Changeset 206850 in webkit

Timestamp:

Oct 5, 2016 11:39:14 PM (8 years ago)

Author:

Michael Catanzaro

Message:

[SOUP] HostTLSCertificateSet should not use SHA-1 hashes to compare certificates
​https://bugs.webkit.org/show_bug.cgi?id=162965

Reviewed by Carlos Garcia Campos.

Use SHA-256 instead.

No new tests, covered by TestSSL.

• platform/network/soup/SoupNetworkSession.cpp:

(WebCore::HostTLSCertificateSet::computeCertificateHash):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/network/soup/SoupNetworkSession.cpp (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-10-05  Michael Catanzaro  <mcatanzaro@igalia.com>
+
+        [SOUP] HostTLSCertificateSet should not use SHA-1 hashes to compare certificates
+        https://bugs.webkit.org/show_bug.cgi?id=162965
+
+        Reviewed by Carlos Garcia Campos.
+
+        Use SHA-256 instead.
+
+        No new tests, covered by TestSSL.
+
+        * platform/network/soup/SoupNetworkSession.cpp:
+        (WebCore::HostTLSCertificateSet::computeCertificateHash):
+
 2016-10-05  Michael Catanzaro  <mcatanzaro@igalia.com>
 

trunk/Source/WebCore/platform/network/soup/SoupNetworkSession.cpp

@@ -32 +32 @@
 #include "AuthenticationChallenge.h"
 #include "CookieJarSoup.h"
+#include "CryptoDigest.h"
 #include "FileSystem.h"
 #include "GUniquePtrSoup.h"
@@ -40 +41 @@
 #include <wtf/HashSet.h>
 #include <wtf/NeverDestroyed.h>
-#include <wtf/SHA1.h>
 #include <wtf/text/Base64.h>
 #include <wtf/text/CString.h>
@@ -78 +78 @@
             return String();
 
-        SHA1 sha1;
-        sha1.addBytes(certificateData->data, certificateData->len);
-
-        SHA1::Digest digest;
-        sha1.computeHash(digest);
-
-        return base64Encode(reinterpret_cast<const char*>(digest.data()), SHA1::hashSize);
+        auto digest = CryptoDigest::create(CryptoDigest::Algorithm::SHA_256);
+        digest->addBytes(certificateData->data, certificateData->len);
+
+        auto hash = digest->computeHash();
+        return base64Encode(reinterpret_cast<const char*>(hash.data()), hash.size());
     }