Add support for MD2, MD4, and MD5 to SignatureAlgorithm.

net/cert/internal/signature_policy.cc

Index: net/cert/internal/signature_policy.cc
diff --git a/net/cert/internal/signature_policy.cc b/net/cert/internal/signature_policy.cc
index 0785cbf65321c719711e25f76109fe2d5cf0fd40..b98cb7ae0524aa58f2213798312308198e10c34c 100644
--- a/net/cert/internal/signature_policy.cc
+++ b/net/cert/internal/signature_policy.cc
@@ -29,16 +29,56 @@ bool IsModulusSizeGreaterOrEqual(size_t modulus_length_bits,
   return true;
 }
 
+// Whitelist of default permitted signature digest algorithms.
+WARN_UNUSED_RESULT bool IsAcceptableDigest(DigestAlgorithm digest) {
+  switch (digest) {
+    case DigestAlgorithm::Md2:
+    case DigestAlgorithm::Md4:
+    case DigestAlgorithm::Md5:
+      return false;
+
+    case DigestAlgorithm::Sha1:
+    case DigestAlgorithm::Sha256:
+    case DigestAlgorithm::Sha384:
+    case DigestAlgorithm::Sha512:
+      return true;
+  }
+
+  return false;
+}
+
 }  // namespace
 
 bool SignaturePolicy::IsAcceptableSignatureAlgorithm(
     const SignatureAlgorithm& algorithm,
     CertErrors* errors) const {
-  return true;
+  // Whitelist default permitted signature algorithms to:
+  //
+  //    RSA PKCS#1 v1.5
+  //    RSASSA-PSS
+  //    ECDSA
+  //
+  // When used with digest algorithms:
+  //
+  //    SHA1
+  //    SHA256
+  //    SHA384
+  //    SHA512
+  switch (algorithm.algorithm()) {
+    case SignatureAlgorithmId::Ecdsa:
+    case SignatureAlgorithmId::RsaPkcs1:
+      return IsAcceptableDigest(algorithm.digest());
+    case SignatureAlgorithmId::RsaPss:
+      return IsAcceptableDigest(algorithm.digest()) &&
+             IsAcceptableDigest(algorithm.ParamsForRsaPss()->mgf1_hash());
+  }
+
+  return false;
 }
 
 bool SignaturePolicy::IsAcceptableCurveForEcdsa(int curve_nid,
                                                 CertErrors* errors) const {
+  // Whitelist default permitted named curves.
   switch (curve_nid) {
     case NID_X9_62_prime256v1:
     case NID_secp384r1: