Merge branch 'youtube:main' into clean-file

Change-Id: I46a7f8382608f20d6000af4a29d623df04db97a1

.github/workflows/scorecards.yml

@@ -32,12 +32,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -46,14 +46,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v3.1.1
+        uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v2.1.37
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
         with:
           sarif_file: results.sarif

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported Versions
+
+Currently supported stable Cobalt versions are.
+
+| Version | Release status   | Supported          |
+| ------- | -----------------|------------------- |
+| 25.lts  | upcoming release | :white_check_mark: |
+| 24.lts  | last stable      | :white_check_mark: |
+| 23.lts  | maintenance      | :white_check_mark: |
+| 22.lts  | EOL              | :no_entry:         |
+| < 21.lts| no support       | :x:                |
+
+
+## Model
+
+Although Cobalt is built to process web content similar to browsers,
+it is not a web browser. Our security model assumes _only trusted content
+processing_.
+
+## Reporting a Vulnerability
+
+Please use [https://developers.google.com/youtube/cobalt](https://developers.google.com/youtube/cobalt/docs/communication) as an overall guide where to report issues.
+
+Critical security vulnerabilities should be reported via [email protected].

base/BUILD.gn

@@ -3661,7 +3661,6 @@ test("base_unittests") {
     data_deps += [
       ":base_unittests_bundle_data",
       "//cobalt/network:copy_ssl_certificates",
-      "//third_party/icu:icudata",
     ]
   }
 

base/files/file.h

@@ -379,7 +379,7 @@ class BASE_EXPORT File {
   static int Stat(const char* path, stat_wrapper_t* sb);
   static int Fstat(int fd, stat_wrapper_t* sb);
 # if !defined(STARBOARD)
-  # Starboard does not support lstat yet.
+  // Starboard does not support lstat yet.
   static int Lstat(const char* path, stat_wrapper_t* sb);
 #endif
 #endif

base/files/file_enumerator_starboard.cc

@@ -44,7 +44,6 @@ int64_t FileEnumerator::FileInfo::GetSize() const {
 }
 
 base::Time FileEnumerator::FileInfo::GetLastModifiedTime() const {
-  LOG(INFO) << "HAO : file_enumerator_starboard, last_modified : " << base::Time::FromTimeT(stat_.st_mtime);
   return base::Time::FromTimeT(stat_.st_mtime);
 }
 

base/files/file_enumerator_unittest.cc

@@ -522,7 +522,9 @@ TEST(FileEnumerator, GetInfoRecursive) {
     const FilePath dir_path = temp_dir.GetPath().Append(dir.name);
 #if defined(STARBOARD)
 #ifdef _WIN32
-// Reable this test when support directory open in base::File for Windows.
+// TODO: Reable this test when support directory open in base::File for Windows.
+// Below tests would fail because we are now using _open from <io.h> instead of 
+// CreateFile from <fileapi.h>.
 #else
     ASSERT_TRUE(GetFileInfo(dir_path, dir.info));
 #endif

base/files/file_starboard.cc

@@ -110,7 +110,6 @@ void File::Info::FromStat(const stat_wrapper_t& stat_info) {
   last_modified =
       Time::FromTimeT(last_modified_sec) +
       Microseconds(last_modified_nsec / Time::kNanosecondsPerMicrosecond);
-  LOG(INFO) << " HAO : file_starboard, last_modified: " << last_modified;
 
   last_accessed =
       Time::FromTimeT(last_accessed_sec) +
@@ -189,8 +188,6 @@ int File::Read(int64_t offset, char* data, int size) {
 int File::ReadAtCurrentPos(char* data, int size) {
   internal::AssertBlockingAllowed();
   DCHECK(IsValid());
-  SB_LOG(INFO) << "HAO: ReadAtCurrentPos";
-  SB_LOG(INFO) << "size" << size;
   if (size < 0)
     return -1;
 
@@ -243,31 +240,26 @@ int File::ReadAtCurrentPosNoBestEffort(char* data, int size) {
 
 int File::Write(int64_t offset, const char* data, int size) {
   internal::AssertBlockingAllowed();
-  //LOG(INFO) << "hao: write: offset: " << offset << "data: " << data << "size: " << size;
   if (append_) {
-    //LOG(INFO) << "hao: write: in append_";
     return WriteAtCurrentPos(data, size);
   }
 
   int original_position = lseek(file_.get(), 0,  static_cast<int>(kSbFileFromCurrent));
-  //LOG(INFO) << "hao: write: file_.get(): " << file_.get() << "original_position: " << original_position;
   if (original_position < 0) {
     return -1;
   }
 
   int64_t position =
       lseek(file_.get(), static_cast<off_t>(offset), static_cast<int>(kSbFileFromBegin));
-  //LOG(INFO) << "hao: write: position: " << position;
+
   int result = 0;
   if (position == offset) {
     result = WriteAtCurrentPos(data, size);
-    //LOG(INFO) << "hao: write: WriteAtCurrentPos result: " << result;
   }
 
   // Restore position regardless of result of write.
   position = lseek(file_.get(), static_cast<off_t>(original_position),
                    static_cast<int>(kSbFileFromBegin));
-  //LOG(INFO) << "hao: write: position: " << position;
   if (result < 0) {
     return result;
   }
@@ -279,20 +271,6 @@ int File::Write(int64_t offset, const char* data, int size) {
   return result;
 }
 
-// int File::WriteAtCurrentPos(const char* data, int size) {
-//   internal::AssertBlockingAllowed();
-//   LOG(INFO) << "HAO: File::Write: in WriteAtCurrentPos, size: " << size;
-//   DCHECK(IsValid());
-//   if (size < 0)
-//     return -1;
-
-//   SCOPED_FILE_TRACE_WITH_SIZE("WriteAtCurrentPos", size);
-//   int write_result = starboard::WriteAll(file_.get(), data, size);
-//   LOG(INFO) << "HAO: File::Write: in WriteAtCurrentPos, write_result: " << write_result;
-//   RecordFileWriteStat(write_result);
-//   return write_result;
-// }
-
 int File::WriteAtCurrentPos(const char* data, int size) {
   internal::AssertBlockingAllowed();
   DCHECK(IsValid());
@@ -342,8 +320,6 @@ int64_t File::GetLength() {
 bool File::SetLength(int64_t length) {
   internal::AssertBlockingAllowed();
   DCHECK(IsValid());
-  LOG(INFO) << "HAO: SetLength: length: " << length;
-  LOG(INFO) << "HAO: SetLength: sizeof long is : " << sizeof(long);
   SCOPED_FILE_TRACE_WITH_SIZE("SetLength", length);
   return !ftruncate(file_.get(), length);
 }
@@ -368,7 +344,6 @@ bool File::GetInfo(Info* info) {
     return false;
 
   info->FromStat(file_info);
-  LOG(INFO) << "HAO: file_starboard: FILE::GetInfo: " << info->last_modified;
   return true;
 }
 

base/files/file_unittest.cc

@@ -348,7 +348,6 @@ TEST(FileTest, Length) {
                 base::File::FLAG_WRITE);
   ASSERT_TRUE(file.IsValid());
   EXPECT_EQ(0, file.GetLength());
-  LOG(INFO) << "hao: getlength: 1"; 
 
   // Write "test" to the file.
   char data_to_write[] = "test";
@@ -361,7 +360,6 @@ TEST(FileTest, Length) {
   int64_t file_size = 0;
   EXPECT_TRUE(file.SetLength(kExtendedFileLength));
   EXPECT_EQ(kExtendedFileLength, file.GetLength());
-  LOG(INFO) << "hao: getlength: 2"; 
   EXPECT_TRUE(GetFileSize(file_path, &file_size));
   EXPECT_EQ(kExtendedFileLength, file_size);
 
@@ -378,7 +376,6 @@ TEST(FileTest, Length) {
   const int kTruncatedFileLength = 2;
   EXPECT_TRUE(file.SetLength(kTruncatedFileLength));
   EXPECT_EQ(kTruncatedFileLength, file.GetLength());
-  LOG(INFO) << "hao: getlength: 3"; 
   EXPECT_TRUE(GetFileSize(file_path, &file_size));
   EXPECT_EQ(kTruncatedFileLength, file_size);
 
@@ -392,16 +389,21 @@ TEST(FileTest, Length) {
   // Expand the file past the 4 GB limit.
 #if defined(STARBOARD)
 #if SB_IS(32_BIT)
-// doesn't work on Win32 with _chsize.
+// TODO: After POSIX migration WIN32 uses _chsize in ftruncate, and it 
+// does not support big file: 
+// https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/chsize?view=msvc-170
+// Before POSXI migration WIN32 was implemented with SetFilePointerEx : 
+// https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-setfilepointerex
 #else
-  //if (sizeof(long) == 8) {
+  // TODO: Checking why SB_IS(32_BIT) is not set for WIN32, and we have to dynamically check
+  // sizeof(long) to filter out WIN32.
+  if (sizeof(long) == 8) {
     const int64_t kBigFileLength = 5'000'000'000;
     EXPECT_TRUE(file.SetLength(kBigFileLength));
     EXPECT_EQ(kBigFileLength, file.GetLength());
-    LOG(INFO) << "hao: getlength: 4";
     EXPECT_TRUE(GetFileSize(file_path, &file_size));
     EXPECT_EQ(kBigFileLength, file_size);
-  //}
+  }
 #endif
 #endif
 #endif
@@ -411,9 +413,7 @@ TEST(FileTest, Length) {
   file.Close();
   file.Initialize(file_path,
                   base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE);
-  LOG(INFO) << "hao: length: " << file.GetLength(); 
   EXPECT_EQ(0, file.GetLength());
-  LOG(INFO) << "hao: getlength: 5"; 
 }
 
 // Flakily fails: http://crbug.com/86494
@@ -656,27 +656,18 @@ TEST(FileTest, MAYBE_WriteDataToLargeOffset) {
 
   const char kData[] = "this file is sparse.";
   const int kDataLen = sizeof(kData) - 1;
-//  int64_t kLargeFileOffset;
-//
-//#if defined(STARBOARD)
-//  if (sizeof(long) == 4) {
-//    kLargeFileOffset = (1LL << 31) - 2;
-//  } else {
-//    kLargeFileOffset = (1LL << 31);
-//  }
-//#else   // defined(STARBOARD)
-//  kLargeFileOffset = (1LL << 31);
-//#endif  // defined(STARBOARD)
+  int64_t kLargeFileOffset;
 
+// TODO: Checking why SB_IS(32_BIT) is not set for WIN32, and we have to dynamically check
+// sizeof(long) to filter out WIN32.
 #if defined(STARBOARD)
-#if SB_IS(32_BIT)
-  // Maximum off_t for lseek() on 32-bit builds is just below 2^31.
-  const int64_t kLargeFileOffset = (1LL << 31) - 2;
-#else   // SB_IS(32_BIT)
-  const int64_t kLargeFileOffset = (1LL << 31);
-#endif  // SB_IS(32_BIT)
+  if (sizeof(long) == 4) {
+    kLargeFileOffset = (1LL << 31) - 2;
+ } else {
+ kLargeFileOffset = (1LL << 31);
+}
 #else   // defined(STARBOARD)
-  const int64_t kLargeFileOffset = (1LL << 31);
+kLargeFileOffset = (1LL << 31);
 #endif  // defined(STARBOARD)
 
   // If the file fails to write, it is probably we are running out of disk space