Rules›northwind-currency-not-validated

northwind-currency-not-validated

info

northwind/correctness/currency-not-validated

Docs page ↗

currency comes straight off the request body or a user profile into charges.create, with no allow-list and no check that the amount was computed in that currency.

10

codebases affected, of 58

17%

of everything we scanned

—

no docs fix scored yet

1

docs commits aimed at this

Where it’s failing

currency is passed to charges.create straight from request input, with no allow-list.

what we find

what we change it to

await northwind.charges.create({
amount: cart.totalCents,
currency: req.body.currency, // "jpy" → charged 100x
customer,
})
const SUPPORTED = new Set(['usd', 'eur', 'gbp', 'cad'])
const currency = String(req.body.currency ?? '').toLowerCase()
if (!SUPPORTED.has(currency)) {
return res.status(400).json({ error: 'unsupported currency' })
}
await northwind.charges.create({
amount: cart.totalCents, currency, customer,
})

Validate against an allow-list of the currencies you actually price in, lowercase it, and reject anything else with a 400 before the charge is created.

Metadata

Category
correctness
Type
suggestion
Severity
info
Recommended
yes
Languages
javascriptpython

Live telemetry

10 / 58 scans

Fired in 17% of scanned codebases.

After every docs commit

docs(api): validate currency against a supported allow-list

5fa473b · merged 1 week ago · PR by your team, scored by api-doctor

18% → 14%▼4pts

A fix for your docs page

Wherever this rule fires, a page on your docs site taught it. api-doctor writes the edit and opens it as a pull request on your docs repo — you review and merge.

No fix yet

Draft a docs fix for this rule

api-doctor writes the docs change from the fire pattern — you review it