Add a note to SkGlobalInitialization_chromium.cpp.

src/ports/SkGlobalInitialization_chromium.cpp

 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkTypes.h"
 
 #include "SkBitmapProcShader.h"
@@ skipping 43 matching lines @@
 #include "SkPictureImageFilter.h"
 #include "SkPictureShader.h"
 #include "SkPixelXorXfermode.h"
 #include "SkRectShaderImageFilter.h"
 #include "SkTableColorFilter.h"
 #include "SkTestImageFilters.h"
 #include "SkTileImageFilter.h"
 #include "SkMatrixImageFilter.h"
 #include "SkXfermodeImageFilter.h"
 
+//  !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+//
+//  Adding new classes to Init() below has security consequences in Chrome.
+//
+//  In particular, it is important that we don't create code paths that
+//  deserialize untrusted data as SkImageFilters; SkImageFilters are sent from
+//  Chrome renderers (untrusted) to the main (trusted) process.
+//
+//  If you add a new SkImageFilter here _or_ other effect that can be part of
+//  an SkImageFilter, it's a good idea to have chrome-security@google.com sign
+//  off on the CL, and at minimum extend SampleFilterFuzz.cpp to fuzz it.
+//
+//  SkPictures are untrusted data.  Please be extremely careful not to allow
+//  SkPictures created in a Chrome renderer to be deserialized in the main process.
+//
+//  !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
 class SkPrivateEffectInitializer {
 public:
     static void Init() {
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkArcToPathEffect)
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkBitmapProcShader)
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkBitmapSource)
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkBlurDrawLooper)
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkBlurImageFilter)
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkColorCubeFilter)
         SK_DEFINE_FLATTENABLE_REGISTRAR_ENTRY(SkColorMatrixFilter)
@@ skipping 43 matching lines @@
         SkLightingImageFilter::InitializeFlattenables();
         SkTableColorFilter::InitializeFlattenables();
         SkXfermode::InitializeFlattenables();
     }
 };
 
 SK_DECLARE_STATIC_ONCE(once);
 void SkFlattenable::InitializeFlattenablesIfNeeded() {
     SkOnce(&once, SkPrivateEffectInitializer::Init);
 }