Fix Business Logic Errors in Camping

Business logic flaws in Camping applications typically arise when the developer assumes the client will follow the intended application flow. Because Camping is a micro-framework, it provides minimal guardrails. Common exploits involve manipulating the 'input' hash to bypass authorization or modify sensitive values like prices or user IDs that should be derived solely from the server-side session ('state').

The Vulnerable Pattern

module CampingApp::Controllers
  class Checkout < R '/checkout'
    def post
      # VULNERABLE: The app trusts the price sent by the client
      # A hacker can intercept this POST and change 'total' to 0.01
      @order = Order.create(
        user_id: state.user_id, 
        total: input.total.to_f, 
        status: 'paid'
      )
      render :receipt
    end
  end
end

The Secure Implementation

The vulnerability is a Parameter Manipulation flaw where the 'total' price is trusted from the 'input' object. An attacker can use a proxy like Burp Suite to modify the POST request. The secure implementation discards any client-provided financial data and re-calculates the total using the server's database (the source of truth) based on the authenticated 'state.user_id'. Always treat the 'input' hash as untrusted user input and the 'state' hash as the only reliable source for identity and session-bound data.

module CampingApp::Controllers
  class Checkout < R '/checkout'
    def post
      # SECURE: Ignore client-side pricing. Re-calculate from DB.
      cart_items = Cart.find_all_by_user_id(state.user_id)
  if cart_items.empty?
    redirect Index
    return
  end

  # Server-side source of truth for pricing
  actual_total = cart_items.map(&:price).sum
  
  @order = Order.create(
    user_id: state.user_id, 
    total: actual_total, 
    status: 'pending_payment'
  )
  # Proceed to actual payment gateway integration
  render :receipt
end
end
end