SSRF و Path Traversal — لما السيرفر يثق في URL أو مسار

// ❌ أي URL يتجابapp.get("/preview", async (req, res) => {  const r = await fetch(req.query.url);  res.send(await r.text());});

import { lookup } from "node:dns/promises";import net from "node:net";const ALLOWED_HOSTS = new Set(["images.example-cdn.com", "api.github.com"]);function isPrivate(ip) {  if (net.isIPv6(ip)) return ip === "::1" || ip.startsWith("fc") || ip.startsWith("fd") || ip.startsWith("fe80");  const [a, b] = ip.split(".").map(Number);  return a === 10 || a === 127 || a === 0 ||    (a === 172 && b >= 16 && b <= 31) ||    (a === 192 && b === 168) ||    (a === 169 && b === 254);           // cloud metadata}app.get("/preview", async (req, res) => {  const url = new URL(req.query.url);  if (url.protocol !== "https:") return res.sendStatus(400);  if (!ALLOWED_HOSTS.has(url.hostname)) return res.sendStatus(403);  const { address } = await lookup(url.hostname);  if (isPrivate(address)) return res.sendStatus(403);  const r = await fetch(url, { redirect: "error" });   // متتبعش redirect لعنوان تاني  res.send(await r.text());});

// ❌ ../../.env هيطلع من فولدر uploadsapp.get("/download", (req, res) => {  res.sendFile(path.join(__dirname, "uploads", req.query.file));});

const ROOT = path.resolve(__dirname, "uploads");app.get("/download", (req, res) => {  const target = path.resolve(ROOT, String(req.query.file));  // لازم يبدأ بالـ ROOT + فاصل، عشان uploads-old ميعديش  if (!target.startsWith(ROOT + path.sep)) return res.sendStatus(403);  res.sendFile(target);});