De-prioritize 2.23.140.1.1 when searching for EV policy.

net/cert/cert_verify_proc_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_win.h"
 
 #include <memory>
 #include <string>
 #include <vector>
 
@@ skipping 924 matching lines @@
     if (policies_info.get()) {
       EVRootCAMetadata* metadata = EVRootCAMetadata::GetInstance();
       for (DWORD i = 0; i < policies_info->cPolicyInfo; ++i) {
         LPSTR policy_oid = policies_info->rgPolicyInfo[i].pszPolicyIdentifier;
         if (metadata->IsEVPolicyOID(policy_oid)) {
           ev_policy_oid = policy_oid;
           chain_para.RequestedIssuancePolicy.dwType = USAGE_MATCH_TYPE_AND;
           chain_para.RequestedIssuancePolicy.Usage.cUsageIdentifier = 1;
           chain_para.RequestedIssuancePolicy.Usage.rgpszUsageIdentifier =
               &ev_policy_oid;
-          break;
+
+          // De-prioritize the CA/Browser forum Extended Validation policy
+          // (2.23.140.1.1). See crbug.com/705285.
+          if (!EVRootCAMetadata::IsCaBrowserForumEvOid(ev_policy_oid))
+            break;
         }
       }
     }
   }
 
   // Revocation checking is always enabled, in order to enable CRLSets to be
   // evaluated as part of a revocation provider. However, when the caller did
   // not explicitly request revocation checking (which is to say, online
   // revocation checking), then only enable cached results. This disables OCSP
   // and CRL fetching, but still allows the revocation provider to be called.
@@ skipping 252 matching lines @@
     return MapCertStatusToNetError(verify_result->cert_status);
 
   if (ev_policy_oid &&
       CheckEV(chain_context, rev_checking_enabled, ev_policy_oid)) {
     verify_result->cert_status |= CERT_STATUS_IS_EV;
   }
   return OK;
 }
 
 }  // namespace net