redirect parametri tekshirilmaysa — hujumchi site.uz havolasini zararli.uz ga yo'naltiradi. Foydalanuvchi domen ishonchi bilan kirsak, phishing va o'g'irlikka uchun ishlatiladi.

// XAVFLI
res.redirect(req.query.next);        // hujum: next=https://zararli.uz

// TO'G'RI
const ALLOW = new Set(['/dashboard','/profile','/orders']);
const next = req.query.next;
if (!ALLOW.has(next)) return res.redirect('/');

Yana 2 xil himoya

// 1) relative-only
if (next.startsWith('/') && !next.startsWith('//')) ok = true;

// 2) domain allowlist
const u = new URL(next, 'https://site.uz');
if (u.origin === 'https://site.uz') ok = true;

# 1) redirect qo'ng'iroqlari
grep -rnE "res\.redirect|window\.location|location\.href|header\('Location" src/ | head

# 2) parametr nomlari
grep -rniE "next=|returnUrl|redirect_uri|continue|return_to|goto|url=" src/ templates/ 2>/dev/null | head

# 1) to'g'ridan-to'g'ri URL
for U in "https://zararli.uz" "//zararli.uz" "https://site.uz.zararli.uz" \
          "https:/\zararli.uz" "https:\\\\zararli.uz" "/\\zararli.uz" \
          "https://site.uz@zararli.uz" "https://zararli.uz/?x=https://site.uz"; do
  printf "  %-32s → " "$U"
  curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" \
    "https://site.uz/login?next=$(python3 -c "import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1]))" "$U")"
done

# 2) Location sarlavhasini ko'rish
curl -s -D- -o /dev/null "https://site.uz/login?next=https://zararli.uz" | grep -i location

# 3) login orqali (ko'p sayt shu yerda yo'naltiradi)
curl -s -D- -o /dev/null -X POST https://site.uz/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"sinov@site.uz","password":"x","next":"https://zararli.uz"}' \
  | grep -iE "location|set-cookie"

# 4) JS da tekshirish
curl -s "https://site.uz/login?next=-alert(1)-" | grep -oE "next[^,;]{0,40}"
curl -s "https://site.uz/login?next=javascript:alert(1)" | grep -i javascript

# 5) ichki o'tish (open redirect emas, lekin tekshiriladi)
curl -s -D- -o /dev/null "https://site.uz/redirect?next=/admin" | grep -i location

1. Yo'l (path) allowlist

const ALLOW = new Set(['/dashboard','/profile','/orders','/settings']);
const next = req.query.next;
if (typeof next !== 'string' || !ALLOW.has(next))
  return res.redirect('/');
// eng ishonchli: faqat ma'lum yo'llar

2. Agar URL kerak bo'lsa — origin tekshiruvi

function safeNext(raw, fallback = '/') {
  if (!raw) return fallback;
  const u = new URL(raw, 'https://site.uz');
  if (u.origin !== 'https://site.uz') return fallback;
  if (u.protocol === 'javascript:') return fallback;
  return u.pathname + u.search;
}

3. Taqiqlanadigan shakllar

const BAD = [
  /^\/\//,          //zararli.uz
  /^\/\\/,         /\zararli.uz
  /^\w+:/,          //javascript:, data:, https:
  /@/,               //site.uz@zararli.uz
  /%00/i, /[
]/   //null va yangi qator
];
if (BAD.some(r => r.test(raw))) return fail();

4. Link rel atributlari

<a href="https://site.uz/tashqi" rel="noopener noreferrer nofollow">Tashqi</a>

• `next` faqat yo'l (path) allowlist dan
• `//`, `/\`, `\`, `@`, `javascript:` rad etiladi
• Origin `https://site.uz` bilan solishtiriladi
• Login'dan keyingi redirect ham tekshiriladi
• Tashqi linklarda `rel="noopener"`
• `?next=https://zararli.uz` bilan test qilindi