Xavfsizlik va ishonchlilik

// XAVFLI: foydalanuvchi boshqaning buyurtmasini ko'ra oladi
public function korsating(int $id): Buyurtma
{
    return $this->repozitoriy->toping($id);
}

GET /api/buyurtmalar/1043     ← boshqa mijozning buyurtmasi

// XAVFSIZ
public function korsating(int $id, Foydalanuvchi $joriy): Buyurtma
{
    $buyurtma = $this->repozitoriy->toping($id)
        ?? throw new TopilmadiIstisnosi();

    if (!$this->ruxsat->korishiMumkinmi($joriy, $buyurtma)) {
        throw new RuxsatYoq();
    }

    return $buyurtma;
}

// Markazlashtirilgan huquq siyosati
final class BuyurtmaSiyosati
{
    public function korishiMumkinmi(Foydalanuvchi $f, Buyurtma $b): bool
    {
        return $f->id === $b->mijozId
            || $f->rolBormi(Rol::Admin)
            || $f->rolBormi(Rol::Operator);
    }

    public function bekorQilaOladimi(Foydalanuvchi $f, Buyurtma $b): bool
    {
        if (!$this->korishiMumkinmi($f, $b)) {
            return false;
        }

        return $b->holat()->bekorQilishMumkinmi();
    }
}

// XAVFLI
$xesh = md5($parol);
$xesh = sha1($parol);
$xesh = hash('sha256', $parol);

// XAVFSIZ
$xesh = password_hash($parol, PASSWORD_DEFAULT);

if (password_verify($parol, $xesh)) {
    if (password_needs_rehash($xesh, PASSWORD_DEFAULT)) {
        $yangiXesh = password_hash($parol, PASSWORD_DEFAULT);
        $this->foydalanuvchilar->parolYangilang($id, $yangiXesh);
    }
}

// Maxfiy ma'lumotni shifrlash
final class Shifrlovchi
{
    public function __construct(private string $kalit) {}

    public function shifrlang(string $matn): string
    {
        $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
        $shifr = sodium_crypto_secretbox($matn, $nonce, $this->kalit);

        return base64_encode($nonce . $shifr);
    }

    public function ochiring(string $shifrlangan): string
    {
        $malumot = base64_decode($shifrlangan, true)
            ?: throw new ShifrlashXatosi('Noto\'g\'ri format');

        $nonce = substr($malumot, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
        $shifr = substr($malumot, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);

        return sodium_crypto_secretbox_open($shifr, $nonce, $this->kalit)
            ?: throw new ShifrlashXatosi('Ochib bo\'lmadi');
    }
}

// SQL inyeksiya
$sql = "SELECT * FROM mahsulotlar WHERE nomi = '{$_GET['q']}'";

// XAVFSIZ
$stmt = $pdo->prepare('SELECT * FROM mahsulotlar WHERE nomi = ?');
$stmt->execute([$_GET['q']]);

// Buyruq inyeksiyasi
system("convert {$fayl} -resize 200x200 {$natija}");

// XAVFSIZ
$jarayon = new Process(['convert', $fayl, '-resize', '200x200', $natija]);
$jarayon->run();

// XSS
echo "<div>Salom, {$foydalanuvchi->ism}!</div>";

// XAVFSIZ
echo '<div>Salom, ' . htmlspecialchars($foydalanuvchi->ism, ENT_QUOTES, 'UTF-8') . '!</div>';

// Shablon dvigateli avtomatik qochiradi
// Twig
{{ foydalanuvchi.ism }}          {# avtomatik qochiriladi #}
{{ matn|raw }}                    {# ehtiyot bo'ling! #}

// Xavfsiz bo'lmagan dizayn: parolni tiklash tokeni bashorat qilinadi
$token = md5($foydalanuvchi->email . time());

// XAVFSIZ
$token = bin2hex(random_bytes(32));
$xesh = hash('sha256', $token);

$this->repozitoriy->tokenSaqlang($foydalanuvchi->id, $xesh, '+1 hour');
// Foydalanuvchiga $token yuboriladi, bazada $xesh saqlanadi

// Ishlab chiqarish sozlamalari
ini_set('display_errors', '0');
ini_set('log_errors', '1');
error_reporting(E_ALL);

// Sessiya
ini_set('session.cookie_httponly', '1');
ini_set('session.cookie_secure', '1');
ini_set('session.cookie_samesite', 'Lax');
ini_set('session.use_strict_mode', '1');

# Xavfsizlik sarlavhalari
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'none'" always;

# Server ma'lumotini yashirish
server_tokens off;

# Maxfiy fayllarga kirishni to'sish
location ~ /\.(env|git|htaccess) {
    deny all;
    return 404;
}

composer audit
npm audit

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "composer"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5
    labels: ["bogliqliklar", "xavfsizlik"]

final class KirishServisi
{
    private const MAKS_URINISH = 5;
    private const BLOK_MUDDATI = 900;   // 15 daqiqa

    public function kiring(string $login, string $parol, string $ip): Sessiya
    {
        if ($this->urinishlar->bloklanganmi($ip, $login)) {
            throw new JudaKopUrinish(self::BLOK_MUDDATI);
        }

        $foydalanuvchi = $this->foydalanuvchilar->loginBoyicha($login);

        // Vaqt hujumidan himoya: foydalanuvchi topilmasa ham xesh hisoblanadi
        $xesh = $foydalanuvchi?->parolXesh
            ?? '$2y$12$soxta.xesh.vaqt.hujumidan.himoya.uchun.qollaniladi';

        if (!password_verify($parol, $xesh) || $foydalanuvchi === null) {
            $this->urinishlar->yozing($ip, $login, muvaffaqiyat: false);

            // Bir xil xabar - qaysi maydon noto'g'ri ekani oshkor bo'lmasin
            throw new NotogriMalumot();
        }

        if (!$foydalanuvchi->faolmi()) {
            throw new HisobBloklangan();
        }

        $this->urinishlar->tozalang($ip, $login);
        session_regenerate_id(true);      // sessiya fiksatsiyasidan himoya

        return $this->sessiyalar->yarating($foydalanuvchi);
    }
}

// Webhook imzosini tekshirish
public function webhookQabulQiling(Sorov $sorov): Javob
{
    $imzo = $sorov->sarlavha('X-Webhook-Imzo');
    $tana = $sorov->xomTana();

    $kutilgan = hash_hmac('sha256', $tana, $this->sir);

    if (!hash_equals($kutilgan, $imzo ?? '')) {
        $this->jurnal->warning('Noto\'g\'ri webhook imzosi', [
            'ip' => $sorov->ip(),
        ]);

        return new Javob(401);
    }

    // ...
}

// Xavfsizlik hodisalarini alohida yozing
$this->xavfsizlikJurnali->warning('kirish_muvaffaqiyatsiz', [
    'login' => $login,
    'ip'    => $ip,
    'agent' => $foydalanuvchiAgenti,
    'vaqt'  => time(),
]);

$this->xavfsizlikJurnali->critical('huquq_oshirish_urinishi', [
    'foydalanuvchi_id' => $joriy->id,
    'sorov_resurs'     => $resurs,
    'ip'               => $ip,
]);

// XAVFLI: foydalanuvchi istalgan manzilga so'rov yuborishi mumkin
$rasm = file_get_contents($_POST['rasm_url']);

rasm_url=http://169.254.169.254/latest/meta-data/     ← bulut metama
rasm_url=http://localhost:6379/                        ← ichki Redis
rasm_url=file:///etc/passwd                            ← fayl tizimi

// XAVFSIZ
final class TashqiRasmYuklovchi
{
    private const RUXSAT_SXEMALAR = ['http', 'https'];

    public function yuklang(string $url): string
    {
        $qismlar = parse_url($url) ?: throw new NotogriUrl($url);

        if (!in_array($qismlar['scheme'] ?? '', self::RUXSAT_SXEMALAR, true)) {
            throw new NotogriUrl('Faqat HTTP va HTTPS');
        }

        $ip = gethostbyname($qismlar['host']);

        if ($this->ichkiManzilmi($ip)) {
            throw new NotogriUrl('Ichki manzillarga ruxsat yo\'q');
        }

        return $this->http->get($url, [
            'timeout'         => 5,
            'max_redirects'   => 2,
            'max_hajm'        => 5 * 1024 * 1024,
        ]);
    }

    private function ichkiManzilmi(string $ip): bool
    {
        return !filter_var($ip, FILTER_VALIDATE_IP, [
            'flags' => FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE,
        ]);
    }
}

# .gitignore
.env
.env.*
!.env.example
*.pem
*.key
config/sirlar.php

# .env.example - qiymatlarsiz
APP_MUHIT=production
APP_KALIT=
DB_HOST=127.0.0.1
DB_BAZA=dokon
DB_FOYDALANUVCHI=
DB_PAROL=
TOLOV_API_KALIT=

# Sirlarni skanerlash
gitleaks detect --source . --verbose
trufflehog filesystem .

# CI da avtomatik tekshiruv
- name: Sirlarni skanerlash
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

final class ZanjirUzgich
{
    private const XATO_CHEGARASI = 5;
    private const OCHIQ_MUDDATI = 30;

    public function __construct(
        private KeshInterfeysi $kesh,
        private string $nom,
    ) {}

    public function bajaring(callable $amal, ?callable $zaxira = null): mixed
    {
        if ($this->ochiqmi()) {
            if ($zaxira !== null) {
                return $zaxira();
            }

            throw new XizmatMavjudEmas($this->nom);
        }

        try {
            $natija = $amal();
            $this->kesh->ochiring("uzgich:{$this->nom}:xatolar");

            return $natija;
        } catch (Throwable $xato) {
            $xatolar = (int) $this->kesh->oshiring("uzgich:{$this->nom}:xatolar");

            if ($xatolar >= self::XATO_CHEGARASI) {
                $this->kesh->saqlang("uzgich:{$this->nom}:ochiq", true, self::OCHIQ_MUDDATI);
            }

            throw $xato;
        }
    }

    private function ochiqmi(): bool
    {
        return (bool) $this->kesh->oling("uzgich:{$this->nom}:ochiq");
    }
}

$tavsiyalar = $uzgich->bajaring(
    amal: fn () => $this->tavsiyaXizmati->oling($mijozId),
    zaxira: fn () => $this->ommaboppMahsulotlar(),   // zaxira variant
);

final class QaytaUrinish
{
    public function bajaring(callable $amal, int $urinishlar = 3): mixed
    {
        $oxirgiXato = null;

        for ($i = 1; $i <= $urinishlar; $i++) {
            try {
                return $amal();
            } catch (VaqtinchalikXato $xato) {
                $oxirgiXato = $xato;

                if ($i < $urinishlar) {
                    // Eksponensial kechikish + tasodifiy qo'shimcha
                    $kutish = (2 ** $i) + random_int(0, 1000) / 1000;
                    usleep((int) ($kutish * 1_000_000));
                }
            }
        }

        throw $oxirgiXato;
    }
}

$javob = $this->http->get($url, [
    'connect_timeout' => 3,
    'timeout'         => 10,
]);

final class YukNazoratchisi
{
    private const MAKS_NAVBAT = 100;

    public function qabulQilaOlamizmi(): bool
    {
        return $this->navbat->uzunligi() < self::MAKS_NAVBAT;
    }
}

if (!$nazoratchi->qabulQilaOlamizmi()) {
    return new Javob(503, ['Retry-After' => '30']);
}

// Zaxira variant bilan ishlash
public function tavsiyalarOling(int $mijozId): array
{
    try {
        return $this->uzgich->bajaring(
            fn () => $this->tavsiyaXizmati->oling($mijozId)
        );
    } catch (Throwable $xato) {
        $this->jurnal->warning('Tavsiya xizmati ishlamadi', [
            'xato' => $xato->getMessage(),
        ]);

        // Sayt ishlashda davom etadi
        return $this->kesh->oling('ommabop_mahsulotlar') ?? [];
    }
}

final class FaylYuklovchi
{
    private const RUXSAT_TURLAR = ['image/jpeg', 'image/png', 'image/webp'];
    private const MAKS_HAJM = 5 * 1024 * 1024;

    public function yuklang(YuklanganFayl $fayl): string
    {
        if ($fayl->hajm() > self::MAKS_HAJM) {
            throw new FaylJudaKatta(self::MAKS_HAJM);
        }

        // MIME turini fayl mazmuni bo'yicha aniqlash (nom bo'yicha emas!)
        $tur = (new finfo(FILEINFO_MIME_TYPE))->file($fayl->vaqtinchalikYol());

        if (!in_array($tur, self::RUXSAT_TURLAR, true)) {
            throw new NotogriFaylTuri($tur);
        }

        // Rasm haqiqatan rasmmi?
        if (@getimagesize($fayl->vaqtinchalikYol()) === false) {
            throw new NotogriFaylTuri('Rasm emas');
        }

        // Yangi nom - foydalanuvchi nomini ishlatmang
        $nom = bin2hex(random_bytes(16)) . '.' . $this->kengaytma($tur);

        // Veb-ildizdan tashqarida saqlang
        $fayl->kochiring(self::YUKLAMALAR_YOLI . '/' . $nom);

        return $nom;
    }
}