# Business Logic Errors (CWE-840)

The product does not properly implement the business logic rules, which may allow users to manipulate the system in unintended ways.

**Stack:** Python

- Prevalence: 中 3 言語をカバー
- Impact: ハイ 3 件の重大度ハイのルール
- Prevention: 文書化済み 3 件の修正例

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Business logic errors occur when the application's implementation doesn't correctly enforce the intended business rules. Unlike technical vulnerabilities, these are flaws in the application's design or logic.

## Prevention

1 件の Shoulder 検出ルールに基づく Business Logic Errors の予防策。

### Python

Calculate totals server-side using database prices instead of client-submitted values

## Warning Signs

- [HIGH] client-controlled business-critical values (price, quantity, discount)
flowing to payment or busines

## Consequences

- 保護メカニズムの回避
- 権限の取得
- アプリケーションデータの変更

## Mitigations

- ビジネスルールとそのセキュリティ上の影響を明確に文書化する
- エッジケースや通常と異なるワークフローもテストする
- すべてのビジネスルールをサーバー側で検証する

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Business Logic Bypass** [HIGH]: Detects client-controlled business-critical values (price, quantity, discount)
flowing to payment or business operations without server-side validation.
  - Remediation: Calculate totals server-side using database prices instead of client values.

```python
@app.post('/checkout')
async def checkout(item_id: int, quantity: int):
    product = Product.query.get(item_id)
    total = product.price * quantity
    stripe.Charge.create(amount=total)
```

Learn more: https://shoulder.dev/learn/python/cwe-840/business-logic-bypass