How to fix Business Logic Errors
in Salvo
Executive Summary
Business logic errors in Salvo applications occur when the server trusts client-provided parameters to drive sensitive operations without verifying ownership or state. In Rust frameworks, memory safety is guaranteed, but logical safety is not. Most common flaws involve Insecure Direct Object References (IDOR) where the 'Depot' context is ignored in favor of 'Request' parameters.
The Vulnerable Pattern
use salvo::prelude::*;#[handler] async fn update_account_balance(req: &mut Request, res: &mut Response) { // VULNERABLE: Trusting the user_id and amount directly from the request let target_user_id = req.param::
(“id”).unwrap(); let adjustment = req.parse_json:: ().await.unwrap(); // An attacker can change the 'id' in the URL to any user's ID db::update_balance(target_user_id, adjustment).await; res.render("Balance updated");
}
The Secure Implementation
The vulnerability stems from an IDOR (Insecure Direct Object Reference) where the handler blindly processes the 'id' parameter from the URI. A malicious actor can modify the URI to manipulate resources belonging to other users. The fix utilizes Salvo's 'Depot' to retrieve the authenticated user's context, which is then compared against the requested resource ID. This ensures that the server, not the client, dictates the scope of the transaction. Always validate object ownership server-side before executing state-changing logic.
use salvo::prelude::*; use salvo::http::StatusCode;#[handler] async fn update_account_balance(req: &mut Request, depot: &mut Depot, res: &mut Response) { // SECURE: Extract identity from the Depot (populated by Auth middleware) let session = depot.get::
(“session”).cloned(); if let Some(user) = session { let target_user_id = req.param::<u64>("id").unwrap(); // Authorization check: Does the session user own this resource? if user.id != target_user_id && !user.is_admin { res.status_code(StatusCode::FORBIDDEN); res.render("Unauthorized: IDOR attempt detected"); return; } let adjustment = req.parse_json::<i32>().await.unwrap(); db::update_balance(target_user_id, adjustment).await; res.render("Balance updated"); } else { res.status_code(StatusCode::UNAUTHORIZED); }
}
Your Salvo API
might be exposed to Business Logic Errors
74% of Salvo apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.