Handle invalid POST to action resources. (#129)

Fixes #128
WebThingsIO · May 4, 2020 · 2247bcf · 2247bcf
1 parent 4a4f14d
commit 2247bcf
Show file tree

Hide file tree

Showing 2 changed files with 44 additions and 32 deletions.
diff --git a/lib/server.js b/lib/server.js
@@ -428,22 +428,28 @@ class ActionsHandler extends BaseHandler {
       return;
     }
 
-    let response = {};
-    for (const actionName in req.body) {
-      let input = null;
-      if (req.body[actionName].hasOwnProperty('input')) {
-        input = req.body[actionName].input;
-      }
+    const keys = Object.keys(req.body);
+    if (keys.length !== 1) {
+      res.status(400).end();
+      return;
+    }
 
-      const action = thing.performAction(actionName, input);
-      if (action) {
-        response = Object.assign(response, action.asActionDescription());
-        action.start();
-      }
+    const actionName = keys[0];
+    let input = null;
+    if (req.body[actionName].hasOwnProperty('input')) {
+      input = req.body[actionName].input;
     }
 
-    res.status(201);
-    res.json(response);
+    const action = thing.performAction(actionName, input);
+    if (action) {
+      const response = action.asActionDescription();
+      action.start();
+
+      res.status(201);
+      res.json(response);
+    } else {
+      res.status(400).end();
+    }
   }
 }
 
@@ -484,26 +490,32 @@ class ActionHandler extends BaseHandler {
 
     const actionName = req.params.actionName;
 
-    let response = {};
-    for (const name in req.body) {
-      if (name !== actionName) {
-        continue;
-      }
+    const keys = Object.keys(req.body);
+    if (keys.length !== 1) {
+      res.status(400).end();
+      return;
+    }
 
-      let input = null;
-      if (req.body[name].hasOwnProperty('input')) {
-        input = req.body[name].input;
-      }
+    if (keys[0] !== actionName) {
+      res.status(400).end();
+      return;
+    }
 
-      const action = thing.performAction(name, input);
-      if (action) {
-        response = Object.assign(response, action.asActionDescription());
-        action.start();
-      }
+    let input = null;
+    if (req.body[actionName].hasOwnProperty('input')) {
+      input = req.body[actionName].input;
     }
 
-    res.status(201);
-    res.json(response);
+    const action = thing.performAction(actionName, input);
+    if (action) {
+      const response = action.asActionDescription();
+      action.start();
+
+      res.status(201);
+      res.json(response);
+    } else {
+      res.status(400).end();
+    }
   }
 }
 

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "webthing",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "HTTP Web Thing implementation",
   "main": "webthing.js",
   "scripts": {
@@ -28,7 +28,7 @@
   },
   "homepage": "https://github.com/mozilla-iot/webthing-node#readme",
   "dependencies": {
-    "ajv": "^6.12.0",
+    "ajv": "^6.12.2",
     "body-parser": "^1.19.0",
     "dnssd": "^0.4.1",
     "express": "^4.17.1",
@@ -37,6 +37,6 @@
   "devDependencies": {
     "babel-eslint": "^10.1.0",
     "eslint": "^6.8.0",
-    "uuid": "^7.0.2"
+    "uuid": "^8.0.0"
   }
 }