Parameter manipulation vulnerability

[vanFrZy]

In the following code snippet, the parameter quantity is unchecked, meaning an attacker can inject a negative quantity into the request. This results in the cart being updated with a negative value which can be seen in the picture below.

  const handleAddToCart = async (productId, quantity) => {
    const item = await commerce.cart.add(productId, quantity);
    setCart(item.cart);
  };

A simple fix could be

  const handleAddToCart = async (productId, quantity) => {
    if (quantity > 0) {
        const item = await commerce.cart.add(productId, quantity);
        setCart(item.cart);
    }
    else { 
         // throw some error
      }
  };