Disallow wildcards from matching top-level registry controlled domains during cert validation.

net/cert/x509_certificate_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <cert.h>
 #include <cryptohi.h>
 #include <keyhi.h>
 #include <nss.h>
@@ skipping 134 matching lines @@
   CERT_DestroyCertificate(cert);
   return x509_cert;
 }
 
 void X509Certificate::GetSubjectAltName(
     std::vector<std::string>* dns_names,
     std::vector<std::string>* ip_addrs) const {
   x509_util::GetSubjectAltName(cert_handle_, dns_names, ip_addrs);
 }
 
-bool X509Certificate::VerifyNameMatch(const std::string& hostname) const {
-  return CERT_VerifyCertName(cert_handle_, hostname.c_str()) == SECSuccess;
-}
-
 bool X509Certificate::IsIssuedByEncoded(
     const std::vector<std::string>& valid_issuers) {
   // Get certificate chain as scoped list of CERTCertificate objects.
   std::vector<CERTCertificate*> cert_chain;
   cert_chain.push_back(cert_handle_);
   for (size_t n = 0; n < intermediate_ca_certs_.size(); ++n) {
     cert_chain.push_back(intermediate_ca_certs_[n]);
   }
   // Convert encoded issuers to scoped CERTName* list.
   std::vector<CERTName*> issuers;
@@ skipping 128 matching lines @@
 }
 
 // static
 void X509Certificate::GetPublicKeyInfo(OSCertHandle cert_handle,
                                        size_t* size_bits,
                                        PublicKeyType* type) {
   x509_util::GetPublicKeyInfo(cert_handle, size_bits, type);
 }
 
 }  // namespace net