Fix Business Logic Errors in Revel

Business logic errors in Revel arise when developers assume client-side data integrity. In these scenarios, attackers manipulate parameters—like price, quantity, or user roles—to bypass intended workflows. Because Revel's data binding is seamless, it's easy to accidentally bind sensitive fields directly from the request body to your models without server-side validation.

The Vulnerable Pattern

func (c App) Checkout(amount float64, productID int) revel.Result {
    // VULNERABLE: Trusting the 'amount' parameter directly from the request.
    // An attacker can modify the POST body to set amount to 0.01.
    order := models.Order{
        ProductID: productID,
        Total:     amount,
        UserID:    c.Session["user_id"].(int),
    }
    db.Save(&order)
    return c.RenderJSON(order)
}

The Secure Implementation

The vulnerability lies in the 'Trusting User Input' anti-pattern. By allowing the 'amount' to be passed as a parameter, the application permits Price Manipulation via Intercepting Proxies. The fix enforces a 'Server-Side Source of Truth'. Always resolve critical business values (prices, permissions, discounts) on the server using a primary key (productID) rather than accepting calculated values from the client. Additionally, use Revel's validation stack to ensure the productID exists and belongs to the current context.

func (c App) Checkout(productID int) revel.Result {
    // SECURE: Re-fetch the price from the database using the productID.
    // Ignore any 'amount' sent by the client.
    var product models.Product
    if err := db.First(&product, productID).Error; err != nil {
        return c.RenderError(err)
    }
order := models.Order{
    ProductID: product.ID,
    Total:     product.Price, // Source of truth is the DB, not the request
    UserID:    c.Session["user_id"].(int),
}
db.Save(&order)
return c.RenderJSON(order)
}