Updating Wootzapp Fiiles to match with chromium-127.0.6498.0 as base

[devjangid15]

This PR performs comprehensive code cleanup and updates the codebase to align with Chromium 127.0.6498.0 as the base version.

Changes Made

🔧 Code Cleanup

• Formatting standardization across C++, Java, TypeScript, and HTML files
• Import cleanup and removal of unused dependencies
• Dead code removal throughout the codebase
• File ending and formatting standardization for consistency
• Trace event naming fixes from "wootzapp" to "chrome" for better alignment

📦 Chromium 127.0.6498.0 Base Update

• Major version alignment with Chromium 127.0.6498.0
• Extensive file updates and reorganization to match upstream
• Feature flag corrections and configuration updates
• Policy handler updates with new mappings and configurations
• WebUI controller factory enhancements with updated components

🧹 Additional Improvements

• .gitignore updates to match Chromium standards
• README updates for better documentation
• Build configuration alignment with upstream Chromium

Impact

• ✅ Improved code consistency and maintainability
• ✅ Better alignment with upstream Chromium development
• ✅ Cleaner codebase with reduced technical debt
• ✅ Updated dependencies and configurations

---

Note: This PR focuses primarily on code cleanup and base alignment.

[qodo-code-review]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 Security concerns - CSP directive bypass: In blink/renderer/core/frame/csp/csp_directive_list.cc the function now unconditionally returns true for inline allowance, effectively disabling CSP inline checks. This is a significant security risk (XSS), enabling inline script/style where CSP should block. Confirm if this is intended for debug only; otherwise revert or guard with build flags. WebUI CSP relaxation: extensions_ui.cc sets DefaultSrc and ScriptSrc to "*" which greatly weakens WebUI CSP. Review if this UI serves untrusted content; consider narrowing sources or gating by build/flag. Sensitive URL allowances: document_subresource_filter.cc introduces broad substring-based ALLOW rules (e.g., "sodar", "_204"), potentially allowing tracking/ads. Validate necessity and risk. Digital identity provider exposure: New Desktop DigitalIdentityProvider is enabled; ensure it follows expected permission/consent flows and is behind appropriate platform checks. Removal of bad-message trace namespace rename: Only a trace label change; no security issue. General: No hardcoded secrets found.

⚡ Recommended focus areas for review Behavior Change The load policy now distinguishes kEnabled vs kDryRun and returns WOULD_DISALLOW in dry-run; verify callers expect this and that metrics/UI aren’t affected. Also, broad URL substring allowances (e.g., "sodar", "_204") may over-allow; confirm intent and impact. subresource_url, *document_origin_, subresource_type, activation_state_.generic_blocking_rules_disabled); CHECK_NE(LoadPolicy::WOULD_DISALLOW, result, base::NotFatalUntil::M129); if (result == LoadPolicy::DISALLOW) { ++statistics_.num_loads_matching_rules; if (activation_state_.activation_level == mojom::ActivationLevel::kEnabled) { ++statistics_.num_loads_disallowed; // Add callback notification for blocked resource if (!blocked_resource_callback_.is_null()) { blocked_resource_callback_.Run(subresource_url); } return LoadPolicy::DISALLOW; } else if (activation_state_.activation_level == mojom::ActivationLevel::kDryRun) { return LoadPolicy::WOULD_DISALLOW; } } Logic Simplification The 3PC exceptions construction was simplified to only label entries with origin "*" and dropped deduping against TP exceptions. Confirm UI doesn’t show duplicate or misleading entries and that removed set-based filtering wasn’t required. base::Value::List cookie_exceptions; GetExceptionsForContentType(ContentSettingsType::COOKIES, profile, web_ui, /*incognito=*/false, &cookie_exceptions); for (auto& cookie_exception : cookie_exceptions) { auto& dict = cookie_exception.GetDict(); if (dict.contains(kOrigin) && *dict.FindString(kOrigin) == "*") { dict.Set(kDescription, l10n_util::GetStringUTF16( Possible Issue Drag-and-drop handler now calls GetURLAndTitle but earlier code removal suggests prior incorrect placeholder. Ensure include/imports and behavior are correct on all platforms and that null/invalid data is handled; confirm no compile issues with kNavigateHomeChromeRefreshIcon availability on non-Refresh builds. ui::mojom::DragOperation& output_drag_op, std::unique_ptr<ui::LayerTreeOwner> drag_image_layer_owner) { std::optional<ui::OSExchangeData::UrlInfo> url_info = event.data().GetURLAndTitle(ui::FilenameToURLPolicy::CONVERT_FILENAMES); if (url_info.has_value() && url_info->url.is_valid() && prefs_) { GURL old_homepage(prefs_->GetString(prefs::kHomePage));

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	Re-evaluate disabling CSP inline checks The PR disables Content Security Policy (CSP) checks for inline scripts and styles by modifying CSPDirectiveListAllowInline to always return true. This creates a major security risk and should be reverted. Examples: src/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc [661] Solution Walkthrough: Before: bool CSPDirectiveListAllowInline(...) { // ... complex logic to check nonces, hashes, etc. // to determine if inline script/style is allowed by CSP. // This logic was removed in the PR. // For example: if (IsMatchingNoncePresent(directive.source_list, nonce)) return true; if (HashAllows(directive.source_list, inline_type, content)) return true; // ... more checks return false; // Disallow if no rule matches } After: bool CSPDirectiveListAllowInline( const ContentSecurityPolicy* csp, InlineType inline_type, Element* element, const String& content, const String& nonce, const String& context_url, const WTF::OrdinalNumber& context_line, ReportingDisposition reporting_disposition) { return true; } Suggestion importance[1-10]: 10 __ Why: This suggestion correctly identifies a critical security vulnerability introduced by hardcoding CSPDirectiveListAllowInline to always return true, which effectively bypasses CSP protections against inline execution and could lead to XSS attacks.	High
Possible issue	Fix a critical syntax error Remove the extra semicolon in the declaration of mJsonRpcService to fix a syntax error. src/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java [428-430] private KeyringService mKeyringService; -private JsonRpcService mJsonRpcService;; +private JsonRpcService mJsonRpcService; private SwapService mSwapService; Apply / Chat Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies a syntax error (mJsonRpcService;;) introduced in the PR that would cause a compilation failure, making it a critical fix.	High
Update