VNX-1284: Improper Validation of Specified Quantity in Input

A quantity the client chose (a request field named quantity, qty, amount, units, credits, points, coins, num_items, deposit or withdraw/withdrawal) is used in a balance, stock or price calculation, or stored on an order, cart or wallet record, with no check that it is positive and within limits, so a negative or huge value moves money the wrong way, creates stock or overflows a total. Reported in Python (Flask/Django/DRF request.args/form/values/json/GET/POST/data/query_params) and JavaScript/TypeScript (req.body/query/params, including const { quantity } = req.body): the value, inline or through a variable assigned from it in the 20 lines above (including a TypeScript-annotated const), used in x += / -= / *= arithmetic, a $inc update, a multiplication, an x = y + / - arithmetic assignment, or as a quantity-named field (or shorthand property) of an ORM create/update/insert/save/build/upsert, $inc or $set. Not reported: a comparison of the value (<, <=, >, >=, in range(...)) or a max()/abs()/clamp/positive check between the read and the use, a file that validates with a schema (Joi/yup/zod .positive() or .min(0|1), pydantic conint/confloat/PositiveInt/gt=0/ge=1, express-validator isInt/isFloat({ min | gt })), the local assignment that reads the value, a value that is only displayed, counts and page sizes (judged by VNX-400 and VNX-606), a client amount credited to a balance or booked as an order total that VNX-840 reports (Client-Controlled Monetary Value, such as dst.balance += int(request.form["amount"]) or { $inc: { balance: -amount } } in a payment or wallet handler): that line is reported by VNX-840, so the negative-amount transfer is one finding rather than two, and text in comments and strings.

product.stock += int(request.form["quantity"])

qty = int(request.POST.get("quantity", 1))
total = product.price * qty

const { productId, quantity } = req.body;
await CartItem.create({ productId, quantity });

const { points } = req.body;
await Member.updateOne({ _id: id }, { $inc: { points: -points } });

# nosec vnx-1284
// nosec vnx-1284