{"id":26801,"date":"2026-07-16T06:34:22","date_gmt":"2026-07-16T06:34:22","guid":{"rendered":"https:\/\/umang.pk\/2026\/07\/16\/node-js-%d9%85%db%8c%da%ba-%d8%b9%d8%a7%d9%85-%d9%88%db%8c%d8%a8-%d8%a7%db%8c%d9%be%d9%84%db%8c%da%a9%db%8c%d8%b4%d9%86-%d8%b3%db%8c%da%a9%db%8c%d9%88%d8%b1%d9%b9%db%8c-%da%a9%d9%85%d8%b2%d9%88%d8%b1\/"},"modified":"2026-07-16T06:34:22","modified_gmt":"2026-07-16T06:34:22","slug":"node-js-%d9%85%db%8c%da%ba-%d8%b9%d8%a7%d9%85-%d9%88%db%8c%d8%a8-%d8%a7%db%8c%d9%be%d9%84%db%8c%da%a9%db%8c%d8%b4%d9%86-%d8%b3%db%8c%da%a9%db%8c%d9%88%d8%b1%d9%b9%db%8c-%da%a9%d9%85%d8%b2%d9%88%d8%b1","status":"publish","type":"post","link":"https:\/\/umang.pk\/en_us\/2026\/07\/16\/node-js-%d9%85%db%8c%da%ba-%d8%b9%d8%a7%d9%85-%d9%88%db%8c%d8%a8-%d8%a7%db%8c%d9%be%d9%84%db%8c%da%a9%db%8c%d8%b4%d9%86-%d8%b3%db%8c%da%a9%db%8c%d9%88%d8%b1%d9%b9%db%8c-%da%a9%d9%85%d8%b2%d9%88%d8%b1\/","title":{"rendered":"Node.js \u0645\u06cc\u06ba \u0639\u0627\u0645 \u0648\u06cc\u0628 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u06d4"},"content":{"rendered":"\n<div id=\"\">\n<p>\u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0645\u06cc\u06ba \u0646\u0626\u06d2 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u0648 \u062d\u06cc\u0631\u0627\u0646 \u06a9\u0631 \u062f\u06cc\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0686\u06cc\u0632\u06cc\u06ba \u06cc\u06c1 \u06c1\u06cc\u06ba: \u0648\u06cc\u0628 \u06a9\u06cc \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0627\u06ba \u0646\u0641\u06cc\u0633 \u062d\u0645\u0644\u0648\u06ba \u06a9\u0627 \u0646\u062a\u06cc\u062c\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u06a9\u0648\u0688 \u06a9\u06d2 \u0646\u0645\u0648\u0646\u0648\u06ba \u0633\u06d2 \u0622\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u0628\u0627\u0644\u06a9\u0644 \u0645\u0639\u0642\u0648\u0644 \u0645\u0639\u0644\u0648\u0645 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062c\u06cc\u0633\u06d2 \u06cc\u0648 \u0622\u0631 \u0627\u06cc\u0644 \u06a9\u06cc \u0642\u062f\u0631 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u0646\u0627\u060c \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06d2 \u0628\u0627\u0688\u06cc \u06a9\u0648 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0627\u067e \u0688\u06cc\u0679 \u067e\u0631 \u0644\u0627\u06af\u0648 \u06a9\u0631\u0646\u0627\u060c \u06cc\u0627 \u062f\u0648 \u0633\u0648\u0627\u0644\u0627\u062a \u067e\u0631 \u0639\u0645\u0644 \u06a9\u0631\u0646\u0627 \u062c\u06c1\u0627\u06ba \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u06a9\u0627\u0641\u06cc \u06c1\u0648\u062a\u0627\u06d4<\/p>\n<p>\u06cc\u06c1 \u06af\u0627\u0626\u06cc\u0688 \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u0686\u06be \u0646\u0645\u0648\u0646\u0648\u06ba \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u06c1\u0631 \u0627\u06cc\u06a9 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0622\u067e \u0627\u06cc\u06a9 \u062a\u0631\u0645\u06cc\u0645 \u0634\u062f\u06c1 \u0648\u0631\u0698\u0646 \u062f\u06cc\u06a9\u06be \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0633 \u0645\u06cc\u06ba \u0627\u0635\u0644 \u06a9\u0648\u0688 \u06a9\u06cc \u0627\u06cc\u06a9 \u0645\u062b\u0627\u0644 \u0634\u0627\u0645\u0644 \u06c1\u06d2 \u062c\u0648 \u062e\u0637\u0631\u06d2 \u06a9\u0648 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0633 \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u062c\u0648 \u0627\u0633\u06d2 \u062e\u0637\u0631\u0646\u0627\u06a9 \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0646\u0648\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u06a9\u06cc\u0627 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u0627\u0648\u0631 \u06a9\u06cc\u0648\u06ba\u06d4<\/p>\n<p>\u06cc\u06c1\u0627\u06ba \u06a9\u0633\u06cc \u062d\u0641\u0627\u0638\u062a\u06cc \u067e\u0633 \u0645\u0646\u0638\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 Node.js \u0627\u0648\u0631 SQL \u0633\u06d2 \u06a9\u0686\u06be \u0648\u0627\u0642\u0641\u06cc\u062a \u062d\u0627\u0635\u0644 \u06a9\u0631\u0646\u0627 \u0645\u062f\u062f\u06af\u0627\u0631 \u062b\u0627\u0628\u062a \u06c1\u0648\u06af\u0627\u06d4<\/p>\n<h2 id=\"heading-prerequisites\">\u0634\u0631\u0637\u06cc\u06ba<\/h2>\n<p>\u0645\u062b\u0627\u0644\u0648\u06ba \u0633\u06d2 \u0627\u0646\u062f\u0627\u0632\u06c1 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u062f\u0631\u062c \u0630\u06cc\u0644 \u0633\u06d2 \u0648\u0627\u0642\u0641 \u06c1\u06cc\u06ba:<\/p>\n<ul>\n<li>\n<p>Node.js \u0627\u0648\u0631 Express.js \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f\u06cc \u0628\u0627\u062a\u06cc\u06ba<\/p>\n<\/li>\n<li>\n<p>SQL \u0627\u0633\u062a\u0641\u0633\u0627\u0631<\/p>\n<\/li>\n<li>\n<p>HTTP \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u06cc\u06ba \u0627\u0648\u0631 \u062c\u0648\u0627\u0628\u0627\u062a \u06a9\u06cc\u0633\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062a\u0648\u062b\u06cc\u0642 \u06a9\u06d2 \u0628\u0646\u06cc\u0627\u062f\u06cc \u062a\u0635\u0648\u0631\u0627\u062a (\u0633\u06cc\u0634\u0646\u060c \u0679\u0648\u06a9\u0646)<\/p>\n<\/li>\n<\/ul>\n<p><strong>\u06a9\u0648\u0688 \u06a9\u06cc \u0645\u062b\u0627\u0644\u0648\u06ba \u067e\u0631 \u0646\u0648\u0679\u0633<\/strong>: \u0627\u0633 \u067e\u0648\u0631\u06d2 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644 \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 <code>db.query()<\/code> \u0627\u06cc\u06a9 \u0641\u0631\u0636\u06cc \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0645\u062f\u062f\u06af\u0627\u0631 \u062c\u0648 \u0627\u06cc\u06a9 \u0642\u0637\u0627\u0631 \u0648\u0627\u0644\u06cc \u0686\u06cc\u0632 \u06a9\u0648 \u0644\u0648\u0679\u0627\u062a\u0627 \u06c1\u06d2\u06d4 <code>SELECT<\/code> \u0627\u0633\u062a\u0641\u0633\u0627\u0631 (\u06cc\u0627 <code>null<\/code> \u0627\u06af\u0631 \u0646\u06c1\u06cc\u06ba \u0645\u0644\u0627) \u0627\u0648\u0631 \u0646\u062a\u06cc\u062c\u06d2 \u0645\u06cc\u06ba \u0622\u0628\u062c\u06cc\u06a9\u0679 <code>INSERT<\/code>\/<code>UPDATE<\/code> \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06c1 <code>connection.query()<\/code> \u0631\u06cc\u0633 \u06a9\u06d2 \u062d\u0627\u0644\u0627\u062a \u06a9\u0627 \u0633\u06cc\u06a9\u0634\u0646 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a mysql2 \u0648\u0639\u062f\u06c1 API \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 <code>query()<\/code> \u0631\u067e\u0648\u0631\u0679 <code>[rows, fields]<\/code>. \u0622\u067e \u062c\u0648 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0688\u0631\u0627\u0626\u06cc\u0648\u0631 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0633 \u06a9\u06d2 \u0645\u0637\u0627\u0628\u0642 \u0646\u062d\u0648 \u06a9\u0648 \u0627\u06cc\u0688\u062c\u0633\u0679 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-table-of-contents\">\u0627\u0646\u0688\u06cc\u06a9\u0633<\/h2>\n<h2 id=\"heading-1-broken-access-control-and-idor\">1. \u0679\u0648\u0679\u0627 \u06c1\u0648\u0627 \u0631\u0633\u0627\u0626\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 \u0627\u0648\u0631 IDOR<\/h2>\n<p>\u0679\u0648\u0679\u0627 \u06c1\u0648\u0627 \u0631\u0633\u0627\u0626\u06cc \u06a9\u0646\u0679\u0631\u0648\u0644 2021 \u06a9\u06d2 \u0644\u06cc\u06d2 OWASP \u0679\u0627\u067e 10 \u0645\u06cc\u06ba \u0631\u06c1\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u062f\u06cc\u06a9\u06be\u0646\u0627 \u0645\u0634\u06a9\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 \u0634\u06a9\u0644 \u06c1\u06d2 <strong>\u063a\u06cc\u0631 \u0645\u062d\u0641\u0648\u0638 IDOR (\u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0622\u0628\u062c\u06cc\u06a9\u0679 \u062d\u0648\u0627\u0644\u06c1)<\/strong>: \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u06cc\u0648 \u0622\u0631 \u0627\u06cc\u0644 \u0645\u06cc\u06ba \u0688\u06cc\u0679\u0627\u0628\u06cc\u0633 \u0622\u0626\u06cc \u0688\u06cc \u06a9\u0648 \u0638\u0627\u06c1\u0631 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u060c \u0635\u0627\u0631\u0641 \u0646\u0645\u0628\u0631 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0686\u0627\u0646\u06a9 \u0648\u06c1 \u06a9\u0633\u06cc \u0627\u0648\u0631 \u06a9\u0627 \u0688\u06cc\u0679\u0627 \u062f\u06cc\u06a9\u06be \u0631\u06c1\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u0635\u0644\u0627\u062d\u0627\u062a \u0645\u0627\u0636\u06cc \u0645\u06cc\u06ba \u0648\u0627\u0636\u062d \u0646\u0638\u0631 \u0622\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u062a\u0627\u06c1\u0645\u060c \u06cc\u06c1 \u0627\u0628 \u0628\u06be\u06cc \u067e\u0631\u0648\u0688\u06a9\u0634\u0646 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06cc\u06c1 \u062a\u0635\u062f\u06cc\u0642 \u0627\u0648\u0631 \u0627\u062c\u0627\u0632\u062a \u06a9\u0648 \u0627\u0644\u062c\u06be\u0627 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0644\u0627\u06af \u0627\u0646 \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u0646\u0627 \u0627\u0633 \u0628\u0627\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u0645\u062e\u062a\u0644\u0641 \u06c1\u06d2 \u06a9\u06c1 \u0635\u0627\u0631\u0641 \u06a9\u0648 \u06a9\u0633\u06cc \u0645\u062e\u0635\u0648\u0635 \u0648\u0633\u0627\u0626\u0644 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0639\u0627\u0645 \u0635\u0627\u0631\u0641 \u067e\u0631\u0648\u0641\u0627\u0626\u0644 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u06a9\u0627\u062a \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.get('\/api\/users\/:id\/profile', authenticate, async (req, res) => {\n  const userId = req.params.id;\n\n  const user = await db.query(\n    'SELECT id, name, email, address FROM users WHERE id = ?',\n    [userId]\n  );\n\n  if (!user) {\n    return res.status(404).json({ error: 'User not found' });\n  }\n\n  res.json(user);\n});\n<\/code><\/pre>\n<p>\u06a9\u06c1 <code>authenticate<\/code> \u0645\u0688\u0644 \u0648\u06cc\u0626\u0631 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u062f\u0631\u0633\u062a \u0679\u0648\u06a9\u0646 \u06c1\u06d2\u06d4 \u062a\u0627\u06c1\u0645\u060c \u06cc\u06c1 \u0627\u0633 \u0628\u0627\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06a9\u06c1 \u0622\u06cc\u0627 \u0645\u0633\u062a\u0646\u062f \u0635\u0627\u0631\u0641 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0645\u0633\u062a\u0646\u062f \u0635\u0627\u0631\u0641 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 <code>\/api\/users\/1\/profile<\/code>\u060c <code>\/api\/users\/2\/profile<\/code>\u062f\u0648\u0633\u0631\u06d2 \u0635\u0627\u0631\u0641\u06cc\u0646 \u06a9\u0627 \u0688\u06cc\u0679\u0627 \u0628\u0627\u0632\u06cc\u0627\u0641\u062a \u06a9\u0631\u06cc\u06ba \u0648\u063a\u06cc\u0631\u06c1\u06d4<\/p>\n<h3 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>\u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u06cc\u06ba\u06d4 <em>\u0688\u0628\u0644\u06cc\u0648 \u0627\u06cc\u0686 \u0627\u0648<\/em> \u062a\u0645 \u06c1\u0648 \u0645\u0646\u0638\u0648\u0631\u06cc \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u06cc\u06ba\u06d4 <em>\u062c\u0648 \u0622\u067e \u06a9\u0648 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2\u06d4<\/em>. \u0627\u0648\u067e\u0631 \u0648\u0627\u0644\u0627 \u06a9\u0648\u0688 \u067e\u06c1\u0644\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u062f\u0648\u0633\u0631\u06d2 \u06a9\u0648 \u0645\u06a9\u0645\u0644 \u0637\u0648\u0631 \u067e\u0631 \u0686\u06be\u0648\u0691 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u062a\u0631\u062a\u06cc\u0628 \u0648\u0627\u0631 \u0639\u062f\u062f\u06cc IDs \u06a9\u0648 \u0645\u062a\u062c\u0633\u0633 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0633\u06cc \u062e\u0627\u0635 \u0679\u0648\u0644\u0632 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u0648\u06c1 \u0635\u0631\u0641 \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba <code>1<\/code> \u06a9\u0648 <code>2<\/code> URL \u0633\u06d2\u06d4 \u062a\u0627\u06c1\u0645\u060c \u0627\u06af\u0631 \u0645\u0644\u06a9\u06cc\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u063a\u0627\u0626\u0628 \u06c1\u06d2 \u062a\u0648 UUIDs \u06cc\u0627 slugs \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0628\u06be\u06cc \u06cc\u06c1\u06cc \u0645\u0633\u0626\u0644\u06c1 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u067e\u0631 \u0686\u06cc\u06a9 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0622\u06cc\u0627 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u0635\u0627\u0631\u0641 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u062f\u06c1 \u0648\u0633\u0627\u0626\u0644 \u06a9\u0627 \u0645\u0627\u0644\u06a9 \u06c1\u06d2 \u06cc\u0627 \u0627\u0633\u06d2 \u0627\u0633 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u06a9\u06cc \u0648\u0627\u0636\u062d \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.get('\/api\/users\/:id\/profile', authenticate, async (req, res) => {\n  \/\/ Reject anything that isn't a string of digits \u2014 parseInt(\"12abc\") would return 12\n  if (!\/^\\d+$\/.test(req.params.id)) {\n    return res.status(400).json({ error: 'Invalid user ID' });\n  }\n\n  const requestedId = Number(req.params.id);\n\n  if (requestedId < 1) {\n    return res.status(400).json({ error: 'Invalid user ID' });\n  }\n\n  \/\/ The authenticated user's ID is set by the authenticate middleware\n  const authenticatedId = req.user.id;\n\n  \/\/ Enforce ownership: users can only access their own profile\n  if (requestedId !== authenticatedId) {\n    return res.status(403).json({ error: 'Forbidden' });\n  }\n\n  const user = await db.query(\n    'SELECT id, name, email, address FROM users WHERE id = ?',\n    [requestedId]\n  );\n\n  if (!user) {\n    return res.status(404).json({ error: 'User not found' });\n  }\n\n  res.json(user);\n});\n<\/code><\/pre>\n<p>\u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679\u0633 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062c\u0648 \u0642\u0627\u0646\u0648\u0646\u06cc \u0637\u0648\u0631 \u067e\u0631 \u062a\u0645\u0627\u0645 \u0635\u0627\u0631\u0641\u06cc\u0646 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u06a9\u0631\u062f\u0627\u0631 \u067e\u0631 \u0645\u0628\u0646\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0648 \u0646\u0627\u0641\u0630 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Admin endpoint with explicit role check\napp.get('\/api\/admin\/users\/:id', authenticate, requireRole('admin'), async (req, res) => {\n  if (!\/^\\d+$\/.test(req.params.id)) {\n    return res.status(400).json({ error: 'Invalid user ID' });\n  }\n\n  const userId = Number(req.params.id);\n\n  const user = await db.query(\n    'SELECT id, name, email, role FROM users WHERE id = ?',\n    [userId]\n  );\n\n  if (!user) {\n    return res.status(404).json({ error: 'User not found' });\n  }\n\n  res.json(user);\n});\n<\/code><\/pre>\n<p>\u06cc\u06c1\u0627\u06ba \u06a9\u06cc\u0627 \u062a\u0628\u062f\u06cc\u0644 \u06c1\u0648\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u06a9\u06cc\u0648\u06ba:<\/p>\n<ul>\n<li>\n<p><code>\/^\\d+$\/.test(req.params.id)<\/code>    \u06a9\u0633\u06cc \u0628\u06be\u06cc \u0686\u06cc\u0632 \u06a9\u0648 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u062e\u0627\u0644\u0635 \u0639\u062f\u062f\u06cc \u062a\u0627\u0631 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 <code>parseInt(\"12abc\", 10)<\/code> \u062e\u0627\u0645\u0648\u0634\u06cc \u0633\u06d2 \u0648\u0627\u067e\u0633 \u0622 \u062c\u0627\u0626\u06cc\u06ba \u06af\u06d2 <code>12<\/code> \u0627\u0648\u0631 \u0627\u0636\u0627\u0641\u06cc \u0679\u06cc\u0633\u0679 \u067e\u0627\u0633 \u06a9\u0631\u06cc\u06ba\u06d4 \u0628\u0627\u0642\u0627\u0639\u062f\u06c1 \u0627\u0638\u06c1\u0627\u0631 \u0627\u0633 \u06a9\u0648 \u0631\u0648\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p><code>Number(req.params.id)<\/code>    \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u062a\u0627\u0631\u0648\u06ba \u06a9\u0648 \u0645\u062d\u0641\u0648\u0638 \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u0646\u0645\u0628\u0631\u0648\u06ba \u0645\u06cc\u06ba \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u0648\u0627\u0632\u0646\u06c1 <code>requestedId !== authenticatedId<\/code> \u0645\u0644\u06a9\u06cc\u062a \u06a9\u0648 \u0646\u0627\u0641\u0630 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u06cc\u0646\u062c\u0645\u0646\u0679 \u0641\u0646\u06a9\u0634\u0646 \u0627\u06cc\u06a9 \u0639\u0644\u06cc\u062d\u062f\u06c1 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u06c1\u06d2 \u062c\u0633 \u06a9\u06d2 \u0627\u067e\u0646\u06d2 \u062a\u0635\u062f\u06cc\u0642\u06cc \u0686\u06cc\u06a9 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<\/ul>\n<p><strong>URL \u067e\u06cc\u0631\u0627\u0645\u06cc\u0679\u0631\u0632 \u0633\u06d2 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0627 \u0627\u0646\u062f\u0627\u0632\u06c1 \u0646\u06c1 \u0644\u06af\u0627\u0626\u06cc\u06ba\u06d4 \u0645\u0633\u062a\u0646\u062f \u0633\u06cc\u0634\u0646 \u0633\u06d2 \u0645\u0627\u062e\u0648\u0630\u06d4<\/strong><\/p>\n<h2 id=\"heading-2-mass-assignment\">2. \u0628\u0644\u06a9 \u0645\u062e\u062a\u0635<\/h2>\n<p>\u0628\u0644\u06a9 \u0627\u06cc\u0644\u0648\u06a9\u06cc\u0634\u0646 \u0627\u0646 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0648\u06ba \u0645\u06cc\u06ba \u0633\u06d2 \u0627\u06cc\u06a9 \u06c1\u06d2 \u062c\u0648 \u0644\u06a9\u06be\u062a\u06d2 \u0648\u0642\u062a \u0628\u0645\u0634\u06a9\u0644 \u0642\u0627\u0628\u0644 \u062a\u0648\u062c\u06c1 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u0622\u067e \u0645\u0648\u062b\u0631 \u06c1\u0648 \u0631\u06c1\u06d2 \u06c1\u06cc\u06ba\u060c \u0679\u06be\u06cc\u06a9 \u06c1\u06d2\u061f \u062c\u0628 \u0622\u067e \u067e\u0648\u0631\u06cc \u0622\u0628\u062c\u06cc\u06a9\u0679 \u06a9\u0648 \u067e\u0627\u0633 \u06a9\u0631\u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648 \u062f\u0633\u062a\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u06a9\u06cc\u0648\u06ba \u0627\u0639\u0627\u062f\u06c1 \u06a9\u0631\u06cc\u06ba\u061f<\/p>\n<p>\u0645\u0633\u0626\u0644\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0679\u06cc\u0628\u0644 \u062c\u0627\u0646\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0635\u0627\u0631\u0641 \u06a9\u0648 \u06a9\u0646 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u0648 \u06a9\u0628\u06be\u06cc \u06c1\u0627\u062a\u06be \u0646\u06c1\u06cc\u06ba \u0644\u06af\u0627\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0635\u0627\u0631\u0641 \u067e\u0631\u0648\u0641\u0627\u0626\u0644 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0627 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u06cc\u06c1 \u06c1\u06d2:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.put('\/api\/users\/me', authenticate, async (req, res) => {\n  const userId = req.user.id;\n\n  \/\/ req.body contains everything the client sends\n  const updates = req.body;\n\n  await db.query(\n    'UPDATE users SET ? WHERE id = ?',\n    [updates, userId]\n  );\n\n  res.json({ success: true });\n});\n<\/code><\/pre>\n<p>\u06a9\u06c1 <code>users<\/code> \u0679\u06cc\u0628\u0644 \u0645\u06cc\u06ba \u062f\u0631\u062c \u0630\u06cc\u0644 \u06a9\u0627\u0644\u0645 \u06c1\u06cc\u06ba:<\/p>\n<pre><code class=\"language-sql\">CREATE TABLE users (\n  id           INT PRIMARY KEY,\n  name         VARCHAR(100),\n  email        VARCHAR(100),\n  bio          TEXT,\n  role         ENUM('user', 'moderator', 'admin') DEFAULT 'user',\n  credits      INT DEFAULT 0,\n  is_banned    BOOLEAN DEFAULT false\n);\n<\/code><\/pre>\n<p>\u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u0627 \u0645\u0642\u0635\u062f \u0635\u0627\u0631\u0641\u06cc\u0646 \u06a9\u0648 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631\u0646\u0627 \u062a\u06be\u0627\u06d4 <code>name<\/code>\u060c <code>email<\/code>\u0627\u0648\u0631 <code>bio<\/code>. \u0644\u06cc\u06a9\u0646 <code>role<\/code>\u060c <code>credits<\/code>\u0627\u0648\u0631 <code>is_banned<\/code> \u06cc\u06c1 \u0628\u06be\u06cc \u0645\u06cc\u0632 \u067e\u0631 \u06c1\u06d2\u06d4 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0644\u0627\u0626\u0646\u0679 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u0628\u06be\u06cc\u062c\u06d2 \u06af\u0626\u06d2 \u062a\u0645\u0627\u0645 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u0648 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0627 \u0628\u0627\u0688\u06cc \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a SQL \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u0645\u06cc\u06ba \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u06a9\u06c1 <code>users<\/code> \u0627\u06cc\u06a9 \u0645\u06cc\u0632 \u0628\u06be\u06cc \u06c1\u06d2\u06d4 <code>role<\/code>\u060c <code>credits<\/code>\u0627\u0648\u0631 <code>is_banned<\/code> - \u0627\u0648\u0631 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u062c\u0627\u0646\u062a\u0627 \u06cc\u0627 \u0627\u0633 \u06a9\u06cc \u067e\u0631\u0648\u0627\u06c1 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0688\u0648\u06cc\u0644\u067e\u0631 \u06a9\u0646 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u0648 \u0628\u06d2 \u0646\u0642\u0627\u0628 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0635\u0627\u0631\u0641 \u0627\u0633\u06d2 \u0628\u06be\u06cc\u062c \u0631\u06c1\u0627 \u06c1\u06d2:<\/p>\n<pre><code class=\"language-json\">{\n  \"name\": \"Alice\",\n  \"role\": \"admin\",\n  \"credits\": 100000,\n  \"is_banned\": false\n}\n<\/code><\/pre>\n<p>\u0622\u067e \u06a9\u0648 \u0627\u0628\u06be\u06cc \u0645\u06cc\u0646\u06cc\u062c\u0631 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u062a\u0631\u0642\u06cc \u0645\u0644\u06cc \u06c1\u06d2\u060c \u0622\u067e \u06a9\u06cc \u067e\u0627\u0628\u0646\u062f\u06cc \u06c1\u0679\u0627 \u062f\u06cc \u06af\u0626\u06cc \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0622\u067e \u06a9\u0648 \u0627\u06cc\u06a9 \u0644\u0627\u06a9\u06be \u06a9\u0631\u06cc\u0688\u0679\u0633 \u0645\u0644\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u0648\u0627\u0636\u062d \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0641\u06cc\u0644\u0688 \u0628\u06c1 \u0641\u06cc\u0644\u0688 \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f \u067e\u0631 \u0627\u067e \u0688\u06cc\u0679 \u0627\u0634\u06cc\u0627\u0621 \u0628\u0646\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.put('\/api\/users\/me', authenticate, async (req, res) => {\n  const userId = req.user.id;\n\n  \/\/ Only these fields may be updated by the user\n  const ALLOWED_FIELDS = ['name', 'email', 'bio'];\n  const updates = {};\n\n  for (const field of ALLOWED_FIELDS) {\n    if (req.body[field] !== undefined) {\n      updates[field] = req.body[field];\n    }\n  }\n\n  if (Object.keys(updates).length === 0) {\n    return res.status(400).json({ error: 'No valid fields provided' });\n  }\n\n  \/\/ Validate individual fields\n  \/\/ isValidEmail is a simple helper: \/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$\/.test(email)\n  if (updates.email && !isValidEmail(updates.email)) {\n    return res.status(400).json({ error: 'Invalid email format' });\n  }\n\n  if (updates.name && (typeof updates.name !== 'string' || updates.name.length > 100)) {\n    return res.status(400).json({ error: 'Name must be a string of 100 characters or fewer' });\n  }\n\n  await db.query(\n    'UPDATE users SET ? WHERE id = ?',\n    [updates, userId]\n  );\n\n  res.json({ success: true });\n});\n<\/code><\/pre>\n<p>\u0627\u06cc\u0633\u06d2 \u0627\u0646\u062a\u0638\u0627\u0645\u06cc \u06a9\u0627\u0645\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u062c\u0648 \u062d\u0633\u0627\u0633 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u0648 \u0642\u0627\u0646\u0648\u0646\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u06a9\u06cc \u0627\u067e\u0646\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u06a9 \u0639\u0644\u06cc\u062d\u062f\u06c1 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Admin-only endpoint for changing user roles\napp.put('\/api\/admin\/users\/:id\/role', authenticate, requireRole('admin'), async (req, res) => {\n  if (!\/^\\d+$\/.test(req.params.id)) {\n    return res.status(400).json({ error: 'Invalid user ID' });\n  }\n\n  const userId = Number(req.params.id);\n  const { role } = req.body;\n\n  const VALID_ROLES = ['user', 'moderator', 'admin'];\n\n  if (!VALID_ROLES.includes(role)) {\n    return res.status(400).json({ error: 'Invalid role' });\n  }\n\n  await db.query(\n    'UPDATE users SET role = ? WHERE id = ?',\n    [role, userId]\n  );\n\n  res.json({ success: true });\n});\n<\/code><\/pre>\n<p><strong>\u0646\u06c1 \u067e\u06be\u06cc\u0644\u0627\u0624<\/strong> <code>req.body<\/code> <strong>\u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u06a9\u06d2 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u06d2 \u0633\u0627\u062a\u06be\u06d4 \u0641\u06cc\u0644\u0688 \u06a9\u06d2 \u0644\u062d\u0627\u0638 \u0633\u06d2 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u0641\u06cc\u0644\u0688\u0632 \u06a9\u0648 \u0627\u067e \u0688\u06cc\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/strong><\/p>\n<h2 id=\"heading-3-prototype-pollution\">3. \u067e\u0631\u0648\u0679\u0648\u0679\u0627\u0626\u067e \u0622\u0644\u0648\u062f\u06af\u06cc<\/h2>\n<p>\u067e\u0631\u0648\u0679\u0648\u0679\u0627\u0626\u067e \u0628\u062f\u0639\u0646\u0648\u0627\u0646\u06cc \u0627\u0633 \u0648\u0642\u062a \u06c1\u0648\u062a\u06cc \u06c1\u06d2 \u062c\u0628 \u0646\u0627\u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0688\u06cc\u0679\u0627 \u06a9\u0648 \u0628\u0627\u0631 \u0628\u0627\u0631 \u06a9\u0633\u06cc \u0622\u0628\u062c\u06cc\u06a9\u0679 \u0645\u06cc\u06ba \u0636\u0645 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0633 \u0633\u06d2 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u0648 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u0645\u06cc\u06ba \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u062f\u0627\u062e\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u0645\u0644\u062a\u06cc \u06c1\u06d2\u06d4 <code>Object.prototype<\/code> (\u0628\u06cc\u0633 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u062c\u0633 \u0633\u06d2 \u062a\u0645\u0627\u0645 \u0628\u0627\u0642\u0627\u0639\u062f\u06c1 \u062c\u0627\u0648\u0627 \u0627\u0633\u06a9\u0631\u067e\u0679 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u0648\u0631\u0627\u062b\u062a \u0645\u06cc\u06ba \u0645\u0644\u062a\u06d2 \u06c1\u06cc\u06ba)<\/p>\n<p>OWASP \u0679\u0627\u067e 10 \u0627\u0633 \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0633\u0627\u0641\u0679 \u0648\u06cc\u0626\u0631 \u0627\u0648\u0631 \u0688\u06cc\u0679\u0627 \u0627\u0646\u0679\u06cc\u06af\u0631\u06cc\u0679\u06cc \u0627\u06cc\u0631\u0631\u0632 (A08:2021)\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646 \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06cc \u0627\u0641\u0627\u062f\u06cc\u062a \u062c\u0648 \u0635\u0627\u0631\u0641 \u06a9\u06cc \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062f\u06c1 \u062a\u0631\u062a\u06cc\u0628\u0627\u062a \u06a9\u0648 \u0633\u0646\u0628\u06be\u0627\u0644\u062a\u06cc \u06c1\u06d2:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Vulnerable recursive merge function\nfunction mergeConfig(target, source) {\n  for (const key of Object.keys(source)) {\n    if (typeof source[key] === 'object' && source[key] !== null) {\n      if (!target[key]) target[key] = {};\n      mergeConfig(target[key], source[key]); \/\/ recursive call\n    } else {\n      target[key] = source[key]; \/\/ triggers __proto__ setter via bracket notation\n    }\n  }\n}\n\napp.post('\/api\/settings', authenticate, (req, res) => {\n  const userSettings = {};\n  mergeConfig(userSettings, req.body); \/\/ merge untrusted input\n  applySettings(userSettings);\n  res.json({ success: true });\n});\n<\/code><\/pre>\n<h3 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>\u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u0645\u0646\u062f\u0631\u062c\u06c1 \u0630\u06cc\u0644 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u06be\u06cc\u062c\u062a\u0627 \u06c1\u06d2:<\/p>\n<pre><code class=\"language-json\">{\n  \"__proto__\": {\n    \"isAdmin\": true\n  }\n}\n<\/code><\/pre>\n<p>\u062a\u06a9\u0631\u0627\u0631\u06cc <code>mergeConfig<\/code> \u0641\u0646\u06a9\u0634\u0646 \u06c1\u06d2 <code>__proto__<\/code> \u06a9\u0644\u06cc\u062f \u0627\u0648\u0631 \u0686\u0644\u0627\u0626\u06cc\u06ba <code>target['__proto__']['isAdmin'] = true<\/code>. \u06a9\u06cc\u0648\u0646\u06a9\u06c1 <code>__proto__<\/code> \u06cc\u06c1 JavaScript \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u067e\u0631\u0648\u0679\u0648 \u0679\u0627\u0626\u067e \u0627\u06cc\u06a9\u0633\u0631 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u06af\u0644\u06cc \u0628\u0627\u0631 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0644\u06a9\u06be\u0627 \u062c\u0627\u0626\u06d2 \u06af\u0627\u06d4 <code>Object.prototype<\/code>. \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06d2 \u0628\u0639\u062f:<\/p>\n<pre><code class=\"language-javascript\">const anyObject = {};\nconsole.log(anyObject.isAdmin); \/\/ true \u2014 inherited from Object.prototype\n<\/code><\/pre>\n<p>\u0686\u0644 \u0631\u06c1\u06cc \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0645\u06cc\u06ba \u062a\u0645\u0627\u0645 \u0639\u0627\u0645 \u0627\u0634\u06cc\u0627\u0621 \u0627\u0628 \u0648\u0631\u0627\u062b\u062a \u0645\u06cc\u06ba \u0645\u0644\u06cc \u06c1\u06cc\u06ba\u06d4 <code>isAdmin: true<\/code>. \u0627\u06af\u0631 \u0645\u0646\u0638\u0648\u0631\u06cc \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06c1\u06d2:<\/p>\n<pre><code class=\"language-javascript\">if (user.isAdmin) { \/* grant admin access *\/ }\n<\/code><\/pre>\n<p>\u0627\u0628 \u06cc\u06c1 \u0686\u06cc\u06a9 \u062a\u0645\u0627\u0645 \u0635\u0627\u0631\u0641\u06cc\u0646 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06af\u0632\u0631 \u062c\u0627\u0626\u06d2 \u06af\u0627 \u0686\u0627\u06c1\u06d2 \u0627\u0646 \u06a9\u06d2 \u0627\u0635\u0644 \u06a9\u0631\u062f\u0627\u0631 \u0633\u06d2 \u0642\u0637\u0639 \u0646\u0638\u0631\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u0635\u0627\u0631\u0641 \u06a9\u06cc \u062d\u0627\u0644\u062a \u06a9\u0648 \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u067e\u0631 \u0627\u0633\u0679\u0648\u0631 \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u06c1\u0631 \u0641\u06cc\u0644\u0688 \u06a9\u0648 \u0627\u0646\u0641\u0631\u0627\u062f\u06cc \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u0633\u062a \u06a9\u0631\u06cc\u06ba\u06d4 \u0646\u0627\u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0627\u0646 \u067e\u0679\u0633 \u06a9\u0648 \u0628\u0627\u0631 \u0628\u0627\u0631 \u0636\u0645 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u06af\u0631\u06cc\u0632 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.post('\/api\/settings', authenticate, async (req, res) => {\n  \/\/ Load current settings from the database \u2014 never from the client\n  const current = await db.query(\n    'SELECT theme, language, notifications FROM user_settings WHERE user_id = ?',\n    [req.user.id]\n  );\n\n  \/\/ Validate each field against an explicit allowlist\n  const safeSettings = {\n    theme: validateEnum(req.body.theme, ['light', 'dark'], current.theme),\n    language: validateEnum(req.body.language, ['en', 'es', 'fr', 'de'], current.language),\n    notifications: typeof req.body.notifications === 'boolean'\n      ? req.body.notifications\n      : current.notifications\n  };\n\n  await db.query(\n    'UPDATE user_settings SET ? WHERE user_id = ?',\n    [safeSettings, req.user.id]\n  );\n\n  res.json({ success: true });\n});\n\nfunction validateEnum(value, allowed, defaultValue) {\n  return allowed.includes(value) ? value : defaultValue;\n}\n<\/code><\/pre>\n<p>\u0627\u06af\u0631 \u0622\u067e \u06a9\u0648 \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06cc \u0627\u0641\u0627\u062f\u06cc\u062a \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u060c \u062a\u0648 \u0627\u0633\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba: <code>Object.create(null)<\/code> \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0637\u06d2 \u0634\u062f\u06c1 - \u0686\u0648\u0646\u06a9\u06c1 \u06a9\u0648\u0626\u06cc \u067e\u0631\u0648\u0679\u0648 \u0679\u0627\u0626\u067e \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 <code>__proto__<\/code> \u0648\u06c1 \u06a9\u0644\u06cc\u062f\u06cc\u06ba \u062c\u0648 \u062f\u0627\u063a\u062f\u0627\u0631 \u0627\u0648\u0631 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc \u062c\u0627 \u0633\u06a9\u062a\u06cc \u06c1\u06cc\u06ba:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Safe merge: base object with no prototype\nfunction safeMerge(allowedKeys, source) {\n  const result = Object.create(null); \/\/ no prototype = no pollution possible\n\n  for (const key of allowedKeys) {\n    if (key in source && typeof source[key] !== 'object') {\n      result[key] = source[key];\n    }\n  }\n\n  return result;\n}\n<\/code><\/pre>\n<p><strong>\u062d\u06a9\u0645\u0631\u0627\u0646\u06cc<\/strong>:<\/p>\n<ul>\n<li>\n<p>\u063a\u06cc\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u0645\u0646\u062f \u0627\u0646 \u067e\u0679 \u06a9\u0648 \u0628\u0627\u0642\u0627\u0639\u062f\u06c1 \u0627\u0634\u06cc\u0627\u0621 \u0645\u06cc\u06ba \u0628\u0627\u0631 \u0628\u0627\u0631 \u0636\u0645 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u06af\u0631\u06cc\u0632 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u0688 \u067e\u0631 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0627\u0633\u0679\u06cc\u0679 \u0627\u0633\u0679\u0648\u0631 \u06a9\u0631\u06cc\u06ba\u06d4 \u0627\u0633\u06d2 \u0644\u06d2 \u062c\u0627\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u067e\u0646\u06d2 \u06af\u0627\u06c1\u06a9\u0648\u06ba \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u0646\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba <code>Object.create(null)<\/code> \u0688\u06cc\u0679\u0627 \u06a9\u0646\u0679\u06cc\u0646\u0631\u0632 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062c\u0646 \u0645\u06cc\u06ba \u063a\u06cc\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u0645\u0646\u062f \u06a9\u0644\u06cc\u062f\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u06c1\u0631 \u0641\u06cc\u0644\u0688 \u06a9\u0648 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0642\u0633\u0645 \u0627\u0648\u0631 \u0627\u062c\u0627\u0632\u062a \u0634\u062f\u06c1 \u0627\u0642\u062f\u0627\u0631 \u06a9\u06d2 \u0644\u062d\u0627\u0638 \u0633\u06d2 \u062f\u0631\u0633\u062a \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<\/ul>\n<h2 id=\"heading-4-race-conditions\">4. \u0631\u06cc\u0633 \u06a9\u06d2 \u062d\u0627\u0644\u0627\u062a<\/h2>\n<p>\u0631\u06cc\u0633 \u06a9\u06cc \u062d\u0627\u0644\u062a \u0645\u0634\u06a9\u0644 \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u06a9\u0648\u0688 \u0628\u0627\u0644\u06a9\u0644 \u062f\u0631\u0633\u062a \u06c1\u06d2\u06d4 \u062c\u0648 \u0686\u06cc\u0632 \u0627\u0633\u06d2 \u062a\u0648\u0691\u062a\u06cc \u06c1\u06d2 \u0648\u06c1 \u0679\u0627\u0626\u0645\u0646\u06af \u06c1\u06d2\u06d4 \u062f\u0648 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u06cc\u06ba \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0627\u06cc\u06a9 \u06c1\u06cc \u0648\u0642\u062a \u067e\u0631 \u067e\u06c1\u0646\u0686\u062a\u06cc \u06c1\u06cc\u06ba\u060c \u062f\u0648\u0646\u0648\u06ba \u0627\u06cc\u06a9 \u062c\u06cc\u0633\u06cc \u0634\u0631\u0627\u0626\u0637 \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062f\u0648\u0646\u0648\u06ba \u062f\u0631\u0633\u062a \u0646\u062a\u0627\u0626\u062c \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u062f\u0648\u0646\u0648\u06ba \u0622\u06af\u06d2 \u0628\u0691\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0646\u062a\u06cc\u062c\u06d2 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631\u060c \u06a9\u0686\u06be \u062c\u0648 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u0628\u0627\u0631 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u0626\u06d2 \u062f\u0648 \u0628\u0627\u0631 \u06c1\u0648\u062a\u0627 \u06c1\u06d2.<\/p>\n<p>\u06cc\u06c1 \u06c1\u06d2 <strong>\u0686\u06cc\u06a9 \u06a9\u0631\u0646\u06d2 \u06a9\u0627 \u0648\u0642\u062a \u0628\u0645\u0642\u0627\u0628\u0644\u06c1 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0627 \u0648\u0642\u062a (TOCTOU)<\/strong> \u0645\u0633\u0626\u0644\u06c1: \u0645\u06cc\u06ba \u0646\u06d2 \u062c\u0633 \u062d\u06cc\u062b\u06cc\u062a \u06a9\u06cc \u062c\u0627\u0646\u0686 \u06a9\u06cc \u06c1\u06d2 \u0648\u06c1 \u0627\u0628 \u06a9\u0627\u0645 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u062d\u06cc\u062b\u06cc\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-pattern-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u067e\u06cc\u0679\u0631\u0646 \u06a9\u06cc \u0634\u0646\u0627\u062e\u062a \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0633\u0646\u06af\u0644 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0648\u067e\u0646 \u0631\u06cc\u0688\u0645\u067e\u0634\u0646 \u0627\u06cc\u0646\u0688 \u067e\u0648\u0627\u0626\u0646\u0679:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.post('\/api\/redeem-coupon', authenticate, async (req, res) => {\n  const { couponCode } = req.body;\n  const userId = req.user.id;\n\n  \/\/ Step 1: Check if the coupon is still valid\n  const coupon = await db.query(\n    'SELECT id, discount_amount, used FROM coupons WHERE code = ? AND used = false',\n    [couponCode]\n  );\n\n  if (!coupon) {\n    return res.status(400).json({ error: 'Invalid or already used coupon' });\n  }\n\n  \/\/ Time gap: another request can pass Step 1 here before Step 3 runs\n\n  \/\/ Step 2: Apply the discount\n  await applyDiscountToOrder(userId, coupon.discount_amount);\n\n  \/\/ Step 3: Mark coupon as used\n  await db.query(\n    'UPDATE coupons SET used = true, used_by = ? WHERE code = ?',\n    [userId, couponCode]\n  );\n\n  res.json({ success: true });\n});\n<\/code><\/pre>\n<h3 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p>\u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0627\u06cc\u06a9 \u06c1\u06cc \u0648\u0642\u062a \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u06c1\u06cc \u06a9\u0648\u067e\u0646 \u06a9\u0648\u0688 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u062f\u0648 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u06cc\u06ba \u067e\u06c1\u0646\u0686\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u062f\u0648\u0646\u0648\u06ba \u0644\u06cc\u0648\u0644 1 \u062a\u06a9 \u067e\u06c1\u0646\u0686 \u062c\u0627\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0633 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u06a9\u06c1 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0644\u06cc\u0648\u0644 3 \u062a\u06a9 \u067e\u06c1\u0646\u0686 \u062c\u0627\u0626\u06d2\u06d4 \u0645\u06cc\u06ba \u062f\u0648\u0646\u0648\u06ba \u06a9\u0648 \u067e\u0691\u06be\u062a\u0627 \u06c1\u0648\u06ba\u06d4 <code>used = false<\/code>. \u0631\u0639\u0627\u06cc\u062a \u062f\u0648\u0646\u0648\u06ba \u067e\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u06d4 \u0627\u06cc\u06a9 \u06a9\u0648\u067e\u0646 \u062f\u0648 \u0628\u0627\u0631 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u067e\u0691\u06be\u0646\u06d2 \u0644\u06a9\u06be\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u06c1\u06cc \u06a9\u06be\u0691\u06a9\u06cc \u06c1\u0631 \u062c\u06af\u06c1 \u0645\u0648\u062c\u0648\u062f \u06c1\u06d2\u06d4 \u06a9\u0679\u0648\u062a\u06cc\u0648\u06ba \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0628\u06cc\u0644\u0646\u0633 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u060c \u0628\u06a9\u0646\u06af \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0627\u0633\u0679\u0627\u06a9 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u060c \u0648\u0648\u0679 \u0628\u0691\u06be\u0627\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u06d4 \u06cc\u0627 \u062a\u0648 \u0627\u0633\u06cc \u0637\u0631\u062d \u0627\u0633\u062a\u062d\u0635\u0627\u0644 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0628\u0639\u062f\u060c \u06c1\u0645 \u0639\u0645\u0644\u062f\u0631\u0622\u0645\u062f \u06a9\u06d2 \u067e\u06cc\u0679\u0631\u0646 \u06a9\u0648 \u0627\u06cc\u0679\u0645 \u0622\u067e\u0631\u06cc\u0634\u0646 \u0645\u06cc\u06ba \u062a\u0628\u062f\u06cc\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u06cc\u0679\u0645 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u06a9\u06cc \u062a\u0627\u0632\u06c1 \u06a9\u0627\u0631\u06cc \u0627\u0633 \u0628\u0627\u062a \u06a9\u0648 \u06cc\u0642\u06cc\u0646\u06cc \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2 \u06a9\u06c1 \u062d\u0627\u0644\u062a \u06a9\u06cc \u062c\u0627\u0646\u0686 \u067e\u0691\u062a\u0627\u0644 \u0627\u0648\u0631 \u062a\u062d\u0631\u06cc\u0631\u06cc\u06ba \u0627\u06cc\u06a9 \u0648\u0627\u062d\u062f\u060c \u0646\u0627\u0642\u0627\u0628\u0644 \u062a\u0642\u0633\u06cc\u0645 \u0627\u06a9\u0627\u0626\u06cc \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.post('\/api\/redeem-coupon', authenticate, async (req, res) => {\n  const { couponCode } = req.body;\n  const userId = req.user.id;\n\n  const connection = await db.getConnection();\n\n  try {\n    await connection.beginTransaction();\n\n    \/\/ Atomic: only one request can update a row where used = false.\n    \/\/ The database row lock ensures only one request succeeds.\n    const [result] = await connection.query(\n      `UPDATE coupons\n       SET used = true, used_by = ?, used_at = NOW()\n       WHERE code = ? AND used = false`,\n      [userId, couponCode]\n    );\n\n    if (result.affectedRows === 0) {\n      await connection.rollback();\n      return res.status(400).json({ error: 'Invalid or already used coupon' });\n    }\n\n    const [couponRows] = await connection.query(\n      'SELECT discount_amount FROM coupons WHERE code = ?',\n      [couponCode]\n    );\n    const coupon = couponRows[0];\n\n    await applyDiscountToOrder(userId, coupon.discount_amount, connection);\n\n    await connection.commit();\n\n    res.json({ success: true, discount: coupon.discount_amount });\n\n  } catch (error) {\n    await connection.rollback();\n    console.error('Coupon redemption failed:', error);\n    res.status(500).json({ error: 'Could not process the coupon' });\n  } finally {\n    connection.release();\n  }\n});\n<\/code><\/pre>\n<p>\u06a9\u0644\u06cc\u062f\u06cc \u062a\u0628\u062f\u06cc\u0644\u06cc \u06c1\u06d2\u06d4 <code>UPDATE ... WHERE code = ? AND used = false<\/code>. \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0627\u067e \u0688\u06cc\u0679\u0633 \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u0642\u0637\u0627\u0631 \u06a9\u06d2 \u062a\u0627\u0644\u06d2 \u062d\u0627\u0635\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u06c1\u0645 \u0622\u06c1\u0646\u06af\u06cc \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0627\u0645\u06cc\u0627\u0628 \u06c1\u0648 \u0633\u06a9\u062a\u06cc \u06c1\u06d2\u06d4 \u062f\u0648\u0633\u0631\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06cc\u06c1 \u06c1\u06d2: <code>affectedRows = 0<\/code> \u063a\u0644\u0637\u06cc \u0644\u0648\u0679\u0627\u062a\u0627 \u06c1\u06d2 \u2014 \u062f\u0631\u0633\u062a \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2\u06d4<\/p>\n<p><strong>\u062c\u0628 \u0628\u06be\u06cc \u0622\u067e \u06a9\u0633\u06cc \u0642\u062f\u0631 \u06a9\u0648 \u0644\u06a9\u06be\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0641\u06cc\u0635\u0644\u06c1 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u067e\u0691\u06be\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u06cc\u06c1 \u0645\u0645\u06a9\u0646\u06c1 \u062f\u0648\u0691 \u06a9\u06cc \u0634\u0631\u0637 \u06c1\u06d2\u06d4 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u0627\u06cc\u06a9 \u062c\u0648\u06c1\u0631\u06cc \u062a\u062d\u0631\u06cc\u0631 \u06a9\u0631\u06cc\u06ba\u06d4<\/strong><\/p>\n<h2 id=\"heading-5-business-logic-flaws\">5. \u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0645\u0646\u0637\u0642 \u06a9\u06cc \u062e\u0631\u0627\u0628\u06cc\u06d4<\/h2>\n<p>\u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0645\u0646\u0637\u0642 \u06a9\u06d2 \u0646\u0642\u0627\u0626\u0635 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u0631\u0646\u0627 \u0633\u0628 \u0633\u06d2 \u0645\u0634\u06a9\u0644 \u0632\u0645\u0631\u06c1 \u06c1\u06d2\u06d4 \u0686\u0648\u0646\u06a9\u06c1 \u06a9\u0648\u0688 \u0628\u0627\u0644\u06a9\u0644 \u0644\u06a9\u06be\u0627 \u06c1\u0648\u0627 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u062e\u0648\u062f\u06a9\u0627\u0631 \u0627\u0633\u06a9\u06cc\u0646\u0631\u0632 \u0627\u0633\u06d2 \u0646\u06c1\u06cc\u06ba \u0688\u06be\u0648\u0646\u0688 \u067e\u0627\u0626\u06cc\u06ba \u06af\u06d2 \u0627\u0648\u0631 \u06a9\u0648\u0688 \u06a9\u06d2 \u062c\u0627\u0626\u0632\u06d2 \u0627\u0633 \u0633\u06d2 \u0645\u062d\u0631\u0648\u0645 \u06c1\u0648\u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0645\u0633\u0626\u0644\u06c1 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u06a9\u06c1 \u06a9\u0648\u0688 \u06a9\u06cc\u0633\u06d2 \u067e\u0631\u0641\u0627\u0631\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0628\u0644\u06a9\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0627\u0633\u06d2 \u06a9\u06cc\u0627 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0633\u0628 \u0633\u06d2 \u0639\u0627\u0645 \u0634\u06a9\u0644 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0645\u0624\u06a9\u0644 \u06a9\u0648 \u0645\u0639\u0642\u0648\u0644 \u0639\u062f\u062f\u06cc \u0627\u0642\u062f\u0627\u0631 \u0628\u06be\u06cc\u062c\u0646\u06d2 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p>\u0627\u06cc \u06a9\u0627\u0645\u0631\u0633 \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc \u06a9\u06d2 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u067e\u0648\u0627\u0626\u0646\u0679\u0633:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Vulnerable\napp.post('\/api\/checkout', authenticate, async (req, res) => {\n  const { items } = req.body;\n\n  let total = 0;\n  const processedItems = [];\n\n  for (const item of items) {\n    const product = await db.query(\n      'SELECT id, price FROM products WHERE id = ?',\n      [item.productId]\n    );\n\n    if (!product) {\n      return res.status(400).json({ error: `Product not found: ${item.productId}` });\n    }\n\n    \/\/ Trust the quantity value from the client\n    const itemTotal = product.price * item.quantity;\n    total += itemTotal;\n\n    processedItems.push({ productId: product.id, quantity: item.quantity, price: product.price });\n  }\n\n  if (total > 100) {\n    total = total * 0.9; \/\/ 10% discount\n  }\n\n  await createOrder(req.user.id, processedItems, total);\n  res.json({ success: true, total });\n});\n<\/code><\/pre>\n<h3 id=\"heading-why-this-matters\">\u06cc\u06c1 \u06a9\u06cc\u0648\u06ba \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/h3>\n<p><strong>\u0645\u0633\u0626\u0644\u06c1 1 - \u0645\u0646\u0641\u06cc \u0645\u0642\u062f\u0627\u0631\u06cc\u06ba<\/strong>:\u06a9\u0648\u0688 \u06cc\u06c1 \u062c\u0627\u0646\u0686\u06d2 \u0628\u063a\u06cc\u0631 \u06a9\u06c1 \u0622\u06cc\u0627 \u0645\u0642\u062f\u0627\u0631 \u0645\u062b\u0628\u062a \u06c1\u06d2\u060c \u0633\u0631\u0648\u0631 \u06a9\u06cc \u0642\u06cc\u0645\u062a \u06a9\u0648 \u06a9\u0644\u0627\u0626\u0646\u0679 \u06a9\u06cc \u0645\u0642\u062f\u0627\u0631 \u0633\u06d2 \u0636\u0631\u0628 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4 \u0635\u0627\u0631\u0641 \u0628\u06be\u06cc\u062c\u062a\u0627 \u06c1\u06d2\u06d4 <code>\"quantity\": -5<\/code> \u0645\u06c1\u0646\u06af\u06cc \u0627\u0634\u06cc\u0627\u0621 \u06a9\u0648\u06d4 \u0645\u062c\u0645\u0648\u0639\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0627\u0646 \u06a9\u06cc \u0634\u0631\u0627\u06a9\u062a \u0645\u0646\u0641\u06cc \u06c1\u0648 \u062c\u0627\u062a\u06cc \u06c1\u06d2\u060c \u062c\u0633 \u0633\u06d2 \u0645\u062c\u0645\u0648\u0639\u06cc \u0645\u062c\u0645\u0648\u0639\u06cc \u06a9\u0645 \u06c1\u0648 \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u0645\u0633\u0626\u0644\u06c1 2 - \u0641\u0644\u0648\u0679\u0646\u06af \u067e\u0648\u0627\u0626\u0646\u0679 \u0631\u06cc\u0627\u0636\u06cc<\/strong>: <code>0.1 + 0.2<\/code> \u062c\u0627\u0648\u0627 \u0627\u0633\u06a9\u0631\u067e\u0679 \u0645\u06cc\u06ba <code>0.30000000000000004<\/code>. \u0631\u0627\u0624\u0646\u0688\u0646\u06af \u06a9\u06d2 \u0628\u063a\u06cc\u0631\u060c \u0645\u0627\u0644\u06cc \u062d\u0633\u0627\u0628\u0627\u062a \u0645\u06cc\u06ba \u0648\u0642\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0633\u0627\u062a\u06be \u063a\u0644\u0637\u06cc\u0627\u06ba \u062c\u0645\u0639 \u06c1\u0648\u062a\u06cc \u0631\u06c1\u062a\u06cc \u06c1\u06cc\u06ba\u06d4<\/p>\n<p><strong>\u0645\u0633\u0626\u0644\u06c1 3 - \u0631\u0639\u0627\u06cc\u062a\u06cc \u06c1\u06cc\u0631\u0627 \u067e\u06be\u06cc\u0631\u06cc<\/strong>: \u0627\u06af\u0631 \u0627\u06cc\u06a9 \u0639\u0644\u06cc\u062d\u062f\u06c1 \u0627\u062e\u062a\u062a\u0627\u0645\u06cc \u0646\u0642\u0637\u06c1 \u0627\u062f\u0627\u0626\u06cc\u06af\u06cc \u06a9\u06d2 \u0628\u0639\u062f \u06a9\u0644 \u06a9\u0627 \u062f\u0648\u0628\u0627\u0631\u06c1 \u062d\u0633\u0627\u0628 \u0644\u06af\u0627\u0626\u06d2 \u0628\u063a\u06cc\u0631 \u0622\u0631\u0688\u0631 \u0645\u06cc\u06ba \u062a\u0631\u0645\u06cc\u0645 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0635\u0627\u0631\u0641 \u0631\u0639\u0627\u06cc\u062a \u062d\u0627\u0635\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0622\u0626\u0679\u0645\u0632 \u0634\u0627\u0645\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u067e\u06be\u0631 \u0631\u0639\u0627\u06cc\u062a\u06cc \u0642\u06cc\u0645\u062a \u06a9\u0648 \u0628\u0631\u0642\u0631\u0627\u0631 \u0631\u06a9\u06be\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0622\u0626\u0679\u0645\u0632 \u06a9\u0648 \u06c1\u0679\u0627 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-this-vulnerability\">\u0627\u0633 \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u0679\u06be\u06cc\u06a9 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/h3>\n<p>\u06cc\u06c1 \u062a\u0645\u0627\u0645 \u0639\u062f\u062f\u06cc \u0622\u062f\u0627\u0646\u0648\u06ba \u06a9\u0648 \u0686\u06cc\u06a9 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0633\u0631\u0648\u0631 \u06a9\u06cc \u0637\u0631\u0641 \u062a\u0645\u0627\u0645 \u0631\u0642\u0648\u0645 \u06a9\u0627 \u062f\u0648\u0628\u0627\u0631\u06c1 \u062d\u0633\u0627\u0628 \u0644\u06af\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0641\u0644\u0648\u0679\u0646\u06af \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u06cc \u063a\u0644\u0637\u06cc\u0648\u06ba \u0633\u06d2 \u0628\u0686\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u067e\u06cc\u0633\u06d2 (\u0633\u06cc\u0646\u0679\u0633) \u067e\u0631 \u0639\u062f\u062f\u06cc \u0631\u06cc\u0627\u0636\u06cc \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-javascript\">\/\/ Express.js - Secure\napp.post('\/api\/checkout', authenticate, async (req, res) => {\n  const { items } = req.body;\n\n  if (!Array.isArray(items) || items.length === 0) {\n    return res.status(400).json({ error: 'Cart must contain at least one item' });\n  }\n\n  if (items.length > 50) {\n    return res.status(400).json({ error: 'Cart cannot contain more than 50 items' });\n  }\n\n  let totalCents = 0; \/\/ Integer arithmetic avoids floating point errors\n  const processedItems = [];\n\n  for (const item of items) {\n    if (!\/^\\d+$\/.test(String(item.productId))) {\n      return res.status(400).json({ error: `Invalid product ID: ${item.productId}` });\n    }\n\n    const productId = Number(item.productId);\n\n    \/\/ Validate quantity: must be a string of digits only, between 1 and 10\n    \/\/ parseInt(\"3abc\", 10) returns 3 \u2014 we use regex to prevent this\n    if (!\/^\\d+$\/.test(String(item.quantity))) {\n      return res.status(400).json({\n        error: `Invalid quantity for product ${productId}`\n      });\n    }\n\n    const quantity = Number(item.quantity);\n\n    if (quantity < 1 || quantity > 10) {\n      return res.status(400).json({\n        error: `Quantity for product ${productId} must be between 1 and 10`\n      });\n    }\n\n    const product = await db.query(\n      'SELECT id, name, price_cents, stock FROM products WHERE id = ? AND active = true',\n      [productId]\n    );\n\n    if (!product) {\n      return res.status(400).json({ error: `Product not found: ${productId}` });\n    }\n\n    if (product.stock < quantity) {\n      return res.status(400).json({\n        error: `Insufficient stock for \"${product.name}\"`\n      });\n    }\n\n    \/\/ Use the server's price \u2014 never trust a price from the client\n    totalCents += product.price_cents * quantity;\n\n    processedItems.push({\n      productId: product.id,\n      name: product.name,\n      quantity,\n      unitPriceCents: product.price_cents\n    });\n  }\n\n  \/\/ Integer arithmetic for the discount calculation\n  const discountMultiplier = totalCents > 10000 ? 90 : 100; \/\/ 10000 cents = $100\n  const finalTotalCents = Math.round(totalCents * discountMultiplier \/ 100);\n\n  await createOrder(req.user.id, processedItems, finalTotalCents);\n\n  res.json({\n    success: true,\n    total: (finalTotalCents \/ 100).toFixed(2),\n    currency: 'USD'\n  });\n});\n<\/code><\/pre>\n<p>\u06a9\u06cc\u0627 \u0628\u062f\u0644\u0627 \u0627\u0648\u0631 \u06a9\u06cc\u0648\u06ba:<\/p>\n<ul>\n<li>\n<p>\u0627\u0646\u0679\u06cc\u062c\u0631 (\u0633\u06cc\u0646\u0679\u06cc) \u0631\u06cc\u0627\u0636\u06cc \u0641\u0644\u0648\u0679\u0646\u06af \u067e\u0648\u0627\u0626\u0646\u0679 \u06a9\u06cc \u063a\u0644\u0637\u06cc\u0648\u06ba \u06a9\u0648 \u062e\u062a\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 <code>10000 + 3000<\/code> \u0627\u0646\u0679\u06cc\u062c\u0631 \u0633\u06cc\u0646\u0679 \u06c1\u0645\u06cc\u0634\u06c1 \u062f\u0631\u0633\u062a \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><code>quantity < 1 || quantity > 10<\/code>    \u0645\u0646\u0641\u06cc \u0645\u0642\u062f\u0627\u0631 \u0627\u0648\u0631 \u063a\u06cc\u0631 \u0645\u0639\u0642\u0648\u0644 \u0628\u0691\u06d2 \u0622\u0631\u0688\u0631\u0632 \u0633\u06d2 \u067e\u0631\u06c1\u06cc\u0632 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><code>items.length > 50<\/code>    \u0628\u06c1\u062a \u0628\u0691\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u0648\u06ba \u0633\u06d2 \u067e\u0631\u06c1\u06cc\u0632 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p><code>product.stock < quantity<\/code>    \u06cc\u0642\u06cc\u0646\u06cc \u0628\u0646\u0627\u0626\u06cc\u06ba \u06a9\u06c1 \u0622\u067e \u06a9\u06d2 \u0622\u0631\u0688\u0631\u0632 \u062f\u0633\u062a\u06cc\u0627\u0628 \u0627\u0646\u0648\u06cc\u0646\u0679\u0631\u06cc \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u062a\u0645\u0627\u0645 \u0679\u0648\u0679\u0644\u060c \u0686\u06be\u0648\u0679 \u0627\u0648\u0631 \u062d\u062a\u0645\u06cc \u0642\u06cc\u0645\u062a\u0648\u06ba \u06a9\u0627 \u062d\u0633\u0627\u0628 \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u0642\u06cc\u0645\u062a\u0648\u06ba \u06a9\u06cc \u0628\u0646\u06cc\u0627\u062f \u067e\u0631 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/li>\n<\/ul>\n<p><strong>\u06a9\u0633\u06cc \u0628\u06be\u06cc \u0639\u062f\u062f\u06cc \u0627\u0646 \u067e\u0679 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u062f\u0631\u0633\u062a \u0631\u06cc\u0646\u062c \u06a9\u06cc \u0648\u0636\u0627\u062d\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u062a\u0645\u0627\u0645 \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u0679\u0648\u0679\u0644 \u06a9\u0627 \u062f\u0648\u0628\u0627\u0631\u06c1 \u062d\u0633\u0627\u0628 \u0644\u06af\u0627\u0626\u06cc\u06ba\u06d4 \u06af\u0627\u06c1\u06a9 \u0642\u06cc\u0645\u062a \u06cc\u0627 \u0645\u0642\u062f\u0627\u0631 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0630\u0631\u06cc\u0639\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4<\/strong><\/p>\n<h2 id=\"heading-6-jwt-misconfiguration\">6. JWT \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646 \u06a9\u06cc \u062e\u0631\u0627\u0628\u06cc\u06d4<\/h2>\n<p>JWTs Node.js API \u0645\u06cc\u06ba \u06c1\u0631 \u062c\u06af\u06c1 \u0645\u0648\u062c\u0648\u062f \u06c1\u06cc\u06ba\u06d4 <code>jsonwebtoken<\/code> \u0644\u0627\u0626\u0628\u0631\u06cc\u0631\u06cc \u0627\u0633\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u0627 \u0622\u0633\u0627\u0646 \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u0686\u06be\u06cc \u0686\u06cc\u0632 \u0628\u06be\u06cc \u06c1\u06d2 \u0627\u0648\u0631 \u0628\u0631\u06cc \u0628\u06be\u06cc\u06d4 \u06cc\u06c1 \u0635\u062d\u06cc\u062d \u0637\u0631\u06cc\u0642\u06d2 \u0633\u06d2 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u0646\u0627 \u0622\u0633\u0627\u0646 \u06c1\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u0627\u0646 \u0637\u0631\u06cc\u0642\u0648\u06ba \u0633\u06d2 \u0628\u06be\u06cc \u062c\u0648 \u0627\u0686\u06be\u06d2 \u0644\u06af\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u0648\u06c1 \u0646\u06c1 \u06c1\u0648\u06ba\u06d4<\/p>\n<p>OWASP \u0679\u0627\u067e 10 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc\u0648\u06ba \u06a9\u0648 \u0634\u0646\u0627\u062e\u062a \u0627\u0648\u0631 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06cc \u0646\u0627\u06a9\u0627\u0645\u06cc\u0648\u06ba (A07:2021) \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u062f\u0631\u062c\u06c1 \u0628\u0646\u062f\u06cc \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u062a\u06cc\u0646 \u063a\u0644\u0637 \u062a\u0631\u062a\u06cc\u0628\u06cc\u06ba \u0628\u0627\u0631 \u0628\u0627\u0631 \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba:<\/p>\n<h3 id=\"heading-how-to-identify-this-vulnerability-in-your-code\">\u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0645\u06cc\u06ba \u0627\u0633 \u062e\u0637\u0631\u06d2 \u06a9\u06cc \u0646\u0634\u0627\u0646\u062f\u06c1\u06cc \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<p><strong>\u063a\u0644\u0637\u06cc 1 - \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645 \u0645\u062a\u0639\u06cc\u0646 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/strong> <code>verify()<\/code>:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Vulnerable\nconst decoded = jwt.verify(token, process.env.JWT_SECRET);\n<\/code><\/pre>\n<p>\u0628\u063a\u06cc\u0631 <code>algorithms<\/code> \u0627\u062e\u062a\u06cc\u0627\u0631\u0627\u062a \u0622\u067e \u06a9\u0648 \u06a9\u0686\u06be JWT \u0646\u0641\u0627\u0630 \u06a9\u0648 \u0627\u06cc\u06a9 \u0679\u0648\u06a9\u0646 \u0642\u0628\u0648\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0686\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0633 \u0645\u06cc\u06ba \u0627\u0639\u0644\u0627\u0646 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2: <code>\"alg\": \"none\"<\/code> \u06c1\u06cc\u0688\u0631 \u0645\u06cc\u06ba - \u06cc\u0639\u0646\u06cc \u06a9\u0633\u06cc \u0628\u06be\u06cc \u062f\u0633\u062a\u062e\u0637 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u063a\u0644\u0637\u06cc 2 - \u06a9\u0645\u0632\u0648\u0631 \u06cc\u0627 \u0633\u062e\u062a \u06a9\u0648\u0688 \u0634\u062f\u06c1 \u0631\u0627\u0632<\/strong>:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Vulnerable\nconst token = jwt.sign({ userId: user.id }, 'secret');\n<\/code><\/pre>\n<p>\u0627\u06cc\u06a9 \u0628\u0627\u0631 \u062c\u0628 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u0627\u06cc\u06a9 \u062f\u0631\u0633\u062a \u0679\u0648\u06a9\u0646 \u062d\u0627\u0635\u0644 \u06a9\u0631 \u0644\u06cc\u062a\u0627 \u06c1\u06d2 \u062a\u0648 \u0645\u062e\u062a\u0635\u0631 \u06cc\u0627 \u0645\u062a\u0648\u0642\u0639 HS256 \u0631\u0627\u0632\u0648\u06ba \u06a9\u0648 \u0632\u0628\u0631\u062f\u0633\u062a\u06cc \u0622\u0641 \u0644\u0627\u0626\u0646 \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p><strong>\u063a\u0644\u0637\u06cc 3 - \u067e\u06d2 \u0644\u0648\u0688 \u0645\u06cc\u06ba \u062d\u0633\u0627\u0633 \u0688\u06cc\u0679\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/strong>:<\/p>\n<pre><code class=\"language-javascript\">\/\/ Vulnerable\nconst token = jwt.sign({\n  userId: user.id,\n  passwordHash: user.passwordHash, \/\/ never do this\n  role: user.role\n}, secret);\n<\/code><\/pre>\n<p>JWT \u067e\u06d2 \u0644\u0648\u0688 \u063a\u06cc\u0631 \u0627\u0646\u06a9\u0631\u067e\u0679\u0688 \u0627\u0648\u0631 \u0628\u06cc\u0633 64 \u0627\u0646\u06a9\u0648\u0688\u0688 \u06c1\u06d2\u06d4 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u062c\u0633 \u06a9\u06d2 \u067e\u0627\u0633 \u0679\u0648\u06a9\u0646 \u06c1\u06d2 \u0648\u06c1 \u067e\u06d2 \u0644\u0648\u0688 \u06a9\u0648 \u0688\u06cc \u06a9\u0648\u0688 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u0645\u0648\u0627\u062f \u06a9\u0648 \u067e\u0691\u06be \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<h3 id=\"heading-how-to-fix-these-issues\">\u0627\u0646 \u0645\u0633\u0627\u0626\u0644 \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u062d\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/h3>\n<pre><code class=\"language-javascript\">\/\/ Secure JWT implementation\nconst jwt = require('jsonwebtoken');\nconst crypto = require('crypto');\n\n\/\/ Generate a strong secret once and store it as an environment variable:\n\/\/ node -e \"console.log(crypto.randomBytes(64).toString('hex'))\"\nconst JWT_SECRET = process.env.JWT_SECRET;\n\nif (!JWT_SECRET || Buffer.from(JWT_SECRET, 'hex').length < 32) {\n  throw new Error('JWT_SECRET must be at least 32 random bytes');\n}\n\nfunction signToken(userId) {\n  return jwt.sign(\n    { sub: userId },         \/\/ 'sub' is the standard claim for the user identifier\n    JWT_SECRET,\n    {\n      algorithm: 'HS256',    \/\/ always declare the algorithm explicitly\n      expiresIn: '15m',      \/\/ short-lived tokens reduce the window if a token is stolen\n      issuer: 'your-app-name',\n      audience: 'your-app-name'\n    }\n  );\n}\n\nfunction verifyToken(token) {\n  return jwt.verify(token, JWT_SECRET, {\n    algorithms: ['HS256'],   \/\/ whitelist only the expected algorithm\n    issuer: 'your-app-name',\n    audience: 'your-app-name'\n  });\n}\n\nfunction authenticate(req, res, next) {\n  const authHeader = req.headers.authorization;\n\n  if (!authHeader || !authHeader.startsWith('Bearer ')) {\n    return res.status(401).json({ error: 'No token provided' });\n  }\n\n  const token = authHeader.split(' ')[1];\n\n  try {\n    const decoded = verifyToken(token);\n    req.user = { id: decoded.sub };\n    next();\n  } catch (err) {\n    return res.status(401).json({ error: 'Invalid or expired token' });\n  }\n}\n<\/code><\/pre>\n<p><strong>\u0679\u0648\u06a9\u0646 \u0645\u0646\u0633\u0648\u062e\u06cc \u067e\u0631 \u0646\u0648\u0679\u0633<\/strong>: JWT \u0628\u06d2 \u0648\u0637\u0646 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06c1\u06d2 \u06a9\u06c1 \u06c1\u0645\u0627\u0631\u06d2 \u0633\u0631\u0648\u0631\u0632 \u067e\u0631 \u06a9\u0648\u0626\u06cc \u0631\u06cc\u06a9\u0627\u0631\u0688 \u0646\u06c1\u06cc\u06ba \u0631\u06a9\u06be\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0644\u0627\u06af \u0622\u0624\u0679 \u06c1\u0648\u0646\u06d2 \u06cc\u0627 \u0627\u06a9\u0627\u0624\u0646\u0679 \u0633\u06d2 \u0633\u0645\u062c\u06be\u0648\u062a\u06c1 \u06a9\u0631\u0646\u06d2 \u067e\u0631 \u0627\u0636\u0627\u0641\u06cc \u0627\u0646\u0641\u0631\u0627\u0633\u0679\u0631\u06a9\u0686\u0631 \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u0679\u0648\u06a9\u0646\u0632 \u06a9\u0648 \u0641\u0648\u0631\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0628\u0627\u0637\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u06d4<\/p>\n<p>\u0639\u0627\u0645 \u062d\u0644\u0648\u06ba \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0642\u0644\u06cc\u0644 \u0627\u0644\u0645\u062f\u062a \u0631\u0633\u0627\u0626\u06cc \u0679\u0648\u06a9\u0646 (15 \u0645\u0646\u0679) \u0634\u0627\u0645\u0644 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u06a9\u06c1 \u0631\u06cc\u0641\u0631\u06cc\u0634 \u0679\u0648\u06a9\u0646 \u0627\u0633\u0679\u0648\u0631 \u0634\u062f\u06c1 \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u06cc\u0688 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u062c\u0648\u0691\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u060c \u06cc\u0627 Redis \u062c\u06cc\u0633\u06d2 \u062a\u06cc\u0632 \u0627\u0633\u0679\u0648\u0631 \u0645\u06cc\u06ba \u0679\u0648\u06a9\u0646 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a\u06d4 \u0648\u06c1 \u0637\u0631\u06cc\u0642\u06c1 \u0645\u0646\u062a\u062e\u0628 \u06a9\u0631\u06cc\u06ba \u062c\u0648 \u0622\u067e \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06cc \u0636\u0631\u0648\u0631\u06cc\u0627\u062a \u06a9\u06d2 \u0645\u0637\u0627\u0628\u0642 \u06c1\u0648\u06d4<\/p>\n<p><strong>JWT \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0686\u06cc\u06a9 \u0644\u0633\u0679<\/strong>:<\/p>\n<ul>\n<li>\n<p>\u06c1\u0645\u06cc\u0634\u06c1 \u06af\u0632\u0631\u0646\u0627 <code>algorithms: ['HS256']<\/code> \u06a9\u0648 <code>verify()<\/code>.<\/p>\n<\/li>\n<li>\n<p>\u0627\u06af\u0644\u0627\u060c \u06a9\u0645 \u0627\u0632 \u06a9\u0645 32 \u0628\u06d2 \u062a\u0631\u062a\u06cc\u0628 \u0628\u0627\u0626\u0679\u0633 \u06a9\u0627 \u0627\u06cc\u06a9 \u0631\u0627\u0632 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba \u062c\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u062a\u06cc\u0627\u0631 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2: <code>crypto.randomBytes<\/code>.<\/p>\n<\/li>\n<li>\n<p>\u0627\u06cc\u06a9 \u0645\u062e\u062a\u0635\u0631 \u0645\u06cc\u0639\u0627\u062f \u062e\u062a\u0645 \u06c1\u0648\u0646\u06d2 \u06a9\u0627 \u0648\u0642\u062a \u0645\u0642\u0631\u0631 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u067e\u06d2 \u0644\u0648\u0688 \u0645\u06cc\u06ba \u0635\u0631\u0641 \u063a\u06cc\u0631 \u062d\u0633\u0627\u0633 \u0634\u0646\u0627\u062e\u062a \u06a9\u0646\u0646\u062f\u06af\u0627\u0646 (\u0635\u0627\u0631\u0641 IDs) \u06a9\u0648 \u0627\u0633\u0679\u0648\u0631 \u06a9\u0631\u06cc\u06ba\u060c \u0627\u06cc \u0645\u06cc\u0644\u0632\u060c \u067e\u0627\u0633 \u0648\u0631\u0688\u0632 \u06cc\u0627 \u06a9\u0631\u062f\u0627\u0631\u0648\u06ba \u06a9\u0648 \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<li>\n<p>\u0645\u0639\u06cc\u0627\u0631\u06cc \u062f\u0639\u0648\u0648\u06ba \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644: <code>sub<\/code>\u060c <code>iss<\/code>\u060c <code>aud<\/code>\u060c <code>exp<\/code>.<\/p>\n<\/li>\n<li>\n<p>\u067e\u06cc\u062f\u0627\u0648\u0627\u0631 \u0645\u06cc\u06ba \u062c\u0627\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0627\u067e\u0646\u06cc \u0645\u0646\u0633\u0648\u062e\u06cc \u06a9\u06cc \u062d\u06a9\u0645\u062a \u0639\u0645\u0644\u06cc \u06a9\u0627 \u0645\u0646\u0635\u0648\u0628\u06c1 \u0628\u0646\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<\/li>\n<\/ul>\n<h2 id=\"heading-summary\">\u062e\u0644\u0627\u0635\u06c1<\/h2>\n<p>\u0630\u06cc\u0644 \u0645\u06cc\u06ba \u0627\u0633 \u0679\u06cc\u0648\u0679\u0648\u0631\u06cc\u0644 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u0686\u06be \u062e\u0637\u0631\u0627\u062a \u06a9\u06d2 \u0632\u0645\u0631\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0641\u0648\u0631\u06cc \u062d\u0648\u0627\u0644\u06c1 \u06c1\u06d2\u06d4<\/p>\n<table>\n<thead>\n<tr>\n<th>\u06a9\u0645\u0632\u0648\u0631\u06cc<\/th>\n<th>\u0628\u0646\u06cc\u0627\u062f\u06cc \u0648\u062c\u06c1<\/th>\n<th>\u0628\u0646\u06cc\u0627\u062f\u06cc \u062f\u0631\u0633\u062a\u06af\u06cc<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u062e\u0634\u06a9<\/td>\n<td>\u0627\u062c\u0627\u0632\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u063a\u0627\u0626\u0628 \u06c1\u06d2\u06d4<\/td>\n<td>\u062a\u0635\u062f\u06cc\u0642 \u0634\u062f\u06c1 \u0633\u06cc\u0634\u0646\u0632 \u0645\u06cc\u06ba \u0645\u0644\u06a9\u06cc\u062a \u06a9\u06cc \u062a\u0635\u062f\u06cc\u0642 \u06a9\u0631\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u0628\u0644\u06a9 \u0645\u062e\u062a\u0635<\/td>\n<td>\u062a\u0645\u0627\u0645 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u0627\u0688\u06cc \u0641\u06cc\u0644\u0688\u0632 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u067e\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/td>\n<td>\u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0645\u06cc\u06ba \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0627\u062c\u0627\u0632\u062a \u0634\u062f\u06c1 \u0641\u06cc\u0644\u0688\u0632 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u067e\u0631\u0648\u0679\u0648\u0679\u0627\u0626\u067e \u0622\u0644\u0648\u062f\u06af\u06cc<\/td>\n<td>\u0646\u0627\u0642\u0627\u0628\u0644 \u0628\u06be\u0631\u0648\u0633\u06c1 \u0627\u0646 \u067e\u0679 \u06a9\u0627 \u0628\u0627\u0631 \u0628\u0627\u0631 \u0627\u0646\u0636\u0645\u0627\u0645<\/td>\n<td>\u0627\u0633\u0679\u06cc\u0679 \u06a9\u0648 \u0633\u0631\u0648\u0631 \u0633\u0627\u0626\u0688 \u067e\u0631 \u0627\u0633\u0679\u0648\u0631 \u06a9\u0631\u06cc\u06ba\u06d4 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba <code>Object.create(null)<\/code> \u0627\u0646\u0636\u0645\u0627\u0645 \u06a9\u06d2 \u0627\u06c1\u062f\u0627\u0641 \u06a9\u06d2 \u0644\u06cc\u06d2\u06d4<\/td>\n<\/tr>\n<tr>\n<td>\u062f\u0648\u0691 \u06a9\u06cc \u062d\u0627\u0644\u062a<\/td>\n<td>\u062c\u0648\u06c1\u0631\u06cc \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u062a\u0635\u062f\u06cc\u0642 \u06a9\u06d2 \u0628\u0639\u062f \u0686\u0644\u0627\u0626\u06cc\u06ba\u06d4<\/td>\n<td>\u0627\u06cc\u0679\u0645 <code>UPDATE ... WHERE condition<\/code> \u06cc\u0627 \u0633\u0648\u062f\u0627<\/td>\n<\/tr>\n<tr>\n<td>\u06a9\u0627\u0631\u0648\u0628\u0627\u0631\u06cc \u0645\u0646\u0637\u0642 \u06a9\u06cc \u062e\u0631\u0627\u0628\u06cc\u06d4<\/td>\n<td>\u06a9\u0644\u0627\u0626\u0646\u0679 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06c1 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062f\u06c1 \u0639\u062f\u062f\u06cc \u0642\u062f\u0631 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u06cc\u06ba\u06d4<\/td>\n<td>\u0628\u0627\u0642\u0627\u0639\u062f\u06c1 \u0627\u0638\u06c1\u0627\u0631 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 \u0627\u0646 \u067e\u0679\u06d4 \u067e\u06cc\u0633\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0639\u062f\u062f\u06cc \u0631\u06cc\u0627\u0636\u06cc \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4<\/td>\n<\/tr>\n<tr>\n<td>JWT \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646 \u06a9\u06cc \u062e\u0631\u0627\u0628\u06cc\u06d4<\/td>\n<td>\u06a9\u0648\u0626\u06cc \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645 \u0648\u0627\u0626\u0679 \u0644\u0633\u0679 \u0646\u06c1\u06cc\u06ba\u060c \u06a9\u0645\u0632\u0648\u0631 \u0631\u0627\u0632<\/td>\n<td>\u0648\u0627\u0636\u062d \u0627\u0644\u06af\u0648\u0631\u062a\u06be\u0645\u06a9 \u0627\u0646\u062a\u0638\u0627\u0645\u060c \u0645\u0636\u0628\u0648\u0637 \u0628\u06d2 \u062a\u0631\u062a\u06cc\u0628 \u0631\u0627\u0632\u060c \u0645\u062e\u062a\u0635\u0631 \u0645\u06cc\u0639\u0627\u062f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u06a9\u0633\u06cc \u0628\u06be\u06cc \u06a9\u0645\u0632\u0648\u0631\u06cc \u06a9\u0627 \u0641\u0627\u0626\u062f\u06c1 \u0627\u0679\u06be\u0627\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06c1\u0648\u0634\u06cc\u0627\u0631 \u062d\u0645\u0644\u06c1 \u0622\u0648\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0622\u067e \u06a9\u0648 \u0635\u0631\u0641 \u06a9\u0648\u0688 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2 \u062c\u0648 \u063a\u0644\u0637 \u0648\u0642\u062a \u067e\u0631 \u063a\u0644\u0637 \u0686\u06cc\u0632\u0648\u06ba \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u06d2\u06d4<\/p>\n<p>\u0627\u0646\u062f\u0631\u0648\u0646\u06cc \u0628\u0646\u0627\u0646\u06d2 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u0627\u06cc\u06a9 \u0646\u0645\u0648\u0646\u06c1: \u06c1\u0645\u06cc\u0634\u06c1 \u0633\u06cc\u0634\u0646 \u0633\u06d2 \u062a\u0648\u062b\u06cc\u0642 \u062d\u0627\u0635\u0644 \u06a9\u0631\u06cc\u06ba\u060c \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0633\u06d2 \u0646\u06c1\u06cc\u06ba\u06d4 \u0631\u06cc\u0646\u062c \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u062a\u0645\u0627\u0645 \u0639\u062f\u062f\u06cc \u0627\u0646 \u067e\u0679 \u06a9\u06cc \u062a\u0648\u062b\u06cc\u0642 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0645\u0627\u0644\u06cc\u0627\u062a\u06cc \u062a\u062d\u0631\u06cc\u0631 \u06a9\u0648 \u062c\u0648\u06c1\u0631\u06cc \u0628\u0646\u0627\u0626\u06cc\u06ba\u06d4 \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 JWT \u06a9\u0646\u0641\u06cc\u06af\u0631\u06cc\u0634\u0646 \u0628\u0646\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<p>\u0627\u0646 \u062e\u0637\u0631\u0627\u062a \u0633\u06d2 \u0646\u0645\u0679\u0646\u06d2 \u06a9\u06d2 \u0637\u0631\u06cc\u0642\u06d2 \u06a9\u0648 \u0633\u0645\u062c\u06be\u0646\u0627 \u062a\u0635\u0648\u06cc\u0631 \u06a9\u0627 \u0627\u06cc\u06a9 \u0631\u062e \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0633\u0645\u062c\u06be\u0646\u0627 \u06a9\u06c1 \u062d\u0642\u06cc\u0642\u06cc \u062f\u0646\u06cc\u0627 \u06a9\u06cc \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u06a9\u06d2 \u062c\u0627\u0626\u0632\u06d2 \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u0627\u0646 \u06a9\u06cc \u0634\u0646\u0627\u062e\u062a \u0627\u0648\u0631 \u0627\u0633\u062a\u062d\u0635\u0627\u0644 \u06a9\u06cc\u0633\u06d2 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u06af\u0631 \u0622\u067e \u0686\u06cc\u0632\u0648\u06ba \u06a9\u06d2 \u062c\u0627\u0631\u062d\u0627\u0646\u06c1 \u067e\u06c1\u0644\u0648 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0645\u0632\u06cc\u062f \u062c\u0627\u0646\u0646\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba (\u062f\u062e\u0648\u0644 \u0679\u06cc\u0633\u0679 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0648\u06cc\u0628 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u06a9\u06d2 \u0627\u06c1\u062f\u0627\u0641 \u062a\u06a9 \u06a9\u06cc\u0633\u06d2 \u0631\u0633\u0627\u0626\u06cc \u062d\u0627\u0635\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0648\u06c1 \u06a9\u06cc\u0627 \u062a\u0644\u0627\u0634 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0645\u062a\u0639\u062f\u062f \u062e\u0627\u0645\u06cc\u0648\u06ba \u06a9\u0648 \u06a9\u06cc\u0633\u06d2 \u062c\u0648\u0691\u062a\u06d2 \u06c1\u06cc\u06ba)\u060c \u062a\u0648 \u0648\u06cc\u0628 \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u06a9\u06d2 \u062d\u0645\u0644\u06d2 \u06a9\u06cc \u062a\u06a9\u0646\u06cc\u06a9\u0648\u06ba \u06a9\u0627 \u06cc\u06c1 \u06af\u0627\u0626\u06cc\u0688 \u0627\u0633 \u062a\u0646\u0627\u0638\u0631 \u06a9\u0648 \u062a\u0641\u0635\u06cc\u0644 \u0633\u06d2 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0645\u06cc\u06ba \u0646\u0626\u06d2 \u0688\u0648\u06cc\u0644\u067e\u0631\u0632 \u06a9\u0648 \u062d\u06cc\u0631\u0627\u0646 \u06a9\u0631 \u062f\u06cc\u0646\u06d2 \u0648\u0627\u0644\u06cc \u0686\u06cc\u0632\u06cc\u06ba \u06cc\u06c1 \u06c1\u06cc\u06ba: \u0648\u06cc\u0628 \u06a9\u06cc \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u06a9\u0645\u0632\u0648\u0631\u06cc\u0627\u06ba \u0646\u0641\u06cc\u0633 \u062d\u0645\u0644\u0648\u06ba \u06a9\u0627 \u0646\u062a\u06cc\u062c\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u06a9\u0648\u0688 \u06a9\u06d2 \u0646\u0645\u0648\u0646\u0648\u06ba \u0633\u06d2 \u0622\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u0628\u0627\u0644\u06a9\u0644 \u0645\u0639\u0642\u0648\u0644 \u0645\u0639\u0644\u0648\u0645 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062c\u06cc\u0633\u06d2 \u06cc\u0648 \u0622\u0631 \u0627\u06cc\u0644 \u06a9\u06cc \u0642\u062f\u0631 \u067e\u0631 \u0628\u06be\u0631\u0648\u0633\u06c1 \u06a9\u0631\u0646\u0627\u060c \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06d2 \u0628\u0627\u0688\u06cc \u06a9\u0648 \u0688\u06cc\u0679\u0627 \u0628\u06cc\u0633 \u0627\u067e \u0688\u06cc\u0679 \u067e\u0631 \u0644\u0627\u06af\u0648 [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-26801","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/posts\/26801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/comments?post=26801"}],"version-history":[{"count":0,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/posts\/26801\/revisions"}],"wp:attachment":[{"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/media?parent=26801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/categories?post=26801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/umang.pk\/en_us\/wp-json\/wp\/v2\/tags?post=26801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}