STS: add chrome.google.com to the built in STS list.

net/base/transport_security_state.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
 #include "base/base64.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/scoped_ptr.h"
 #include "base/sha2.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "base/values.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/dns_util.h"
 
 namespace net {
 
 TransportSecurityState::TransportSecurityState()
     : delegate_(NULL) {
 }
 
 void TransportSecurityState::EnableHost(const std::string& host,
                                         const DomainState& state) {
+  if (GetBuiltin(NULL, host)) {
+    // You cannot override the settings of a builtin record.
+    return;
+  }
+
   const std::string canonicalised_host = CanonicaliseHost(host);
   if (canonicalised_host.empty())
     return;
   char hashed[base::SHA256_LENGTH];
   base::SHA256HashString(canonicalised_host, hashed, sizeof(hashed));
 
   AutoLock lock(lock_);
 
   enabled_hosts_[std::string(hashed, sizeof(hashed))] = state;
   DirtyNotify();
 }
 
 bool TransportSecurityState::IsEnabledForHost(DomainState* result,
                                               const std::string& host) {
   const std::string canonicalised_host = CanonicaliseHost(host);
   if (canonicalised_host.empty())
     return false;
 
   base::Time current_time(base::Time::Now());
   AutoLock lock(lock_);
 
   for (size_t i = 0; canonicalised_host[i]; i += canonicalised_host[i] + 1) {
     char hashed_domain[base::SHA256_LENGTH];
 
     base::SHA256HashString(&canonicalised_host[i], &hashed_domain,
                            sizeof(hashed_domain));
     std::map<std::string, DomainState>::iterator j =
         enabled_hosts_.find(std::string(hashed_domain, sizeof(hashed_domain)));
-    if (j == enabled_hosts_.end())
-      continue;
+    if (j != enabled_hosts_.end()) {
+      if (current_time > j->second.expiry) {
+        enabled_hosts_.erase(j);
+        DirtyNotify();
+        continue;
+      }
+      *result = j->second;
 
-    if (current_time > j->second.expiry) {
-      enabled_hosts_.erase(j);
-      DirtyNotify();
+    } else if (GetBuiltin(result, host)) {
+      // The host has a builtin record. We don't check the expiry on these.
+    } else {
+      // no record for this host. Try the next least specific domain.
       continue;
     }
 
-    *result = j->second;
-
     // If we matched the domain exactly, it doesn't matter what the value of
     // include_subdomains is.
     if (i == 0)
       return true;
 
-    return j->second.include_subdomains;
+    return result->include_subdomains;
   }
 
   return false;
 }
 
 // "Strict-Transport-Security" ":"
 //     "max-age" "=" delta-seconds [ ";" "includeSubDomains" ]
 bool TransportSecurityState::ParseHeader(const std::string& value,
                                          int* max_age,
                                          bool* include_subdomains) {
@@ skipping 245 matching lines @@
     // step 3(b)
     if (new_host[i + 1] == '-' ||
         new_host[i + label_length] == '-') {
       return std::string();
     }
   }
 
   return new_host;
 }
 
+bool TransportSecurityState::GetBuiltin(DomainState* result,
+                                        const std::string& host) {
+  // This time is somewhere around the year 2970.
+  static const double kNoExpiry = 31557600000;
+
+  // For the moment this list is just compiled into the browser.
+  if (host == "chrome.google.com") {

[abarth-chromium, 2009/12/08 03:09:42]

They rolled back this change because they're hosting HTTP YouTube videos.  We
shouldn't bake this in until they're ready.

+    if (result) {
+      result->mode = DomainState::MODE_STRICT;
+      result->include_subdomains = true;

[abarth-chromium, 2009/12/08 03:09:42]

This should be false.

+      result->expiry = base::Time::FromDoubleT(kNoExpiry);
+    }
+    return true;
+  }
+
+  return false;
+}
+
 }  // namespace