net: don't duplicate HPKP hashes when parsing the header.

net/http/http_security_headers_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/sha1.h"
 #include "base/strings/string_piece.h"
 #include "crypto/sha2.h"
@@ skipping 398 matching lines @@
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_TRUE(include_subdomains);
 
   EXPECT_TRUE(ParseHPKPHeader(
       "  max-age=999999999999999999999999999999999999999999999  ;  " +
           backup_pin + ";" + good_pin + ";   ",
       chain_hashes, &max_age, &include_subdomains, &hashes));
   expect_max_age = base::TimeDelta::FromSeconds(kMaxHSTSAgeSecs);
   EXPECT_EQ(expect_max_age, max_age);
   EXPECT_FALSE(include_subdomains);
+
+  // Test that parsing the same header twice doesn't duplicate the recorded
+  // hashes.
+  hashes.clear();
+  EXPECT_TRUE(ParseHPKPHeader(
+      "  max-age=999;  " +
+          backup_pin + ";" + good_pin + ";   ",
+      chain_hashes, &max_age, &include_subdomains, &hashes));
+  EXPECT_EQ(2u, hashes.size());
+  EXPECT_TRUE(ParseHPKPHeader(
+      "  max-age=999;  " +
+          backup_pin + ";" + good_pin + ";   ",
+      chain_hashes, &max_age, &include_subdomains, &hashes));
+  EXPECT_EQ(2u, hashes.size());
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA1) {
   TestBogusPinsHeaders(HASH_VALUE_SHA1);
 }
 
 TEST_F(HttpSecurityHeadersTest, BogusPinsHeadersSHA256) {
   TestBogusPinsHeaders(HASH_VALUE_SHA256);
 }
 
@@ skipping 67 matching lines @@
   EXPECT_NE(domain_state.dynamic_spki_hashes.end(), hash);
 
   hash = std::find_if(
       domain_state.dynamic_spki_hashes.begin(),
       domain_state.dynamic_spki_hashes.end(),
       HashValuesEqual(backup_hash));
   EXPECT_NE(domain_state.dynamic_spki_hashes.end(), hash);
 }
 
 };    // namespace net