Add HSTS support

src/Interceptor/Hsts/CombinationHstsJar.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+class CombinationHstsJar implements HstsJar
+{
+    /**
+     * @var ReadableHstsJar[]
+     */
+    private readonly array $jars;
+
+    public function __construct(ReadableHstsJar ...$jars)
+    {
+        $this->jars = $jars;
+    }
+
+    public function test(string $host): bool
+    {
+        foreach ($this->jars as $jar) {
+            if ($jar->test($host)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Registers into first HSTS jar that is not read-only.
+     */
+    public function register(string $host, bool $includeSubDomains = false): void
+    {
+        foreach ($this->jars as $jar) {
+            if ($jar instanceof HstsJar) {
+                $jar->register($host, $includeSubDomains);
+                return;
+            }
+        }
+    }
+
+    /**
+     * Unregisters from all HSTS jars.
+     */
+    public function unregister(string $host): void
+    {
+        foreach ($this->jars as $jar) {
+            if ($jar instanceof HstsJar) {
+                $jar->unregister($host);
+                return;
+            }
+        }
+    }
+}

src/Interceptor/Hsts/GooglePreloadListJar.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+final class GooglePreloadListJar extends ReadOnlyHstsJar
+{
+    public function __construct()
+    {
+        $jar = new InMemoryHstsJar();
+        $entries = \json_decode(\file_get_contents(__DIR__ . "/transport_security_state_static.json"), associative: true)["entries"];
+        foreach ($entries as $entry) {
+            if (($entry["mode"] ?? null) === "force-https") {
+                $jar->register($entry["name"], $entry["include_subdomains"] ?? false);
+            }
+        }
+        parent::__construct($jar);
+    }
+}

src/Interceptor/Hsts/HstsInterceptor.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+use Amp\Cancellation;
+use Amp\Http\Client\ApplicationInterceptor;
+use Amp\Http\Client\DelegateHttpClient;
+use Amp\Http\Client\Request;
+use Amp\Http\Client\Response;
+
+final class HstsInterceptor implements ApplicationInterceptor
+{
+    public function __construct(private readonly ReadableHstsJar $hstsJar)
+    {
+    }
+
+    public function request(Request $request, Cancellation $cancellation, DelegateHttpClient $httpClient): Response
+    {
+        if ($request->getUri()->getScheme() === "http" && $this->hstsJar->test($request->getUri()->getHost())) {
+            $request->setUri($request->getUri()->withScheme("https"));
+        }
+        $response = $httpClient->request($request, $cancellation);
+        if ($strictTransportSecurity = $response->getHeader("Strict-Transport-Security")) {
+            $directives = \array_map(trim(...), \explode(";", $strictTransportSecurity));
+            $includeSubDomains = false;
+            $remove = false;
+            foreach ($directives as $directive) {
+                if ($directive === "includeSubDomains") {
+                    $includeSubDomains = true;
+                } elseif ($directive === "max-age=0") {
+                    $remove = true;
+                }
+            }
+            if ($this->hstsJar instanceof HstsJar) {
+                if ($remove) {
+                    $this->hstsJar->unregister($request->getUri()->getHost());
+                } else {
+                    $this->hstsJar->register($request->getUri()->getHost(), $includeSubDomains);
+                }
+            }
+        }
+        return $response;
+    }
+}

src/Interceptor/Hsts/HstsJar.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+interface HstsJar extends ReadableHstsJar
+{
+    /**
+     * Mark a host as HSTS.
+     * @param bool $includeSubDomains Whether the includeSubDomains directive was specified
+     */
+    public function register(string $host, bool $includeSubDomains = false): void;
+
+    /**
+     * Un-mark a host as HSTS, if it exists.
+     */
+    public function unregister(string $host): void;
+}

src/Interceptor/Hsts/InMemoryHstsJar.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+final class InMemoryHstsJar implements HstsJar
+{
+    /**
+     * Array of host to either true (includeSubDomain) or false (no includeSubDomain).
+     * @var array<string,bool>
+     */
+    private array $hosts = [];
+
+    public function test(string $host, bool $requireIncludeSubDomains = false): bool
+    {
+        if (
+            // Host must have been marked HSTS
+            \array_key_exists($host, $this->hosts) &&
+            // If "includeSubDomains" is required, it must be marked as such
+            (!$requireIncludeSubDomains || $this->hosts[$host])
+        ) {
+            return true;
+        }
+        if (($dotPosition = \strpos($host, ".")) !== false) {
+            // Test if a parent domain has been registered with includeSubDomains
+            return $this->test(\substr($host, $dotPosition + 1), true);
+        }
+        return false;
+    }
+
+    public function register(string $host, bool $includeSubDomains = false): void
+    {
+        $this->hosts[$host] = $includeSubDomains;
+    }
+
+    public function unregister(string $host): void
+    {
+        unset($this->hosts[$host]);
+    }
+}

src/Interceptor/Hsts/ReadOnlyHstsJar.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+class ReadOnlyHstsJar implements ReadableHstsJar
+{
+    public function __construct(private ReadableHstsJar $proxyJar)
+    {
+    }
+
+    public function test(string $host): bool
+    {
+        return $this->proxyJar->test($host);
+    }
+}

src/Interceptor/Hsts/ReadableHstsJar.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace Amp\Http\Client\Interceptor\Hsts;
+
+interface ReadableHstsJar
+{
+    /**
+     * Test whether a host is registered as HSTS.
+     */
+    public function test(string $host): bool;
+}