Limit Public-Key-Pins max-age to 60 days

net/http/http_security_headers.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <limits>
 
 #include "base/base64.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "net/http/http_security_headers.h"
 #include "net/http/http_util.h"
 #include "url/gurl.h"
 
 namespace net {
 
 namespace {
 
 enum MaxAgeParsing { REQUIRE_MAX_AGE, DO_NOT_REQUIRE_MAX_AGE };
 
 static_assert(kMaxHSTSAgeSecs <= UINT32_MAX, "kMaxHSTSAgeSecs too large");
+static_assert(kMaxHPKPAgeSecs <= UINT32_MAX, "kMaxHPKPAgeSecs too large");
 
-// MaxAgeToInt converts a string representation of a "whole number" of
+// MaxAgeToLimitedInt converts a string representation of a "whole number" of
 // seconds into a uint32_t. The string may contain an arbitrarily large number,
-// which will be clipped to kMaxHSTSAgeSecs and which is guaranteed to fit
+// which will be clipped to a supplied limit and which is guaranteed to fit
 // within a 32-bit unsigned integer. False is returned on any parse error.
-bool MaxAgeToInt(std::string::const_iterator begin,
-                 std::string::const_iterator end,
-                 uint32_t* result) {
+bool MaxAgeToLimitedInt(std::string::const_iterator begin,
+                        std::string::const_iterator end,
+                        uint32_t limit,
+                        uint32_t* result) {
   const base::StringPiece s(begin, end);
   if (s.empty())
     return false;
 
   int64_t i = 0;
 
   // Return false on any StringToInt64 parse errors *except* for int64_t
   // overflow. StringToInt64 is used, rather than StringToUint64, in order to
   // properly handle and reject negative numbers (StringToUint64 does not return
   // false on negative numbers). For values too large to be stored in an
   // int64_t, StringToInt64 will return false with i set to
-  // std::numeric_limits<int64_t>::max(), so this case is detected by the
-  // immediately following if-statement and allowed to fall through so that i
-  // gets clipped to kMaxHSTSAgeSecs.
+  // std::numeric_limits<int64_t>::max(), so this case is allowed to fall
+  // through so that i gets clipped to limit.
   if (!base::StringToInt64(s, &i) && i != std::numeric_limits<int64_t>::max())
     return false;
   if (i < 0)
     return false;
-  if (i > kMaxHSTSAgeSecs)
-    i = kMaxHSTSAgeSecs;
+  if (i > limit)
+    i = limit;
   *result = (uint32_t)i;
   return true;
 }
 
 // Returns true iff there is an item in |pins| which is not present in
 // |from_cert_chain|. Such an SPKI hash is called a "backup pin".
 bool IsBackupPinPresent(const HashValueVector& pins,
                         const HashValueVector& from_cert_chain) {
   for (HashValueVector::const_iterator i = pins.begin(); i != pins.end();
        ++i) {
@@ skipping 75 matching lines @@
 
   HttpUtil::NameValuePairsIterator name_value_pairs(
       value.begin(), value.end(), ';',
       HttpUtil::NameValuePairsIterator::VALUES_OPTIONAL);
 
   while (name_value_pairs.GetNext()) {
     if (base::LowerCaseEqualsASCII(
             base::StringPiece(name_value_pairs.name_begin(),
                               name_value_pairs.name_end()),
             "max-age")) {
-      if (!MaxAgeToInt(name_value_pairs.value_begin(),
-                       name_value_pairs.value_end(), &max_age_candidate)) {
+      if (!MaxAgeToLimitedInt(name_value_pairs.value_begin(),
+                              name_value_pairs.value_end(), kMaxHPKPAgeSecs,
+                              &max_age_candidate)) {
         return false;
       }
       parsed_max_age = true;
     } else if (base::LowerCaseEqualsASCII(
                    base::StringPiece(name_value_pairs.name_begin(),
                                      name_value_pairs.name_end()),
                    "pin-sha256")) {
       // Pins are always quoted.
       if (!name_value_pairs.value_is_quoted() ||
           !ParseAndAppendPin(name_value_pairs.value_begin(),
@@ skipping 115 matching lines @@
         if (*tokenizer.token_begin() != '=')
           return false;
         DCHECK_EQ(tokenizer.token().length(), 1U);
         state = AFTER_MAX_AGE_EQUALS;
         break;
 
       case AFTER_MAX_AGE_EQUALS:
         if (base::IsAsciiWhitespace(*tokenizer.token_begin()))
           continue;
         unquoted = HttpUtil::Unquote(tokenizer.token());
-        if (!MaxAgeToInt(unquoted.begin(), unquoted.end(), &max_age_candidate))
+        if (!MaxAgeToLimitedInt(unquoted.begin(), unquoted.end(),
+                                kMaxHSTSAgeSecs, &max_age_candidate))
           return false;
         state = AFTER_MAX_AGE;
         break;
 
       case AFTER_MAX_AGE:
       case AFTER_INCLUDE_SUBDOMAINS:
         if (base::IsAsciiWhitespace(*tokenizer.token_begin()))
           continue;
         else if (*tokenizer.token_begin() == ';')
           state = DIRECTIVE_END;
         else
           return false;
         break;
 
       case AFTER_UNKNOWN_LABEL:
         // Consume and ignore the post-label contents (if any).
         if (*tokenizer.token_begin() != ';')
           continue;
         state = DIRECTIVE_END;
         break;
     }
   }
 
-  // We've consumed all the input.  Let's see what state we ended up in.
+  // We've consumed all the input. Let's see what state we ended up in.
   if (max_age_observed != 1 ||
       (include_subdomains_observed != 0 && include_subdomains_observed != 1)) {
     return false;
   }
 
   switch (state) {
     case DIRECTIVE_END:
     case AFTER_MAX_AGE:
     case AFTER_INCLUDE_SUBDOMAINS:
     case AFTER_UNKNOWN_LABEL:
@@ skipping 51 matching lines @@
                                bool* include_subdomains,
                                HashValueVector* hashes,
                                GURL* report_uri) {
   // max-age is irrelevant for Report-Only headers.
   base::TimeDelta unused_max_age;
   return ParseHPKPHeaderImpl(value, DO_NOT_REQUIRE_MAX_AGE, &unused_max_age,
                              include_subdomains, hashes, report_uri);
 }
 
 }  // namespace net