#1001
Your e-commerce platform calculates an order total by summing quantity * price for each line item.
The calculateOrderTotal function performs no validation on quantities, allowing an attacker to submit a negative quantity for an expensive item to reduce — or even negate — the total cost.
In the worst case, an attacker's cart yields a negative total, meaning the platform would effectively pay the attacker upon checkout.
Negative quantity attacks have cost real businesses significant money. Input validation at the business logic layer is the only reliable defence — server-side validation cannot be skipped even when the UI prevents negative quantities.
calculateOrderTotal to validate that every item's quantity is a positive integer.'Invalid quantity' if any item has a quantity of zero or less.calculateOrderTotal([{productId:'p1',quantity:-1,price:100},{productId:'p2',quantity:1,price:50}])// returns -50 — attacker reduces total!
calculateOrderTotal([{productId:'p1',quantity:-1,price:100}])// throws Error('Invalid quantity')
'Invalid quantity' — no other message.0.