ifttt: Ensure topic and body are strings, and not dicts / arrays.

zerver/webhooks/ifttt/fixtures/invalid_payload_with_dict_content.json

@@ -0,0 +1,4 @@
+{
+  "topic": "Email sent from email@email.com",
+  "content": {"wrong": "example"}
+}

zerver/webhooks/ifttt/fixtures/invalid_payload_with_dict_topic.json

@@ -0,0 +1,4 @@
+{
+  "topic": {"wrong": "example"},
+  "content": "Email subject: Subject"
+}

zerver/webhooks/ifttt/tests.py

@@ -28,3 +28,15 @@ class IFTTTHookTests(WebhookTestCase):
         payload = self.get_body("invalid_payload_with_missing_content")
         result = self.client_post(self.url, payload, content_type="application/json")
         self.assert_json_error(result, "Content can't be empty")
+
+    def test_ifttt_when_topic_is_dict(self) -> None:
+        self.url = self.build_webhook_url()
+        payload = self.get_body("invalid_payload_with_dict_topic")
+        result = self.client_post(self.url, payload, content_type="application/json")
+        self.assert_json_error(result, "Topic must be a string")
+
+    def test_ifttt_when_content_is_dict(self) -> None:
+        self.url = self.build_webhook_url()
+        payload = self.get_body("invalid_payload_with_dict_content")
+        result = self.client_post(self.url, payload, content_type="application/json")
+        self.assert_json_error(result, "Content must be a string")

zerver/webhooks/ifttt/view.py

@@ -29,5 +29,11 @@ def api_iftt_app_webhook(
     if content is None:
         raise JsonableError(_("Content can't be empty"))
 
+    if not isinstance(topic, str):
+        raise JsonableError(_("Topic must be a string"))
+
+    if not isinstance(content, str):
+        raise JsonableError(_("Content must be a string"))
+
     check_send_webhook_message(request, user_profile, topic, content)
     return json_success()