Fix Business Logic Errors in Rails

Business logic vulnerabilities in Rails are the ultimate prize for a manual tester. Unlike SQLi or XSS, these flaws bypass automated scanners by exploiting the developer's flawed assumptions about state transitions and data integrity. If you are trusting the client to dictate the price, the user_id, or the workflow state, you have already lost. Stop treating controllers like logic dumps and start enforcing state integrity at the model and service layers.

The Vulnerable Pattern

class OrdersController < ApplicationController
  def update
    @order = Current.user.orders.find(params[:id])
    # VULNERABLE: Mass assignment allows the attacker to inject 'status' or 'total_price'
    # An attacker sends: { "order": { "status": "paid", "total_price": 0.00 } }
    if @order.update(params[:order])
      redirect_to @order
    end
  end
end

The Secure Implementation

The vulnerability lies in 'Over-posting' or 'Mass Assignment'. By passing the entire params[:order] hash to the update method, the application blindly persists any key-value pair that matches a database column. A malicious actor can elevate their privileges or bypass payment gates by setting attributes like 'role', 'status', or 'balance'. To fix this: 1. Strictly use Strong Parameters to permit only user-controllable fields. 2. Encapsulate business rules in Service Objects or Domain Models. 3. Use state machine gems (like AASM) to ensure that status transitions (e.g., 'pending' to 'shipped') can only happen through valid triggers, not direct database writes.

class OrdersController < ApplicationController
  def update
    @order = Current.user.orders.find(params[:id])
    authorize @order, :update?
# SECURE: Use Strong Parameters to whitelist only non-sensitive fields
# Use a Service Object or State Machine to handle logic-heavy transitions
if OrderProcessor.call(@order, order_update_params)
  redirect_to @order
else
  render :edit
end
end
private
def order_update_params
params.require(:order).permit(:shipping_address, :notes)
end
end