Add HSTS support

src/Interceptor/Hsts/CombinationHstsJar.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+class CombinationHstsJar implements HstsJar
+{
+ /**
+ * @var ReadableHstsJar[]
+ */
+ private readonly array $jars;
+
+ public function __construct(ReadableHstsJar ...$jars)
+ {
+ $this->jars = $jars;
+ }
+
+ public function test(string $host): bool
+ {
+ foreach ($this->jars as $jar) {
+ if ($jar->test($host)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * Registers into first HSTS jar that is not read-only
+ */
+ public function register(string $host, bool $includeSubDomains = false): void
+ {
+ foreach ($this->jars as $jar) {
+ if ($jar instanceof HstsJar) {
+ $jar->register($host, $includeSubDomains);
+ return;
+ }
+ }
+ }
+
+ /**
+ * Unregisters from all HSTS jars
+ */
+ public function unregister(string $host): void
+ {
+ foreach ($this->jars as $jar) {
+ if ($jar instanceof HstsJar) {
+ $jar->unregister($host);
+ return;
+ }
+ }
+ }
+}

src/Interceptor/Hsts/GooglePreloadListJar.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+final class GooglePreloadListJar extends ReadOnlyHstsJar
+{
+ public function __construct()
+ {
+ $jar = new InMemoryHstsJar();
+ $entries = json_decode(file_get_contents(__DIR__ . "/transport_security_state_static.json"), associative: true)["entries"];
+ foreach ($entries as $entry) {
+ if (($entry["mode"] ?? null) === "force-https") {
+ $jar->register($entry["name"], $entry["include_subdomains"] ?? false);
+ }
+ }
+ parent::__construct($jar);
+ }
+}

src/Interceptor/Hsts/HstsInterceptor.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+use Amp\Cancellation;
+use Amp\Http\Client\ApplicationInterceptor;
+use Amp\Http\Client\DelegateHttpClient;
+use Amp\Http\Client\Request;
+use Amp\Http\Client\Response;
+
+final class HstsInterceptor implements ApplicationInterceptor
+{
+ public function __construct(private readonly ReadableHstsJar $hstsJar)
+ {
+ }
+
+ public function request(Request $request, Cancellation $cancellation, DelegateHttpClient $httpClient): Response
+ {
+ if ($request->getUri()->getScheme() === "http" && $this->hstsJar->test($request->getUri()->getHost())) {
+ $request->setUri($request->getUri()->withScheme("https"));
+ }
+ $response = $httpClient->request($request, $cancellation);
+ if ($strictTransportSecurity = $response->getHeader("Strict-Transport-Security")) {
+ $directives = array_map(trim(...), explode(";", $strictTransportSecurity));
+ $includeSubDomains = false;
+ $remove = false;
+ foreach ($directives as $directive) {
+ if ($directive === "includeSubDomains") {
+ $includeSubDomains = true;
+ } elseif ($directive === "max-age=0") {
+ $remove = true;
+ }
+ }
+ if ($this->hstsJar instanceof HstsJar) {
+ if ($remove) {
+ $this->hstsJar->unregister($request->getUri()->getHost());
+ } else {
+ $this->hstsJar->register($request->getUri()->getHost(), $includeSubDomains);
+ }
+ }
+ }
+ return $response;
+ }
+}

src/Interceptor/Hsts/HstsJar.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+interface HstsJar extends ReadableHstsJar
+{
+ /**
+ * Mark a host as HSTS
+ * @param bool $includeSubDomains Whether the includeSubDomains directive was specified
+ */
+ public function register(string $host, bool $includeSubDomains = false): void;
+
+ /**
+ * Un-mark a host as HSTS, if it exists
+ */
+ public function unregister(string $host): void;
+}

src/Interceptor/Hsts/InMemoryHstsJar.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+final class InMemoryHstsJar implements HstsJar
+{
+ /**
+ * Array of host to either true (includeSubDomain) or false (no includeSubDomain)
+ * @var array<string,bool>
+ */
+ private array $hosts = [];
+
+ public function test(string $host, bool $requireIncludeSubDomains = false): bool
+ {
+ if (
+ // Host must have been marked HSTS
+ array_key_exists($host, $this->hosts) &&
+ // If "includeSubDomains" is required, it must be marked as such
+ (!$requireIncludeSubDomains || $this->hosts[$host])
+ ) {
+ return true;
+ }
+ if (($dotPosition = strpos($host, ".")) !== false) {
+ // Test if a parent domain has been registered with includeSubDomains
+ return $this->test(substr($host, $dotPosition + 1), true);
+ }
+ return false;
+ }
+
+ public function register(string $host, bool $includeSubDomains = false): void
+ {
+ $this->hosts[$host] = $includeSubDomains;
+ }
+
+ public function unregister(string $host): void
+ {
+ unset($this->hosts[$host]);
+ }
+}

src/Interceptor/Hsts/ReadOnlyHstsJar.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+class ReadOnlyHstsJar implements ReadableHstsJar
+{
+ public function __construct(private ReadableHstsJar $proxyJar)
+ {
+ }
+
+ public function test(string $host): bool
+ {
+ return $this->proxyJar->test($host);
+ }
+}

src/Interceptor/Hsts/ReadableHstsJar.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+interface ReadableHstsJar
+{
+ /**
+ * Test whether a host is registered as HSTS
+ */
+ public function test(string $host): bool;
+}