Verify intent signatures.

I have moved to https://codereview.chromium.org/2167573003/, according to Roslyn's advice .
code will be updated at new issue.
Thanks for understanding.

quote"
> I recommend that you re-upload the patch with your @alibaba-inc.com email.
> Alibaba employees are already allowed to submit patches to Chromium. If you
must
> use your @gmail.com email, then please sign the individual agreement in
> https://cla.developers.google.com/.
> 
> Whichever method your choose, please put your email address and name in the
> AUTHORS file:
> 
> https://cs.chromium.org/chromium/src/AUTHORS
"

########
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as intended target app.
such as sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713

[xiaohai, 2016-07-19 07:22:49]

Description was changed from

==========
Add one step to verify the signature in intent for chrome while the intent has a
scheme for the app.

BUG=
==========

to

==========
BUG=629055
TEST=start a website which contains a scheme intent in chrome, one intent case
contains official app signature , it can start activity in app, and one another
intent case contains fake app signature,
the chrome won't start activity of the fake app.

e.g.
original intent:
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end".

optimized  intent(add sha256): 
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end".

the method is compatible for all chrome.
==========

[xiaohai, 2016-07-19 07:29:16]

Description was changed from

==========
BUG=629055
TEST=start a website which contains a scheme intent in chrome, one intent case
contains official app signature , it can start activity in app, and one another
intent case contains fake app signature,
the chrome won't start activity of the fake app.

e.g.
original intent:
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end".

optimized  intent(add sha256): 
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end".

the method is compatible for all chrome.
==========

to

==========
BUG=629055
TEST=start a website which contains a scheme intent in chrome, one intent case
contains official app signature , it can start activity in app, and one another
intent case contains fake app signature,
the chrome won't start activity of the fake app.

e.g.
original intent:
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end".

optimized  intent(add sha256): 
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end".

the method is compatible for all chrome.

## How to use this feature?
while using deep link or app link ,developers just need add the sha256 of the
app into the intent.
==========

[xiaohai, 2016-07-19 09:01:31]

xiaohai.yxh@alipay.com changed reviewers:
+ rouslan@chromium.org

[please use gerrit instead, 2016-07-19 15:41:16]

https://codereview.chromium.org/2160193002/diff/80001/AUTHORS
File AUTHORS (right):

https://codereview.chromium.org/2160193002/diff/80001/AUTHORS#newcode725
AUTHORS:725: Jiajia Li <jiajia.lijj@alipay.com>
This email address should match the author of the patch, which is
xiaohai.yxh@alipay.com.

[please use gerrit instead, 2016-07-19 15:45:33]

Description was changed from

==========
BUG=629055
TEST=start a website which contains a scheme intent in chrome, one intent case
contains official app signature , it can start activity in app, and one another
intent case contains fake app signature,
the chrome won't start activity of the fake app.

e.g.
original intent:
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end".

optimized  intent(add sha256): 
"intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end".

the method is compatible for all chrome.

## How to use this feature?
while using deep link or app link ,developers just need add the sha256 of the
app into the intent.
==========

to

==========
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

BUG=629055
==========

[please use gerrit instead, 2016-07-19 15:45:34]

rouslan@chromium.org changed reviewers:
+ esprehn@chromium.org

[please use gerrit instead, 2016-07-19 15:47:35]

I am not able to view http://crbug.com/629055. Can you open up the permissions
to reviewers? You can do this by adding the reviewer emails to CC list.

[xiaohai, 2016-07-20 01:42:00]

Description was changed from

==========
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

BUG=629055
==========

to

==========
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

[jiajia, 2016-07-20 02:25:43]

On 2016/07/19 15:47:35, Rouslan (ツ) wrote:
> I am not able to view http://crbug.com/629055. Can you open up the permissions
> to reviewers? You can do this by adding the reviewer emails to CC list.

Hi , I changed author email to my own and moved to new issue at
https://codereview.chromium.org/2167573003/.
Also I change a new bug issue. You can check it at codereview.

[xiaohai, 2016-07-20 02:42:00]

Description was changed from

==========
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

to

==========
I have moved to https://codereview.chromium.org/2167573003/。
code will be updated at new issue.
Thanks for understanding.
#####
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

[xiaohai, 2016-07-20 02:50:09]

Description was changed from

==========
I have moved to https://codereview.chromium.org/2167573003/。
code will be updated at new issue.
Thanks for understanding.
#####
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

to

==========
I have moved to https://codereview.chromium.org/2167573003/ according to
Roslyn's advice。
code will be updated at new issue.
Thanks for understanding.
#####
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

[xiaohai, 2016-07-20 02:55:06]

Description was changed from

==========
I have moved to https://codereview.chromium.org/2167573003/ according to
Roslyn's advice。
code will be updated at new issue.
Thanks for understanding.
#####
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

to

==========
I have moved to https://codereview.chromium.org/2167573003/, according to
Roslyn's advice .
code will be updated at new issue.
Thanks for understanding.

quote"
> I recommend that you re-upload the patch with your @alibaba-inc.com email.
> Alibaba employees are already allowed to submit patches to Chromium. If you
must
> use your @gmail.com email, then please sign the individual agreement in
> https://cla.developers.google.com/.
> 
> Whichever method your choose, please put your email address and name in the
> AUTHORS file:
> 
> https://cs.chromium.org/chromium/src/AUTHORS"

########
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

[xiaohai, 2016-07-20 02:56:01]

Description was changed from

==========
I have moved to https://codereview.chromium.org/2167573003/, according to
Roslyn's advice .
code will be updated at new issue.
Thanks for understanding.

quote"
> I recommend that you re-upload the patch with your @alibaba-inc.com email.
> Alibaba employees are already allowed to submit patches to Chromium. If you
must
> use your @gmail.com email, then please sign the individual agreement in
> https://cla.developers.google.com/.
> 
> Whichever method your choose, please put your email address and name in the
> AUTHORS file:
> 
> https://cs.chromium.org/chromium/src/AUTHORS"

########
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========

to

==========
I have moved to https://codereview.chromium.org/2167573003/, according to
Roslyn's advice .
code will be updated at new issue.
Thanks for understanding.

quote"
> I recommend that you re-upload the patch with your @alibaba-inc.com email.
> Alibaba employees are already allowed to submit patches to Chromium. If you
must
> use your @gmail.com email, then please sign the individual agreement in
> https://cla.developers.google.com/.
> 
> Whichever method your choose, please put your email address and name in the
> AUTHORS file:
> 
> https://cs.chromium.org/chromium/src/AUTHORS
"

########
Verify intent signatures.

This patch adds one step to verify the signature in intent
for chrome while the intent has a scheme for the app.

To test, start a website which contains a scheme intent in
chrome, one intent case contains official app signature,
it can start activity in app, and one another intent case
contains fake app signature, chrome won't start activity of
the fake app.

For example, original intent:

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;package=com.eg.oandroid.AlipayGphone;end

More secure intent (additional sha256):

intent://platformapi/startapp?appId=20000001&_t=1468848794586#Intent;scheme=alipays;sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A;package=com.eg.android.AlipayGphone;end

And we now extend this feature to support apps contain more than one signature.
sha256 param in intent scheme can concat by "," as same package name and "|" as
intended target app.
such as
sha256=389B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A,123449F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF498A|5B9B49F7832F53E9017923220AA85E14DFAA4886ECD7428818BF339543CF499F；

BUG=629713
==========