✨ Enhance security and validation in CSS proxy handling 🛡️🔒

- Added access check for chat session to ensure only authorized users can proceed.
- Implemented validation for co-browse session URL to prevent unauthorized access.
- Added checks to ensure CSS URL belongs to the co-browse session origin.
- Introduced validation to reject private or loopback IP addresses for CSS downloads.

Author: remdex

lhc_web/modules/lhcobrowse/proxycss.php

@@ -12,9 +12,17 @@
     $browse = erLhcoreClassCoBrowse::getBrowseInstanceByOnlineUser($ouser);
 } else {
     $chat = erLhcoreClassChat::getSession()->load('erLhcoreClassModelChat', $Params['user_parameters']['chat_id']);
+    if (!erLhcoreClassChat::hasAccessToRead($chat)) {
+        exit;
+    }
     $browse = erLhcoreClassCoBrowse::getBrowseInstance($chat);
 }
 
+// Require a co-browse session URL to bind the fetch origin
+if (empty($browse->url)) {
+    exit;
+}
+
 $base = trim($_GET['base']);
 
 if (!filter_var($base, FILTER_VALIDATE_URL)) {
@@ -28,6 +36,14 @@
     exit;
 }
 
+// Bind to the co-browse session origin
+$browseUrl = parse_url($browse->url);
+$browseOrigin = ($browseUrl['scheme'] ?? '') . '://' . ($browseUrl['host'] ?? '') . (isset($browseUrl['port']) ? ':' . $browseUrl['port'] : '');
+$requestOrigin = $url['scheme'] . '://' . $url['host'] . (isset($url['port']) ? ':' . $url['port'] : '');
+if ($browseOrigin !== $requestOrigin) {
+    exit;
+}
+
 // Some basic validation
 if (isset($url['host']) && $url['host'] != '' && strpos($_GET['css'], erLhcoreClassSystem::getHost()) === false) {
 
@@ -52,9 +68,28 @@
             exit;
         }
 
+        // CSS URL must belong to the co-browse session origin
+        $cssOrigin = $urlCSS['scheme'] . '://' . $urlCSS['host'] . (isset($urlCSS['port']) ? ':' . $urlCSS['port'] : '');
+        if ($cssOrigin !== $browseOrigin) {
+            exit;
+        }
+
         $urlCSSDownload = $_GET['css'];
     }
 
+    // Resolve host and reject private/loopback destinations
+    $downloadHost = parse_url($urlCSSDownload, PHP_URL_HOST);
+    if ($downloadHost === null || $downloadHost === '') {
+        exit;
+    }
+    $resolvedIp = gethostbyname($downloadHost);
+    if ($resolvedIp === $downloadHost || !filter_var($resolvedIp, FILTER_VALIDATE_IP)) {
+        exit;
+    }
+    if (!filter_var($resolvedIp, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+        exit;
+    }
+
     $ch = curl_init();
     curl_setopt($ch, CURLOPT_URL, $urlCSSDownload);
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);