Change the client-side phishing detection hashing function to

chrome/browser/safe_browsing/browser_feature_extractor.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/safe_browsing/browser_feature_extractor.h"
 
 #include <map>
 #include <utility>
 
 #include "base/stl_util.h"
 #include "base/stringprintf.h"
+#include "base/string_util.h"
 #include "base/task.h"
 #include "base/time.h"
 #include "chrome/common/safe_browsing/csd.pb.h"
 #include "chrome/browser/history/history.h"
 #include "chrome/browser/history/history_types.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/browser_features.h"
 #include "chrome/browser/safe_browsing/client_side_detection_service.h"
 #include "chrome/browser/safe_browsing/safe_browsing_util.h"
 #include "content/common/page_transition_types.h"
 #include "content/browser/browser_thread.h"
 #include "content/browser/cancelable_request.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "crypto/sha2.h"
 #include "googleurl/src/gurl.h"
 
 namespace safe_browsing {
 
-const int BrowserFeatureExtractor::kSuffixPrefixHashLength = 5;
+const int BrowserFeatureExtractor::kHashPrefixLength = 5;
 
 BrowseInfo::BrowseInfo() {}
 
 BrowseInfo::~BrowseInfo() {}
 
 static void AddFeature(const std::string& feature_name,
                        double feature_value,
                        ClientPhishingRequest* request) {
   DCHECK(request);
   ClientPhishingRequest::Feature* feature =
@@ skipping 405 matching lines @@
 
 void BrowserFeatureExtractor::ComputeURLHash(
     ClientPhishingRequest* request) {
   // Put the url into SafeBrowsing host suffix / path prefix format, with
   // query parameters stripped.
   std::string host, path, query;
   safe_browsing_util::CanonicalizeUrl(GURL(request->url()),
                                       &host, &path, &query);
   DCHECK(!host.empty()) << request->url();
   DCHECK(!path.empty()) << request->url();
-  request->set_suffix_prefix_hash(
-      crypto::SHA256HashString(host + path).substr(
-          0, kSuffixPrefixHashLength));
+
+  // Lowercase the URL.  Note: canonicalization converts the URL to ASCII.
+  // Percent encoded characters will not be lowercased but this is consistent
+  // with what we're doing on the server side.
+  StringToLowerASCII(&host);
+  StringToLowerASCII(&path);
+
+  // Remove leading 'www.' from the host.
+  if (host.size() > 4 && host.substr(0, 4) == "www.") {
+    host.erase(0, 4);
+  }
+  // Remove everything after the last '/' to broaden the pattern.
+  if (path.size() > 1 && *(path.rbegin()) != '/') {
+    // The pattern never ends in foo.com/test? because we stripped CGI params.
+    // Remove everything that comes after the last '/'.
+    size_t last_path = path.rfind("/");
+    path.erase(last_path + 1);
+  }
+
+  request->set_hash_prefix(crypto::SHA256HashString(host + path).substr(
+      0, kHashPrefixLength));
 }
 
 };  // namespace safe_browsing