Require HPKP pins to be quoted.

net/http/http_security_headers.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/base64.h"
 #include "base/basictypes.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "net/http/http_security_headers.h"
@@ skipping 100 matching lines @@
   pair.first = source.substr(0, point);
   if (std::string::npos != point)
     pair.second = source.substr(point + 1);
 
   return pair;
 }
 
 bool ParseAndAppendPin(const std::string& value,
                        HashValueTag tag,
                        HashValueVector* hashes) {
+  // Pins are always quoted.
+  if (value.empty() || !HttpUtil::IsQuote(value[0]))
+    return false;
+
   std::string unquoted = HttpUtil::Unquote(value);
-  std::string decoded;
-
   if (unquoted.empty())
       return false;
 
+  std::string decoded;
   if (!base::Base64Decode(unquoted, &decoded))
     return false;
 
   HashValue hash(tag);
   if (decoded.size() != hash.size())
     return false;
 
   memcpy(hash.data(), decoded.data(), hash.size());
   hashes->push_back(hash);
   return true;
@@ skipping 199 matching lines @@
     }
 
     if (!found)
       hashes->push_back(*i);
   }
 
   return true;
 }
 
 }  // namespace net