Strange behavior with /prices api endpoint
The payload for the endpoint "https://api.mojang.com/catalog/prices" contains two fields for identifying product and price ID. When these two fields don't match, invalid price data is returned.
To replicate, send a POST request to the above endpoint with no headers, and include the following payload:
[{"locale":"en-us","currency":{"currencyCode":"USD"},"variantId":"desktop_realms_30_days","bundled":false,"quantity":1,"priceId":"minecraft"}]
A simple solution to this would be to return an error if "variantId" and "priceId" don't match. Unsure if there is potential for exploitation here.


2020-09-21, 10:50 PM
2020-12-03, 11:31 AM
2020-12-03, 11:31 AM
0
2