Disallow support for a*.example.net, *a.example.net, and a*b.example.net in certificate wildcard ha…

net/cert/x509_certificate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <stdlib.h>
 
 #include <algorithm>
 #include <map>
@@ skipping 611 matching lines @@
     // as we require the wildcard (if present) to match at least one character.
     if (presented_name.length() > reference_name.length())
       continue;
 
     base::StringPiece presented_host, presented_domain;
     SplitOnChar(presented_name, '.', &presented_host, &presented_domain);
 
     if (presented_domain != reference_domain)
       continue;
 
-    base::StringPiece pattern_begin, pattern_end;
-    SplitOnChar(presented_host, '*', &pattern_begin, &pattern_end);
-
-    if (pattern_end.empty()) {  // No '*' in the presented_host
+    if (presented_host != "*") {
       if (presented_host == reference_host)
         return true;
       continue;
     }
-    pattern_end.remove_prefix(1);  // move past the *
 
     if (!allow_wildcards)
       continue;
 
-    // * must not match a substring of an IDN A label; just a whole fragment.
-    if (reference_host.starts_with("xn--") &&
-        !(pattern_begin.empty() && pattern_end.empty()))
-      continue;
-
-    if (reference_host.starts_with(pattern_begin) &&
-        reference_host.ends_with(pattern_end))
-      return true;
+    return true;
   }
   return false;
 }
 
 bool X509Certificate::VerifyNameMatch(const std::string& hostname,
                                       bool* common_name_fallback_used) const {
   std::vector<std::string> dns_names, ip_addrs;
   GetSubjectAltName(&dns_names, &ip_addrs);
   return VerifyHostname(hostname, subject_.common_name, dns_names, ip_addrs,
                         common_name_fallback_used);
@@ skipping 99 matching lines @@
     RemoveFromCache(cert_handle_);
     FreeOSCertHandle(cert_handle_);
   }
   for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i) {
     RemoveFromCache(intermediate_ca_certs_[i]);
     FreeOSCertHandle(intermediate_ca_certs_[i]);
   }
 }
 
 }  // namespace net