FinTech 安全解决方案

1// ✅ Secure payment processing code
2async function processPaymentSecure(amount, accountId) {
3    // Use database transaction with locking
4    return await db.transaction(async (trx) => {
5        // Lock account row to prevent race conditions
6        const account = await trx('accounts')
7            .where('id', accountId)
8            .forUpdate()
9            .first();
10            
11        if (!account || account.balance < amount) {
12            throw new Error("Insufficient funds");
13        }
14        
15        // Atomic balance update
16        await trx('accounts')
17            .where('id', accountId)
18            .decrement('solution-pages.fintech.balance', amount);
19            
20        return await processTransactionSecure(amount, trx);
21    });
22}
23 
24// ✅ Safe integer calculation with bounds checking
25function calculateInterestSecure(principal, rate, time) {
26    // Validate inputs and check for overflow
27    if (principal > Number.MAX_SAFE_INTEGER / rate / time) {
28        throw new Error("Calculation would overflow");
29    }
30    return Math.floor(principal * rate * time * 100) / 100;
31}
32 
33// ✅ Fixed-point arithmetic for financial calculations
34function transferAmountSecure(from, to, amount) {
35    // Use cents to avoid floating point issues
36    const amountCents = Math.round(amount * 100);
37    const feeCents = Math.round(amountCents * 0.1);
38    const netAmountCents = amountCents - feeCents;
39    
40    return {
41        amount: amountCents / 100,
42        fee: feeCents / 100,
43        netAmount: netAmountCents / 100
44    };
45}

1// ❌ Vulnerable payment processing code
2function processPayment(amount, accountId) {
3    // Race condition vulnerability
4    const balance = getAccountBalance(accountId);
5    if (balance >= amount) {
6        // Time-of-check to time-of-use gap
7        sleep(100); // Simulating network delay
8        deductFromAccount(accountId, amount);
9        return processTransaction(amount);
10    }
11    throw new Error("Insufficient funds");
12}
13 
14// ❌ Integer overflow in calculation
15function calculateInterest(principal, rate, time) {
16    return principal * rate * time; // No overflow check
17}
18 
19// ❌ Precision issues with floating point
20function transferAmount(from, to, amount) {
21    const fee = amount * 0.1; // Floating point arithmetic
22    const netAmount = amount - fee;
23    // Could result in: 10.00 - 1.00 = 8.999999999999998
24}

1# ✅ Secure API configuration
2openapi: "3.0.0"
3info:
4  title: Banking API
5  version: "1.0.0"
6security:
7  - BearerAuth: []
8  - ApiKeyAuth: []
9paths:
10  /api/accounts/{accountId}/balance:
11    get:
12      parameters:
13        - name: accountId
14          in: path
15          required: true
16          schema:
17            type: string
18            format: uuid  # Use UUIDs instead of sequential IDs
19            pattern: '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
20      security:
21        - BearerAuth: []
22        - ApiKeyAuth: []
23      responses:
24        '200':
25          description: Account balance (sanitized)
26          content:
27            application/json:
28              schema:
29                type: object
30                properties:
31                  availableBalance:
32                    type: string  # Masked balance range
33                    example: "$1,000 - $5,000"
34                  accountMask:
35                    type: string  # Masked account number
36                    example: "****-****-****-1234"
37                  # No PII or sensitive data exposed

1# ❌ Vulnerable API configuration
2openapi: "3.0.0"
3info:
4  title: Banking API
5  version: "1.0.0"
6paths:
7  /api/accounts/{accountId}/balance:
8    get:
9      parameters:
10        - name: accountId
11          in: path
12          required: true
13          schema:
14            type: string  # No format validation
15      security: []  # No authentication required
16      responses:
17        '200':
18          description: Account balance
19          content:
20            application/json:
21              schema:
22                type: object
23                properties:
24                  balance:
25                    type: number  # Exposes exact balance
26                  accountNumber:
27                    type: string  # Sensitive data exposure
28                  ssn:
29                    type: string  # PII exposure
30                  creditScore:
31                    type: integer # Sensitive financial data