De-prioritize 2.23.140.1.1 when searching for EV policy.

net/cert/cert_verify_proc_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc_nss.h"
 
 #include <cert.h>
 #include <nss.h>
 #include <prerror.h>
 #include <secerr.h>
@@ skipping 642 matching lines @@
 }
 
 // Returns true if |cert_handle| contains a policy OID that is an EV policy
 // OID according to |metadata|, storing the resulting policy OID in
 // |*ev_policy_oid|. A true return is not sufficient to establish that a
 // certificate is EV, but a false return is sufficient to establish the
 // certificate cannot be EV.
 bool IsEVCandidate(EVRootCAMetadata* metadata,
                    CERTCertificate* cert_handle,
                    SECOidTag* ev_policy_oid) {
+  *ev_policy_oid = SEC_OID_UNKNOWN;
   DCHECK(cert_handle);
   ScopedCERTCertificatePolicies policies(DecodeCertPolicies(cert_handle));
   if (!policies.get())
     return false;
 
   CERTPolicyInfo** policy_infos = policies->policyInfos;
   while (*policy_infos != NULL) {
     CERTPolicyInfo* policy_info = *policy_infos++;
     // If the Policy OID is unknown, that implicitly means it has not been
     // registered as an EV policy.
     if (policy_info->oid == SEC_OID_UNKNOWN)
       continue;
     if (metadata->IsEVPolicyOID(policy_info->oid)) {
       *ev_policy_oid = policy_info->oid;
-      return true;
+
+      // De-prioritize the CA/Browser forum Extended Validation policy
+      // (2.23.140.1.1). See crbug.com/705285.
+      if (!EVRootCAMetadata::IsCaBrowserForumEvOid(policy_info->oid))
+        break;
     }
   }
 
-  return false;
+  return *ev_policy_oid != SEC_OID_UNKNOWN;
 }
 
 // Studied Mozilla's code (esp. security/manager/ssl/src/nsIdentityChecking.cpp
 // and nsNSSCertHelper.cpp) to learn how to verify EV certificate.
 // TODO(wtc): A possible optimization is that we get the trust anchor from
 // the first PKIXVerifyCert call.  We look up the EV policy for the trust
 // anchor.  If the trust anchor has no EV policy, we know the cert isn't EV.
 // Otherwise, we pass just that EV policy (as opposed to all the EV policies)
 // to the second PKIXVerifyCert call.
 bool VerifyEV(CERTCertificate* cert_handle,
@@ skipping 262 matching lines @@
     CRLSet* crl_set,
     const CertificateList& additional_trust_anchors,
     CertVerifyResult* verify_result) {
   return VerifyInternalImpl(cert, hostname, ocsp_response, flags, crl_set,
                             additional_trust_anchors,
                             NULL,  // chain_verify_callback
                             verify_result);
 }
 
 }  // namespace net