Require HPKP pins to be quoted.

net/http/http_security_headers.cc

Index: net/http/http_security_headers.cc
diff --git a/net/http/http_security_headers.cc b/net/http/http_security_headers.cc
index 8d0c1465307f8adb5da5eb61907e2a0b8b2d9da6..373d0b896caf83c1d03ee23c09452ed253fc7a00 100644
--- a/net/http/http_security_headers.cc
+++ b/net/http/http_security_headers.cc
@@ -118,12 +118,15 @@ StringPair Split(const std::string& source, char delimiter) {
 bool ParseAndAppendPin(const std::string& value,
                        HashValueTag tag,
                        HashValueVector* hashes) {
-  std::string unquoted = HttpUtil::Unquote(value);
-  std::string decoded;
+  // Pins are always quoted.
+  if (value.empty() || !HttpUtil::IsQuote(value[0]))
+    return false;
 
+  std::string unquoted = HttpUtil::Unquote(value);
   if (unquoted.empty())
       return false;
 
+  std::string decoded;
   if (!base::Base64Decode(unquoted, &decoded))
     return false;