# Business Logic Errors (CWE-840)

The product does not properly implement the business logic rules, which may allow users to manipulate the system in unintended ways.

**Stack:** Go

- Prevalence: 보통 3개 언어 지원
- Impact: 높음 3개의 높은 심각도 규칙
- Prevention: 문서화됨 3개의 수정 예시

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Business logic errors occur when the application's implementation doesn't correctly enforce the intended business rules. Unlike technical vulnerabilities, these are flaws in the application's design or logic.

## Prevention

1개의 Shoulder 탐지 규칙을 기반으로 한 Business Logic Errors 예방 전략.

### Go

Calculate financial values server-side from trusted data sources instead of accepting client-submitted totals

## Consequences

- 보호 메커니즘 우회
- 권한 획득
- 애플리케이션 데이터 수정

## Mitigations

- 비즈니스 규칙과 그 보안 영향을 명확히 문서화하세요
- 엣지 케이스와 비정상적인 워크플로를 테스트하세요
- 모든 비즈니스 규칙은 서버에서 검증하세요

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **Business Logic Bypass** [HIGH]: Client-controlled financial values flow to payment operations without server-side calculation.
  - Remediation: Fetch prices from the database instead of trusting client values.

```go
func checkout(c *gin.Context) {
    productID := c.PostForm("product_id")
    var product Product
    db.First(&product, productID)
    total := product.Price * float64(quantity)
    processPayment(total)
}
```

Learn more: https://shoulder.dev/learn/go/cwe-840/business-logic-bypass