Titouan Rigoudy

Use structured fields for CORS headers

2

Private Network Access is considering using structured fields for the new `Access-Control-Allow-Private-Network` header in https://github.com/WICG/private-network-access/issues/45. This header should be kept consistent with the existing `Access-Control-Allow-Credentials` header defined by the CORS...

Using a context manager class to wrap task execution. Improves on #3698.

Add pyright support.

9

Adds support for type checking python code using pyright. Also adds a dependency on `mypy-protobuf` in order to generate `.pyi` type stubs for generated protobuf code, without which the type...

Prevent fetching from IPv4-mapped IPv6 addresses

2

Quoting my distinguished self from https://github.com/WICG/private-network-access/issues/36: > Dual stack applications such as modern browsers should never have to deal with IPv4-mapped IPv6 addresses (https://tools.ietf.org/html/rfc4291#section-2.5.5), as they can simply use IPv4...

Improve `butler.py weights` script

1

Add support for: - fuzz target weights, i.e. `FuzzTargetJob` db entries - notably including `fuzz-target set` - listing `FuzzerJobs` entries in text format Rework the command-line interface: - rename data...

Iterate through all revisions to find first good revision before bisecting.

2

This change builds on #3927 to change the way regression task operates. To review, given GitHub's lack of support for stacked PRs, this link should work: https://github.com/google/clusterfuzz/pull/3934/files/1bdca4468269ee897b5145f6dc24c395b6eb4d2d..dc74698caba2f0ce6512eca69d93d41d1692aef7 The overall goal...

Refactor `regression_task.found_regression_near_extreme_revisions`.

2

Prework for changing the behavior of `check_earliest_revisions()` to perform a binary search for the first good build instead of just checking the first few and erroring out if unsuccessful. See...

Update pipenv to latest version 2023.12.1

4

This would allow use of package categories, which might help simplify dependency management. Curious to see whether this breaks things or not, most notably CI.

Same-origin policy violation

24

Hi there! Chromium Web Platform security reviewer here. It appears to us that this API allows an origin to learn the color of cross-origin pixels, in violation of the same-origin...

> Subresource requests and subframe navigations are simpler as they cannot introduce a new first-party context. If the request matches the first-party URL's owner's manifest but is not currently recorded...