GET request of schema inputs causes error

[chimmelb]

Name of Issue

GET request of schema inputs throw error.
Workaround is to use POST or write middleware (example below)

• ActionHero Version: 16.0.5
• Node.js Version: 7.4.0
• Operating System OSX

Steps to reproduce your error

• Make a new actionhero project with ./node_modules/.bin/actionhero generate

./node_modules/.bin/actionhero generate action --name="schemaTest" --description="this action tests schema parameters with a GET request"

• create an action with the follwing content...

inputs: {
    goodInput: {},
    schemaInput: {
      required: true,
      default: {},
      schema: {
        in1: {},
        in2: {}
      }
    }
  },

Run a curl request:

curl "localhost:8080/api/schemaTest?goodInput=10&schemaInput=%7B%22in1%22%3A1%2C%22in2%22%3A%22in2%22%7D"

This is a URL encoded JSON object {"in1":1,"in2":"in2"} and I receive this error:

/Users/chimmelberger/Documents/workspace/ah-get-schema-params/node_modules/actionhero/initializers/actionProcessor.js:184
            delete params[p]
                          ^

TypeError: Cannot delete property '0' of [object String]
    at api.ActionProcessor.reduceParams (/Users/chimmelberger/Documents/workspace/ah-get-schema-params/node_modules/actionhero/initializers/actionProcessor.js:184:27)
    at Object.keys.forEach (/Users/chimmelberger/Documents/workspace/ah-get-schema-params/node_modules/actionhero/initializers/actionProcessor.js:255:16)
    at Array.forEach (native)
    at api.ActionProcessor.validateParams (/Users/chimmelberger/Documents/workspace/ah-get-schema-params/node_modules/actionhero/initializers/actionProcessor.js:250:27)
    at preProcessAction (/Users/chimmelberger/Documents/workspace/ah-get-schema-params/node_modules/actionhero/initializers/actionProcessor.js:291:14)

POSTing a request works fine:

curl http://localhost:8080/api/schemaTest -H "Content-Type:application/json" -X POST -d '{"company":{"goodInput":10,"schemaInput":{"in1":1,"in2":"in2"}}}'

I thought to create a middleware to error 405 Method Not Allowed, but this occurs in the input processing of an action after preProcessor middleware. https://github.com/actionhero/actionhero/blob/v16.0.5/initializers/actionProcessor.js#L289-L291, so the validation is run on error anyway.

A workaround is to add some parsing middleware like this:

var parseSchemaInputStrings = {
      name: 'parseSchemaInputStrings',
      global: true,
      priority: 1000,
      preProcessor: function (data, next) {
        for (var prop in data.params) {
          if (data.actionTemplate.inputs[prop] &&
              data.actionTemplate.inputs[prop].schema &&
              typeof data.params[prop] === 'string') {
            try {
              data.params[prop] = JSON.parse(data.params[prop])
            } catch (err) {
              return next(new Error('Parameter ' + prop + ' must be a valid JSON object'))
            }
          }
        }
        next()
      }
    }

    api.actions.addMiddleware(parseSchemaInputStrings)

Of course, invalid JSON will throw and like any middleware that validation will still be run and hit the bug.

Copying @witem for ideas.

[evantahler]

@chimmelb your middleware seems like a good option for a fix, especially because it only messes with schema-type actions.

[witem]

Thanks for issue.
I can create PR for fix error. But I not sure about add JSON.parse.

[chimmelb]

I'm using that middleware I posted so this isn't a showstopper, but thought I'd report it. If the schema input wasn't an object, I could see rejecting the entire action (and I'd still need my JSON.parse middleware, but at least you could avoid the server crash)

[evantahler]

BTW, I think the source of the difference in behavior between GET and everything else is here https://github.com/actionhero/actionhero/blob/master/servers/web.js#L481-L489

We try to parse uploaded params as a form, which de-URL encodes them, and sorts them out... only when it is not a GET or HEAD. Perhaps we need to also try to parse URL params in a similar way. The more I think about this, the more this might be a server issue and not an action issue.

[chimmelb]

I did notice that inside middleware the schema input was a JSON string, not an URL encoded string. It is getting decoded, just not JSON.parsed.