req.body being overwritten

[jamesblack]

55 introduced a bug where it would overwrite req.body even if it didn't make sense.

The offending block of code is

               switch (parameter.in) {
                    case 'path':
                    case 'query':
                        isPath = true;
                        value = req.params[parameter.name];
                        break;
                    case 'header':
                        value = req.get(parameter.name);
                        break;
                    case 'body':
                    case 'formData':
                        isBody = true;
                        value = req.body;
                }

                validate(value, function (error, newvalue) {
                    if (error) {
                        res.statusCode = 400;
                        next(error);
                        return;
                    }

                    if (isPath) {
                        req.params[parameter.name] = newvalue;
                    }

                    if (isBody) {
                      req.body = newvalue;
                    }

                    next();
                });

I had a request that took a username, password, remeber_me, it would loop through each of these things and run the validator against them, each time this would force the entire req.body to be the last thing validated, which in my case was remeber_me, causing my req.body to just be true, in the handlers.

I believe that the ACTUAL bug here is

                    case 'body':
                    case 'formData':
                        isBody = true;
                        value = req.body;

formData is not a singular entry like body, and it shouldn't be considered body. I think that isBody should be put in the case of body only, not in the case of formData.

ALSO while investigating this I realized that this is even worse if you are using non-object formData types, because enjoi will string them, turning your req.body, into a "[object Object]" as a string, which then means your req.body will be a string of "[object Object]" and you will find yourself cursing the weekend for changing your code.

I will be submitting my proposed fix for this bug shortly.

[tlivings]

Is this resolved?

[jamesblack]

Yep thanks

— Sent from Mailbox

On Tue, Jun 2, 2015 at 8:27 AM, Trevor notifications@github.com wrote:

Is this resolved?

Reply to this email directly or view it on GitHub: https://github.com/krakenjs/swaggerize-express/issues/61#issuecomment-107972764