Mojira Archive
WEB-3103

Strange behavior with /prices api endpoint

The payload for the endpoint "https://api.mojang.com/catalog/prices" contains two fields for identifying product and price ID.  When these two fields don't match, invalid price data is returned.

 

To replicate, send a POST request to the above endpoint with no headers, and include the following payload:

[{"locale":"en-us","currency":{"currencyCode":"USD"},"variantId":"desktop_realms_30_days","bundled":false,"quantity":1,"priceId":"minecraft"}] 

A simple solution to this would be to return an error if "variantId" and "priceId" don't match. Unsure if there is potential for exploitation here.

 

 

Fixed

PretendingToCode

[Mojang] Web Team

2020-09-21, 10:50 PM

2020-12-03, 11:31 AM

2020-12-03, 11:31 AM

0

2