# Business Logic Errors (CWE-840)

The product does not properly implement the business logic rules, which may allow users to manipulate the system in unintended ways.

**Stack:** JavaScript

- Prevalence: मध्यम 3 भाषाएँ कवर की गईं
- Impact: उच्च 3 उच्च गंभीरता वाले नियम
- Prevention: प्रलेखित 3 फिक्स उदाहरण

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Business logic errors occur when the application's implementation doesn't correctly enforce the intended business rules. Unlike technical vulnerabilities, these are flaws in the application's design or logic.

## Prevention

1 Shoulder डिटेक्शन नियमों पर आधारित Business Logic Errors के लिए रोकथाम रणनीतियाँ।

### JavaScript

Calculate totals and prices server-side using database values instead of client-submitted data

## Warning Signs

- [HIGH] client-controlled prices or amounts flowing to payment operations without server-side validation

## Consequences

- सुरक्षा तंत्र को बायपास करना
- विशेषाधिकार प्राप्त करना
- एप्लिकेशन डेटा संशोधित करना

## Mitigations

- व्यावसायिक नियमों और उनके सुरक्षा निहितार्थों का स्पष्ट दस्तावेज़ीकरण करें
- एज केसों और असामान्य workflows का परीक्षण करें
- सभी व्यावसायिक नियमों का सर्वर-साइड सत्यापन लागू करें

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Javascript (1 rules)

- **Business Logic Bypass** [HIGH]: Detects client-controlled prices or amounts flowing to payment operations without server-side validation.
  - Remediation: Calculate totals server-side using database prices.

```javascript
const product = await Product.findById(productId);
const total = product.price * quantity;
await stripe.charges.create({ amount: total, currency: 'usd' });
```

Learn more: https://shoulder.dev/learn/javascript/cwe-840/business-logic-bypass

### Typescript (1 rules)

- **Business Logic Bypass** [HIGH]: Detects client-controlled prices or amounts flowing to payment operations without server-side validation.
  - Remediation: Calculate totals server-side using database prices.

```javascript
const product = await Product.findById(productId);
const total = product.price * quantity;
await stripe.charges.create({ amount: total, currency: 'usd' });
```

Learn more: https://shoulder.dev/learn/javascript/cwe-840/business-logic-bypass