Vulnerability: Negative charge in shopping cart in Shopizer ### Impact
Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. 

### Patches
Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0

### Workarounds
Without uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter.

### References
[Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
[Using bean validation constraint](https://javaee.github.io/tutorial/bean-validation002.html)
[Commits with fixes](https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a)
CVE Details below : 
[Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11007)
[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11007)

### Credits
Found and solved by Yannick Gosset from Aix-Marseille University cybersecurity
master program supervised by Yassine Ilmi
Vulnerability ID: GHSA-w8rc-pgxq-x2cj
CWE: CWE-20
Severity score: 6.5
Project: https://github.com/shopizer-ecommerce/shopizer
Published: 2020-04-22
File: sm-shop/src/main/java/com/salesmanager/shop/store/controller/shoppingCart/facade/ShoppingCartFacadeImpl.java
Commit message: Merge pull request from GHSA-w8rc-pgxq-x2cj

Fixing negative charge vulnerability
Commit author: Shopizer

Vulnerable version (before fix):
 public ShoppingCartData addItemsToShoppingCart( final ShoppingCartData shoppingC     {          ShoppingCart cartModel = null;                  /**          * Sometimes a user logs in and a shopping cart is present in db (shoppingCartData          * but ui has no cookie with shopping cart code so the cart code will have private com.salesmanager.core.model.shoppingcart.ShoppingCartItem createCartItem         }         	         for(ProductAvailability availability : availabilities) {         	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() ==0) {                 throw new Exception( "Item with id " + product.getId() + " is not available");         	}         } private com.salesmanager.core.model.shoppingcart.ShoppingCartItem createCartItem         }         	         for(ProductAvailability availability : availabilities) {         	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() ==0) {                 throw new Exception( "Item with id " + product.getId() + " is not available");         	}         } public ShoppingCartData updateCartItem( final Long itemID, final String cartId,         return null;     }          @SuppressWarnings("unchecked") 	@Override     public ShoppingCartData updateCartItems( final List<ShoppingCartItem> shoppingCartItems, final MerchantStore store, final Language language )             throws Exception         { public ReadableShoppingCart addToCart(PersistableShoppingCartItem item, Merchant 	} 	  	@SuppressWarnings("unchecked") 	@Override 	public void removeShoppingCartItem(String cartCode, Long productId, 	      MerchantStore merchant, Language language) throws Exception { public ReadableShoppingCart addToCart(Customer customer, PersistableShoppingCart 		 		Validate.notNull(customer,"Customer cannot be null"); 		Validate.notNull(customer.getId(),"Customer.id cannot be null or empty"); 		 		//Check if customer has an existing shopping cart 		ShoppingCart cartModel = shoppingCartService.getByCustomer(customer); 		

Fixed version (after fix):
 public ShoppingCartData addItemsToShoppingCart( final ShoppingCartData shoppingC     {          ShoppingCart cartModel = null;         if(item.getQuantity() < 1) item.setQuantity(1);         /**          * Sometimes a user logs in and a shopping cart is present in db (shoppingCartData          * but ui has no cookie with shopping cart code so the cart code will have private com.salesmanager.core.model.shoppingcart.ShoppingCartItem createCartItem         }         	         for(ProductAvailability availability : availabilities) {         	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() <= 0) {                 throw new Exception( "Item with id " + product.getId() + " is not available");         	}         } private com.salesmanager.core.model.shoppingcart.ShoppingCartItem createCartItem         }         	         for(ProductAvailability availability : availabilities) {         	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() <= 0) {                 throw new Exception( "Item with id " + product.getId() + " is not available");         	}         } public ShoppingCartData updateCartItem( final Long itemID, final String cartId,         return null;     }          @Override     public ShoppingCartData updateCartItems( final List<ShoppingCartItem> shoppingCartItems, final MerchantStore store, final Language language )             throws Exception         { public ReadableShoppingCart addToCart(PersistableShoppingCartItem item, Merchant 	} 	  	@Override 	public void removeShoppingCartItem(String cartCode, Long productId, 	      MerchantStore merchant, Language language) throws Exception { public ReadableShoppingCart addToCart(Customer customer, PersistableShoppingCart 		 		Validate.notNull(customer,"Customer cannot be null"); 		Validate.notNull(customer.getId(),"Customer.id cannot be null or empty"); 		if(item.getQuantity() < 1) item.setQuantity(1); 		//Check if customer has an existing shopping cart 		ShoppingCart cartModel = shoppingCartService.getByCustomer(customer); 		

Patch:
patch: @@ -108,7 +108,7 @@ public ShoppingCartData addItemsToShoppingCart( final ShoppingCartData shoppingC
     {
 
         ShoppingCart cartModel = null;
-        
+        if(item.getQuantity() < 1) item.setQuantity(1);
         /**
          * Sometimes a user logs in and a shopping cart is present in db (shoppingCartData
          * but ui has no cookie with shopping cart code so the cart code will have
@@ -216,7 +216,7 @@ private com.salesmanager.core.model.shoppingcart.ShoppingCartItem createCartItem
         }
         	
         for(ProductAvailability availability : availabilities) {
-        	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() ==0) {
+        	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() <= 0) {
                 throw new Exception( "Item with id " + product.getId() + " is not available");
         	}
         }
@@ -288,7 +288,7 @@ private com.salesmanager.core.model.shoppingcart.ShoppingCartItem createCartItem
         }
         	
         for(ProductAvailability availability : availabilities) {
-        	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() ==0) {
+        	if(availability.getProductQuantity() == null || availability.getProductQuantity().intValue() <= 0) {
                 throw new Exception( "Item with id " + product.getId() + " is not available");
         	}
         }
@@ -554,8 +554,7 @@ public ShoppingCartData updateCartItem( final Long itemID, final String cartId,
         return null;
     }
     
-    @SuppressWarnings("unchecked")
-	@Override
+    @Override
     public ShoppingCartData updateCartItems( final List<ShoppingCartItem> shoppingCartItems, final MerchantStore store, final Language language )
             throws Exception
         {
@@ -720,7 +719,6 @@ public ReadableShoppingCart addToCart(PersistableShoppingCartItem item, Merchant
 	}
 	
 
-	@SuppressWarnings("unchecked")
 	@Override
 	public void removeShoppingCartItem(String cartCode, Long productId,
 	      MerchantStore merchant, Language language) throws Exception {
@@ -914,7 +912,7 @@ public ReadableShoppingCart addToCart(Customer customer, PersistableShoppingCart
 		
 		Validate.notNull(customer,"Customer cannot be null");
 		Validate.notNull(customer.getId(),"Customer.id cannot be null or empty");
-		
+		if(item.getQuantity() < 1) item.setQuantity(1);
 		//Check if customer has an existing shopping cart
 		ShoppingCart cartModel = shoppingCartService.getByCustomer(customer);
path: sm-shop/src/main/java/com/salesmanager/shop/store/controller/shoppingCart/facade/ShoppingCartFacadeImpl.java