Business Logic Bypass

Description

Client-controlled financial values flow to payment operations without server-side calculation.

What Shoulder detects

Client-controlled value from {source} flows to {sink} without server-side calculation.

How to fix

Fetch prices from the database instead of trusting client values.

```go
func checkout(c *gin.Context) {
    productID := c.PostForm("product_id")
    var product Product
    db.First(&product, productID)
    total := product.Price * float64(quantity)
    processPayment(total)
}
```

Learn more: https://shoulder.dev/learn/go/cwe-840/business-logic-bypass

Applies to

Languages

🐹 Go

Frameworks

gin echo fiber chi gorilla net/http

References

Documentation ↗ OWASP ↗ Learn about CWE-840

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=go-business-logic-bypass .