Mark SHA-1 as deprecated

net/url_request/url_request_http_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
@@ skipping 726 matching lines @@
 // NOTE: |ProcessStrictTransportSecurityHeader| and
 // |ProcessPublicKeyPinsHeader| have very similar structures, by design.
 void URLRequestHttpJob::ProcessStrictTransportSecurityHeader() {
   DCHECK(response_info_);
   TransportSecurityState* security_state =
       request_->context()->transport_security_state();
   const SSLInfo& ssl_info = response_info_->ssl_info;
 
   // Only accept HSTS headers on HTTPS connections that have no
   // certificate errors.
-  if (!ssl_info.is_valid() || IsCertStatusError(ssl_info.cert_status) ||
+  if (!ssl_info.is_valid() || (IsCertStatusError(ssl_info.cert_status) &&
+                               !IsCertStatusMinorError(ssl_info.cert_status)) ||

[davidben, 2014/09/29 20:21:32]

Is this bit still necessary now that it's not CertStatus error?

       !security_state)
     return;
 
   // http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec:
   //
   //   If a UA receives more than one STS header field in a HTTP response
   //   message over secure transport, then the UA MUST process only the
   //   first such header field.
   HttpResponseHeaders* headers = GetResponseHeaders();
   std::string value;
   if (headers->EnumerateHeader(NULL, "Strict-Transport-Security", &value))
     security_state->AddHSTSHeader(request_info_.url.host(), value);
 }
 
 void URLRequestHttpJob::ProcessPublicKeyPinsHeader() {
   DCHECK(response_info_);
   TransportSecurityState* security_state =
       request_->context()->transport_security_state();
   const SSLInfo& ssl_info = response_info_->ssl_info;
 
   // Only accept HPKP headers on HTTPS connections that have no
   // certificate errors.
-  if (!ssl_info.is_valid() || IsCertStatusError(ssl_info.cert_status) ||
+  if (!ssl_info.is_valid() || (IsCertStatusError(ssl_info.cert_status) &&
+                               !IsCertStatusMinorError(ssl_info.cert_status)) ||

[davidben, 2014/09/29 20:21:32]

Ditto.

       !security_state)
     return;
 
   // http://tools.ietf.org/html/draft-ietf-websec-key-pinning:
   //
   //   If a UA receives more than one PKP header field in an HTTP
   //   response message over secure transport, then the UA MUST process
   //   only the first such header field.
   HttpResponseHeaders* headers = GetResponseHeaders();
   std::string value;
@@ skipping 736 matching lines @@
   return override_response_headers_.get() ?
              override_response_headers_.get() :
              transaction_->GetResponseInfo()->headers.get();
 }
 
 void URLRequestHttpJob::NotifyURLRequestDestroyed() {
   awaiting_callback_ = false;
 }
 
 }  // namespace net