net: don't set HSTS for chart.apis.google.com

net/base/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 1313 matching lines @@
   {26, true, "\003ssl\020google-analytics\003com", true,
       kGooglePins, DOMAIN_GOOGLE_ANALYTICS_COM },
   {18, true, "\005drive\006google\003com", true, kGooglePins,
       DOMAIN_GOOGLE_COM },
   {16, true, "\012googleplex\003com", true, kGooglePins,
       DOMAIN_GOOGLEPLEX_COM },
   {19, true, "\006groups\006google\003com", true, kGooglePins,
       DOMAIN_GOOGLE_COM },
   {17, true, "\004apis\006google\003com", true, kGooglePins,
       DOMAIN_GOOGLE_COM },
+  // chart.apis.google.com is *not* HSTS because the certificate doesn't match
+  // and there are lots of links out there that still use the name. The correct
+  // hostname for this is chart.googleapis.com.
+  {23, true, "\005chart\004apis\006google\003com", false, kGooglePins,
+      DOMAIN_GOOGLE_COM},
+
   // Other Google-related domains that must use an acceptable certificate
   // iff using SSL.
   {11, true, "\005ytimg\003com", false, kGooglePins,
       DOMAIN_YTIMG_COM },
   {23, true, "\021googleusercontent\003com", false, kGooglePins,
       DOMAIN_GOOGLEUSERCONTENT_COM },
   {13, true, "\007youtube\003com", false, kGooglePins,
       DOMAIN_YOUTUBE_COM },
   {16, true, "\012googleapis\003com", false, kGooglePins,
       DOMAIN_GOOGLEAPIS_COM },
@@ skipping 290 matching lines @@
 
   return true;
 }
 
 bool TransportSecurityState::DomainState::ShouldRedirectHTTPToHTTPS()
     const {
   return mode == MODE_STRICT;
 }
 
 }  // namespace