EH-19: Business Logic Flaw - Mengeksploitasi Alur Aplikasi

cd ~ && mkdir -p eth-l19 && cd eth-l19
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
app = Flask(__name__)
coupons = {"DISKON10": {"used":False,"discount":0.1}}
@app.route('/order', methods=['POST'])
def order():
    data = request.json
    price = data.get('price',100000)
    coupon = data.get('coupon','')
    if coupon in coupons and not coupons[coupon]['used']:
        price = price * (1 - coupons[coupon]['discount'])
        coupons[coupon]['used'] = True
        # ❌ LOGIC FLAW: bisa apply coupon, cancel, apply lagi!
    return jsonify({"total":price})
@app.route('/cancel/<int:order_id>')
def cancel(order_id):
    # ❌ LOGIC FLAW: cancel tidak mengembalikan status coupon!
    return jsonify({"cancelled":order_id})
app.run(port=9017)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Apply coupon ==*"
curl -s -X POST http://localhost:9017/order -H "Content-Type: application/json" \
  -d '{"price":100000,"coupon":"DISKON10"}'
echo ""
echo "=== 2. Cancel (coupon tidak kembali) ==*"
curl -s "http://localhost:9017/cancel/1"
echo ""
echo "=== 3. Apply lagi (sudah used!) ==*"
curl -s -X POST http://localhost:9017/order -H "Content-Type: application/json" \
  -d '{"price":100000,"coupon":"DISKON10"}'

kill %1 2>/dev/null