Add options validation

hassio/api/homeassistant.py

@@ -2,11 +2,17 @@
 import asyncio
 import logging
 
-from .util import api_process, json_loads
+import voluptuous as vol
+
+from .util import api_process, api_validate
 from ..const import ATTR_VERSION, ATTR_CURRENT
 
 _LOGGER = logging.getLogger(__name__)
 
+SCHEMA_VERSION = vol.Schema({
+    vol.Optional(ATTR_VERSION): vol.Coerce(str),
+})
+
 
 class APIHomeAssistant(object):
     """Handle rest api for homeassistant functions."""
@@ -30,7 +36,7 @@ class APIHomeAssistant(object):
     @api_process
     async def update(self, request):
         """Update host OS."""
-        body = await request.json(loads=json_loads)
+        body = await api_validate(SCHEMA_VERSION, request)
         version = body.get(ATTR_VERSION, self.config.current_homeassistant)
 
         if self.dock_hass.in_progress:

hassio/api/host.py

@@ -1,13 +1,19 @@
 """Init file for HassIO host rest api."""
 import logging
 
-from .util import api_process_hostcontroll, api_process, json_loads
+import voluptuous as vol
+
+from .util import api_process_hostcontroll, api_process, api_validate
 from ..const import ATTR_VERSION
 
 _LOGGER = logging.getLogger(__name__)
 
 UNKNOWN = 'unknown'
 
+SCHEMA_VERSION = vol.Schema({
+    vol.Optional(ATTR_VERSION): vol.Coerce(str),
+})
+
 
 class APIHost(object):
     """Handle rest api for host functions."""
@@ -46,7 +52,7 @@ class APIHost(object):
     @api_process_hostcontroll
     async def update(self, request):
         """Update host OS."""
-        body = await request.json(loads=json_loads)
+        body = await api_validate(SCHEMA_VERSION, request)
         version = body.get(ATTR_VERSION)
 
         if version == self.host_controll.version:

hassio/api/supervisor.py

@@ -1,11 +1,21 @@
 """Init file for HassIO supervisor rest api."""
 import logging
 
-from .util import api_process, api_process_hostcontroll, json_loads
+import voluptuous as vol
+
+from .util import api_process, api_process_hostcontroll, api_validate
 from ..const import ATTR_VERSION, ATTR_CURRENT, ATTR_BETA, HASSIO_VERSION
 
 _LOGGER = logging.getLogger(__name__)
 
+SCHEMA_OPTIONS = vol.Schema({
+    vol.Optional(ATTR_BETA): vol.Boolean(),
+})
+
+SCHEMA_VERSION = vol.Schema({
+    vol.Optional(ATTR_VERSION): vol.Coerce(str),
+})
+
 
 class APISupervisor(object):
     """Handle rest api for supervisor functions."""
@@ -35,7 +45,7 @@ class APISupervisor(object):
     @api_process
     async def options(self, request):
         """Set supervisor options."""
-        body = await request.json(loads=json_loads)
+        body = await api_validate(SCHEMA_OPTIONS, request)
 
         if ATTR_BETA in body:
             self.config.upstream_beta = body[ATTR_BETA]
@@ -45,7 +55,7 @@ class APISupervisor(object):
     @api_process_hostcontroll
     async def update(self, request):
         """Update host OS."""
-        body = await request.json(loads=json_loads)
+        body = await api_validate(SCHEMA_VERSION, request)
         version = body.get(ATTR_VERSION, self.config.current_hassio)
 
         if version == HASSIO_VERSION:

hassio/api/util.py

@@ -4,6 +4,8 @@ import logging
 
 from aiohttp import web
 from aiohttp.web_exceptions import HTTPServiceUnavailable
+import voluptuous as vol
+from voluptuous.humanize import humanize_error
 
 from ..const import (
     JSON_RESULT, JSON_DATA, JSON_MESSAGE, RESULT_OK, RESULT_ERROR)
@@ -74,3 +76,14 @@ def api_return_ok(data=None):
         JSON_RESULT: RESULT_OK,
         JSON_DATA: data or {},
     })
+
+
+async def api_validate(schema, request):
+    """Validate request data with schema."""
+    data = await request.json(loads=json_loads)
+    try:
+        schema(data)
+    except vol.Invalid as ex:
+        raise RuntimeError(humanize_error(data, ex)) from None
+
+    return data

setup.py

@@ -36,5 +36,6 @@ setup(
         'aiohttp',
         'docker',
         'colorlog',
+        'voluptuous',
     ]
 )