Make HSTS headers not clobber preloaded pins.

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 216 matching lines @@
   TransportSecurityState::DomainState domain_state;
   if (!state.GetDomainState(hostname, true /* SNI ok */, &domain_state))
     return false;
 
   return (domain_state.static_spki_hashes.size() > 0 ||
           domain_state.bad_static_spki_hashes.size() > 0 ||
           domain_state.dynamic_spki_hashes.size() > 0) &&
          !domain_state.ShouldUpgradeToSSL();
 }
 
+TEST_F(TransportSecurityStateTest, NoClobberPins) {
+  TransportSecurityState state;
+  TransportSecurityState::DomainState domain_state;
+
+  EXPECT_TRUE(state.GetDomainState("accounts.google.com", true, &domain_state));
+  EXPECT_TRUE(HasPublicKeyPins("accounts.google.com"));
+  EXPECT_TRUE(state.AddHSTSHeader("accounts.google.com",
+                                  "includesubdomains; max-age=1000000"));
+  EXPECT_TRUE(HasPublicKeyPins("accounts.google.com"));
+}
+
 TEST_F(TransportSecurityStateTest, Preloaded) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
 
   // We do more extensive checks for the first domain.
   EXPECT_TRUE(state.GetDomainState("www.paypal.com", true, &domain_state));
   EXPECT_EQ(domain_state.upgrade_mode,
             TransportSecurityState::DomainState::MODE_FORCE_HTTPS);
   EXPECT_FALSE(domain_state.sts_include_subdomains);
   EXPECT_FALSE(domain_state.pkp_include_subdomains);
@@ skipping 436 matching lines @@
   // Expect to fail for SNI hosts when not searching the SNI list:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "gmail.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "googlegroups.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "www.googlegroups.com", false));
 }
 
 }  // namespace net