL also fixes the LOAD_DO_NOT_SAVE_COOKIES case, where we'd set
privacy mode at the URLRequest layer, but then URLRequestHttpRequest
would disable it in the RequestInfo struct unless cookies were blocked
by the network delegate. The code now never sets PrivacyMode if only
LOAD_DO_NOT_SAVE_COOKIES is set, which does slightly alter behavior in
the LOAD_DO_NOT_SAVE_COOKIES + NetworkDelegate blocks cookies case, but
the current behavior seems more consistent.
This will also make it so that when the NetworkDelegate forces
PrivacyMode, it will disable sending auth credentials. The impact
on this is not expected to be significant, but it's worth being
aware of.
Bug: 799935
To fix:
ERROR at //brave/components/brave_ads/browser/BUILD.gn:122:1: Dependency not allowed.
source_set("testutil") {
^-----------------------
The item //brave/components/brave_ads/browser:testutil
can not depend on //brave/vendor/bat-native-ads:internal_config
because it is not in //brave/vendor/bat-native-ads:internal_config's visibility list: [
//brave/vendor/bat-native-ads:*
//brave/components/brave_ads/test:*
//brave/test:*
]
To fix
ERROR at //third_party/blink/renderer/modules/modules.gni:28:3: Dependency not allowed.
target(target_type, target_name) {
^---------------------------------
The item //brave/third_party/blink/renderer/modules/brave:brave
can not depend on //third_party/blink/renderer:config
because it is not in //third_party/blink/renderer:config's visibility list: [
//third_party/blink/*
]
Mario Sanchez Prada