在线商店安全：防范客户端篡改造成的业务漏洞

// 假设这是一个订单提交的API端点
@PostMapping("/api/orders")
public ResponseEntity<?> createOrder(@RequestBody OrderRequest orderRequest) {
    // 1. 基本输入验证 (例如，使用JSR 303/380 Bean Validation)
    // @Valid 注解会触发OrderRequest类中定义的验证规则
    if (!isValid(orderRequest)) { // 实际由Spring等框架自动处理验证结果
        return ResponseEntity.badRequest().body("输入数据格式不正确或不符合要求。");
    }

    // ... 后续业务逻辑处理
    return ResponseEntity.ok("订单创建成功。");
}

// OrderRequest DTO 示例
public class OrderRequest {
    @NotNull(message = "商品ID不能为空")
    private Long productId;

    @Min(value = 1, message = "购买数量至少为1")
    @Max(value = 10, message = "购买数量不能超过10")
    private Integer quantity;

    @NotBlank(message = "提货点ID不能为空")
    private String pickupPointId;

    @Email(message = "邮箱格式不正确")
    private String customerEmail;

    // getters and setters
}

@PostMapping("/api/orders")
public ResponseEntity<?> createOrder(@RequestBody @Valid OrderRequest orderRequest) {
    // 假设 @Valid 已经处理了基本格式验证

    // 2. 业务逻辑验证 - 提货点可用性
    PickupPoint pickupPoint = pickupPointService.getPickupPointById(orderRequest.getPickupPointId());
    if (pickupPoint == null || !pickupPoint.isAvailable()) {
        return ResponseEntity.badRequest().body("您选择的提货点无效或当前不可用，请重新选择。");
    }

    // 3. 业务逻辑验证 - 商品库存
    Product product = productService.getProductById(orderRequest.getProductId());
    if (product == null || product.getStock() < orderRequest.getQuantity()) {
        return ResponseEntity.badRequest().body("商品库存不足，请调整购买数量。");
    }

    // 4. 业务逻辑验证 - 价格一致性
    BigDecimal serverSidePrice = product.getPrice().multiply(new BigDecimal(orderRequest.getQuantity()));
    if (orderRequest.getTotalAmount().compareTo(serverSidePrice) != 0) {
        // 客户端提交的总价与服务器计算的不符，可能存在篡改
        return ResponseEntity.badRequest().body("订单总金额不正确，请核对。");
    }

    // 5. 执行订单创建逻辑
    orderService.processOrder(orderRequest, product, pickupPoint);

    return ResponseEntity.ok("订单已成功提交。");
}