net: limit HSTS ages to one year.

net/base/transport_security_state_unittest.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
 
 class TransportSecurityStateTest : public testing::Test {
@@ skipping 98 matching lines @@
   EXPECT_EQ(max_age, 123);
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(TransportSecurityState::ParseHeader(
       "max-age=394082;  incLudesUbdOmains", &max_age, &include_subdomains));
   EXPECT_EQ(max_age, 394082);
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(TransportSecurityState::ParseHeader(
       "max-age=39408299  ;incLudesUbdOmains", &max_age, &include_subdomains));
-  EXPECT_EQ(max_age, 39408299);
+  EXPECT_EQ(max_age,
+            std::min(TransportSecurityState::kMaxHSTSAgeSecs, 39408299l));
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(TransportSecurityState::ParseHeader(
       "max-age=394082038  ;  incLudesUbdOmains", &max_age, &include_subdomains));
-  EXPECT_EQ(max_age, 394082038);
+  EXPECT_EQ(max_age,
+            std::min(TransportSecurityState::kMaxHSTSAgeSecs, 394082038l));
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(TransportSecurityState::ParseHeader(
       "  max-age=0  ;  incLudesUbdOmains   ", &max_age, &include_subdomains));
   EXPECT_EQ(max_age, 0);
   EXPECT_TRUE(include_subdomains);
+
+  EXPECT_TRUE(TransportSecurityState::ParseHeader(
+      "  max-age=999999999999999999999999999999999999999999999  ;"
+      "  incLudesUbdOmains   ",
+      &max_age, &include_subdomains));
+  EXPECT_EQ(max_age, TransportSecurityState::kMaxHSTSAgeSecs);
+  EXPECT_TRUE(include_subdomains);
 }
 
 TEST_F(TransportSecurityStateTest, SimpleMatches) {
   scoped_refptr<TransportSecurityState> state(
       new TransportSecurityState);
   TransportSecurityState::DomainState domain_state;
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
 
   EXPECT_FALSE(state->IsEnabledForHost(&domain_state, "google.com"));
@@ skipping 211 matching lines @@
       new TransportSecurityState);
   const char kLongName[] =
       "lookupByWaveIdHashAndWaveIdIdAndWaveIdDomainAndWaveletIdIdAnd"
       "WaveletIdDomainAndBlipBlipid";
   TransportSecurityState::DomainState domain_state;
   // Just checks that we don't hit a NOTREACHED.
   EXPECT_FALSE(state->IsEnabledForHost(&domain_state, kLongName));
 }
 
 }  // namespace net