Correctly hash the input of MatchModuleWhitelistString() in pver4.

components/safe_browsing_db/v4_local_database_manager.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file should not be build on Android but is currently getting built.
 // TODO(vakh): Fix that: http://crbug.com/621647
 
 #include "components/safe_browsing_db/v4_local_database_manager.h"
 
 #include <vector>
 
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/metrics/histogram_macros.h"
 #include "components/safe_browsing_db/v4_feature_list.h"
 #include "components/safe_browsing_db/v4_protocol_manager_util.h"
 #include "content/public/browser/browser_thread.h"
+#include "crypto/sha2.h"
 
 using content::BrowserThread;
 using base::TimeTicks;
 
 namespace safe_browsing {
 
 namespace {
 
 const ThreatSeverity kLeastSeverity =
     std::numeric_limits<ThreatSeverity>::max();
@@ skipping 267 matching lines @@
   if (!V4ProtocolManagerUtil::IPAddressToEncodedIPV6Hash(ip_address,
                                                          &hashed_encoded_ip)) {
     return false;
   }
 
   return HandleHashSynchronously(hashed_encoded_ip,
                                  StoresToCheck({GetIpMalwareId()}));
 }
 
 bool V4LocalDatabaseManager::MatchModuleWhitelistString(
-    const std::string& str) {
+    const std::string& module_filename) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-
   if (!enabled_ || !v4_database_) {
-    // To make sure we are conservative we return true.
+    // Fail open: Whitelist everything
     return true;
   }
 
+  FullHash hash = crypto::SHA256HashString(module_filename);
   return HandleHashSynchronously(
-      str, StoresToCheck({GetChromeFilenameClientIncidentId()}));
+      hash, StoresToCheck({GetChromeFilenameClientIncidentId()}));
 }
 
 ThreatSource V4LocalDatabaseManager::GetThreatSource() const {
   return ThreatSource::LOCAL_PVER4;
 }
 
 bool V4LocalDatabaseManager::IsCsdWhitelistKillSwitchOn() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   return false;
 }
@@ skipping 350 matching lines @@
 }
 
 void V4LocalDatabaseManager::UpdateRequestCompleted(
     std::unique_ptr<ParsedServerResponse> parsed_server_response) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   v4_database_->ApplyUpdate(std::move(parsed_server_response),
                             db_updated_callback_);
 }
 
 }  // namespace safe_browsing