Force HTTPS and public keys for sandbox.google.com and subdomains.

Force HTTPS and public keys for sandbox.google.com and subdomains.

This would have helped mitigate a recent security bug.

BUG=172984
TEST=visit http://{plus,www,}.sandbox.google.com and make sure the request
is upgraded to HTTPS.

[palmer, 2013-01-31 22:34:28]

This is a present for cevans. Seems To Work OK For Me.

[Ryan Sleevi, 2013-01-31 22:41:45]

I'm guessing this is for
https://developers.google.com/checkout/developer/Google_Checkout_Basic_HTML_S...
and the like

LGTM, but please check with agl@ to make sure affected services are good to go.
They should all be.

[agl, 2013-01-31 23:42:19]

There's a lot of stuff in sandbox.google.com, I've little confidence that I can
say anything about about them. Let me email internally.

[palmer, 2013-02-01 00:44:05]

> There's a lot of stuff in http://sandbox.google.com, I've little confidence
that I can
> say anything about about them. Let me email internally.

What about [*.]plus.sandbox.google.com? That works over HTTPS always, and
wouldn't frighten other sites under sandbox.google.com.

[agl, 2013-02-01 14:45:13]

On Thu, Jan 31, 2013 at 7:44 PM,  <palmer@chromium.org> wrote:
> What about [*.]plus.sandbox.google.com? That works over HTTPS always, and
> wouldn't frighten other sites under sandbox.google.com.

I'd have no problem with that.


Cheers

AGL

[palmer, 2013-02-01 20:26:47]

> > What about [*.]plus.sandbox.google.com? That works over HTTPS always, and
> > wouldn't frighten other sites under http://sandbox.google.com.
> 
> I'd have no problem with that.

Done.

[agl, 2013-02-01 20:27:35]

lgtm

[commit-bot: I haz the power, 2013-02-01 21:08:15]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/palmer@chromium.org/12093100/1003

[commit-bot: I haz the power, 2013-02-01 21:08:17]

Presubmit check for 12093100-1003 failed and returned exit status 1.


Running presubmit commit checks ...

** Presubmit Messages **
Most layers below src/chrome/ should not hardcode service URLs.
Are you sure this is correct? (Contact: joi@chromium.org)
    net/base/transport_security_state_static.json:176:      { "name":
"plus.sandbox.google.com", "include_subdomains": true, "mode": "force-https",
"pins": "google" },

** Presubmit Warnings **
Found lines longer than 80 characters (first 5 shown).
  net/base/transport_security_state_static.h, line 395, 92 chars

[palmer, 2013-02-02 01:57:55]

This CL is in a weird state: I did a manual "git cl dcommit" to get around the
presubmit warning (it's a real warning but
net/base/transport_security_state_static.h is generated code with lots of long
lines). However, I ctrl-C'd the dcommit when I realized I had not rebased
against master first.

The result is: The code is committed, but this CL is not in status Closed. But
it effectively is closed and the code (just the plus.sandbox policy) is in the
tree now.