add note about security and new subclasses

BUG=skia:
GOLD_TRYBOT_URL= https://gold.skia.org/search2?unt=true&query=source_type%3Dgm&master=false&issue=1667663004

Review URL: https://codereview.chromium.org/1667663004

diff --git a/src/ports/SkGlobalInitialization_default.cpp b/src/ports/SkGlobalInitialization_default.cpp
index a2b91b4..8b27c49 100644 (file)
--- a/src/ports/SkGlobalInitialization_default.cpp
+++ b/src/ports/SkGlobalInitialization_default.cpp
@@ -46,6 +46,15 @@
 #include "SkTileImageFilter.h"
 #include "SkXfermodeImageFilter.h"
 
+// Security note:
+//
+// As new subclasses are added here, they should be reviewed by chrome security before they
+// support deserializing cross-process: chrome-security@google.com. SampleFilterFuzz.cpp should
+// also be amended to exercise the new subclass.
+//
+// See SkReadBuffer::isCrossProcess() and SkPicture::PictureIOSecurityPrecautionsEnabled()
+//
+
 /*
  *  None of these are strictly "required" for Skia to operate.
  *