Xavfsizlik

function ekranla(matn) {
    return String(matn)
        .replaceAll("&", "&")
        .replaceAll("<", "&lt;")
        .replaceAll(">", "&gt;")
        .replaceAll('"', "&quot;")
        .replaceAll("'", "&#39;");
}

const yomon = '<script>alert("xato")</script>';

console.log("Xom:", yomon);
console.log("Ekranlangan:", ekranla(yomon));
console.log("Skript qoldimi:", ekranla(yomon).includes("<script>"));

import { join, resolve, sep } from "node:path";

const ildiz = resolve("/var/www/ommaviy");

function xavfliYol(soralgan) {
    return join(ildiz, soralgan);
}

function xavfsizYol(soralgan) {
    const toliq = resolve(ildiz, soralgan);
    if (toliq !== ildiz && !toliq.startsWith(ildiz + sep)) {
        return null;
    }
    return toliq;
}

const yaxshi = "rasmlar/logo.png";
const yomon = "../../../etc/parol";

console.log("Xavfli, yaxshi so'rov:", xavfliYol(yaxshi));
console.log("Xavfli, yomon so'rov:", xavfliYol(yomon));
console.log("Xavfsiz, yaxshi so'rov:", xavfsizYol(yaxshi));
console.log("Xavfsiz, yomon so'rov:", xavfsizYol(yomon));

import express from "express";

const app = express();

function cheklov({ oyna, chegara }) {
    const urinishlar = new Map();
    let soat = 0;

    const qatlam = (sorov, javob, keyingi) => {
        const kalit = sorov.ip ?? "nomalum";
        const yozuv = urinishlar.get(kalit) ?? { soni: 0, boshi: soat };

        if (soat - yozuv.boshi >= oyna) {
            yozuv.soni = 0;
            yozuv.boshi = soat;
        }

        yozuv.soni++;
        urinishlar.set(kalit, yozuv);

        if (yozuv.soni > chegara) {
            javob.status(429).json({ xato: "juda ko'p so'rov" });
            return;
        }
        keyingi();
    };

    qatlam.soatniSur = (n) => { soat += n; };
    return qatlam;
}

const cheklagich = cheklov({ oyna: 60, chegara: 3 });
app.use(cheklagich);
app.get("/", (s, j) => j.json({ holat: "yaxshi" }));

const server = app.listen(0);
const port = server.address().port;
const asos = `http://localhost:${port}/`;

const holatlar = [];
for (let i = 0; i < 5; i++) {
    holatlar.push((await fetch(asos)).status);
}
console.log("Besh so'rov:", holatlar.join(", "));

cheklagich.soatniSur(61);
console.log("Oyna tugagach:", (await fetch(asos)).status);

server.close();

import express from "express";

const app = express();

app.disable("x-powered-by");

app.use((sorov, javob, keyingi) => {
    javob.set({
        "X-Content-Type-Options": "nosniff",
        "X-Frame-Options": "DENY",
        "Referrer-Policy": "no-referrer",
        "Content-Security-Policy": "default-src 'self'",
    });
    keyingi();
});

app.get("/", (s, j) => j.json({ holat: "yaxshi" }));

const server = app.listen(0);
const port = server.address().port;

const javob = await fetch(`http://localhost:${port}/`);

console.log("x-powered-by:", javob.headers.get("x-powered-by"));
console.log("nosniff:", javob.headers.get("x-content-type-options"));
console.log("frame:", javob.headers.get("x-frame-options"));
console.log("csp bor:", javob.headers.has("content-security-policy"));

server.close();

const sozlama = {
    port: process.env.PORT ?? "3000",
    bazaUrl: process.env.BAZA_URL ?? "sqlite::memory:",
    maxfiyKalit: process.env.MAXFIY_KALIT ?? null,
};

function xavfsizKorinish(s) {
    return {
        ...s,
        maxfiyKalit: s.maxfiyKalit ? "***" : null,
    };
}

console.log(xavfsizKorinish(sozlama));

if (!sozlama.maxfiyKalit) {
    console.log("Ogohlantirish: MAXFIY_KALIT berilmagan");
}