How to fix Business Logic Errors
in Plug
Executive Summary
Business logic errors in Plug-based Elixir applications often arise from 'State Trust' issues. Developers frequently trust client-side parameters for sensitive values like prices, quantities, or user roles. In a functional pipeline, if you don't verify the integrity of the data being passed through your plugs, an attacker can manipulate the request to bypass intended constraints.
The Vulnerable Pattern
defmodule Shop.Router do use Plug.Router plug :match plug :dispatchpost “/checkout” do # VULNERABLE: Directly trusting the ‘amount’ from the client request %{“product_id” => id, “amount” => amount} = conn.params
case PaymentProvider.charge(id, amount) do :ok -> send_resp(conn, 200, "Charged #{amount}") _ -> send_resp(conn, 400, "Error") end
end end
The Secure Implementation
The vulnerability is a classic Parameter Tampering flaw. In the vulnerable snippet, an attacker can intercept the HTTP POST request and modify the 'amount' field to '0.01', regardless of the actual product price. The fix implements a 'Server-Side Source of Truth' pattern. By ignoring the client-provided price and fetching the authoritative price from the database using the product ID, we neutralize the attack vector. Always treat conn.params as untrusted input and perform all critical calculations using verified server-side data.
defmodule Shop.Router do use Plug.Router plug :match plug :dispatchpost “/checkout” do # SECURE: Only trust the ID; fetch the source of truth (price) from the DB %{“product_id” => id} = conn.params
case Repo.get(Product, id) do nil -> send_resp(conn, 404, "Product not found") product -> case PaymentProvider.charge(id, product.price) do :ok -> send_resp(conn, 200, "Charged #{product.price}") _ -> send_resp(conn, 400, "Payment failed") end end
end end
Your Plug API
might be exposed to Business Logic Errors
74% of Plug apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.