Business Logic Input Validation

Description

Detects business-critical values (discount, refund, quantity) used without validation.

What Shoulder detects

Business-critical value from {source} flows to {sink} without proper validation.
This could allow users to specify invalid values (negative numbers, out-of-range
percentages, amounts exceeding limits).

How to fix

Validate business-critical inputs before use.

```javascript
function validateDiscount(discount) {
  const value = parseFloat(discount);
  if (isNaN(value) || value < 0 || value > 100) {
    throw new Error('Discount must be 0-100');
  }
  return value;
}

const validated = validateDiscount(req.body.discount);
applyDiscount(validated);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-20/business-logic-input-validation