net: add certificate pins for Twitter.

net/base/transport_security_state_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/string_piece.h"
 #include "net/base/transport_security_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 #if defined(USE_OPENSSL)
 #include "crypto/openssl_util.h"
@@ skipping 688 matching lines @@
 
   EXPECT_TRUE(state.IsEnabledForHost(&domain_state,
                                      "greplin.com",
                                      false));
   EXPECT_TRUE(state.IsEnabledForHost(&domain_state,
                                      "www.greplin.com",
                                      false));
   EXPECT_FALSE(state.IsEnabledForHost(&domain_state,
                                       "foo.greplin.com",
                                       false));
+
+#if defined(OS_CHROMEOS)
+  EXPECT_TRUE(state.IsEnabledForHost(&domain_state,
+                                     "twitter.com",
+                                     false));
+#else
+  EXPECT_FALSE(state.IsEnabledForHost(&domain_state,
+                                      "twitter.com",
+                                      false));
+#endif
 }
 
 TEST_F(TransportSecurityStateTest, LongNames) {
   TransportSecurityState state("");
   const char kLongName[] =
       "lookupByWaveIdHashAndWaveIdIdAndWaveIdDomainAndWaveletIdIdAnd"
       "WaveletIdDomainAndBlipBlipid";
   TransportSecurityState::DomainState domain_state;
   // Just checks that we don't hit a NOTREACHED.
   EXPECT_FALSE(state.IsEnabledForHost(&domain_state, kLongName, true));
@@ skipping 34 matching lines @@
   TransportSecurityState state("");
   TransportSecurityState::DomainState domain_state;
   EXPECT_TRUE(state.IsEnabledForHost(&domain_state,
                                      "chrome.google.com",
                                      true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "chrome.google.com", true));
   std::vector<SHA1Fingerprint> hashes;
   // This essential checks that a built-in list does exist.
   EXPECT_FALSE(domain_state.IsChainOfPublicKeysPermitted(hashes));
   EXPECT_FALSE(state.HasPinsForHost(&domain_state, "www.paypal.com", true));
-  EXPECT_FALSE(state.HasPinsForHost(&domain_state, "twitter.com", true));
 
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "docs.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "1.docs.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "sites.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "drive.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state,
                                    "spreadsheets.google.com",
                                    true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "health.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state,
@@ skipping 22 matching lines @@
   EXPECT_TRUE(state.HasPinsForHost(&domain_state,
                                    "hostedtalkgadget.google.com",
                                    true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "talk.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "plus.google.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state, "ssl.gstatic.com", true));
   EXPECT_FALSE(state.HasPinsForHost(&domain_state, "www.gstatic.com", true));
   EXPECT_TRUE(state.HasPinsForHost(&domain_state,
                                    "ssl.google-analytics.com",
                                    true));
+
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "twitter.com", true));
+  EXPECT_FALSE(state.HasPinsForHost(&domain_state, "foo.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "www.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "api.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "oauth.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "mobile.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "dev.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "business.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "platform.twitter.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "si0.twimg.com", true));
+  EXPECT_TRUE(state.HasPinsForHost(&domain_state, "twimg0-a.akamaihd.net", true));
 }
 
 TEST_F(TransportSecurityStateTest, OptionalHSTSCertPins) {
   TransportSecurityState state("");
   TransportSecurityState::DomainState domain_state;
   EXPECT_FALSE(state.IsEnabledForHost(&domain_state,
                                       "www.google-analytics.com",
                                       false));
   EXPECT_FALSE(state.IsEnabledForHost(&domain_state,
                                       "www.google-analytics.com",
@@ skipping 166 matching lines @@
     size_t bit = bit_to_flip & 7;
     side_info_copy[byte] ^= (1 << bit);
 
     EXPECT_FALSE(TransportSecurityState::ParseSidePin(
         leaf_spki, side_info, &pub_key_hashes));
     ASSERT_EQ(0u, pub_key_hashes.size());
   }
 }
 
 }  // namespace net