Update proxy-xml.php

[alanEG]

Security improvement

[Reqrefusion]

@alanEG Thanks for your initial contribution. I had to do something like this because of cors. Actually, this code doesn't do anything. But I don't believe there should be any security for this.

[alanEG]

Hi, I added the whitelist to prevent SSRF and file system access via file://, which is possible with the original code. Even if it's only used for CORS, adding basic security helps prevent the server from being exposed to potential attacks.

[Copilot]

Pull Request Overview

This PR implements security improvements to the XML proxy by adding URL validation and whitelisting functionality to prevent potential SSRF (Server-Side Request Forgery) attacks.

• Introduces a whitelist-based approach to restrict allowed domains
• Adds URL safety validation function that checks both hostname and IP address against the whitelist
• Replaces direct URL validation with comprehensive security checks

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The gethostbyname() function can be exploited for DNS rebinding attacks and may resolve to internal IP addresses. Consider using a more secure approach that validates against private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and blocks localhost resolution.

[Copilot]

Using file_get_contents() without timeout or context options can lead to denial of service attacks through slow responses or large file downloads. Consider adding a stream context with timeout and size limits, or use cURL with proper configuration.

Suggested change

	echo $response;
	// Set a timeout of 5 seconds
	$context = stream_context_create([
	'http' => [
	'timeout' => 5
	]
	]);
	// Limit response size to 2MB
	$maxSize = 2 * 1024 * 1024; // 2MB
	$response = '';
	$handle = @fopen($url, 'r', false, $context);
	if ($handle) {
	while (!feof($handle) && strlen($response) < $maxSize) {
	$response .= fread($handle, 8192);
	}
	fclose($handle);
	if (strlen($response) >= $maxSize) {
	header('HTTP/1.1 413 Payload Too Large');
	echo "Response too large";
	} else {
	header('Content-Type: application/xml');
	echo $response;
	}
	} else {
	header('HTTP/1.1 502 Bad Gateway');
	echo "Failed to fetch URL";
	}

[maxwxyz]

is this good to go?

[alanEG]

Hey @maxwxyz,

Yeah, I made a few changes, and I would say it’s looking good to go.