Language: JavaScript
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
exports.handler = async ({ arguments: args }) => {
    if (!args) return respondWithError("Internal error while trying to execute task.", "Event arguments missing.");
    if (!args.action)
        return respondWithError("Internal error while trying to execute task.", "Parameter 'action' missing.");

    let params;
    if (args.paramJson) {
        try {
            params = JSON.parse(args.paramJson);
        } catch (e) {
            return respondWithError("'paramJson' contains malformed JSON string.");
        }
    }

    try {
        switch (args.action) {
            case "listLeases":
                return listLeases();
            case "updateLease":
                return updateLease(params);
            case "createLease":
                return createLease(params);
            case "terminateLease":
                return terminateLease(params);
            case "deleteLease":
                return deleteLease(params);
            case "getStatistics":
                return getStatistics();
            case "listUsage":
                return listUsage();
            default:
                throw new Error("unknown API action '" + args.action + "'");
        }
    } catch (error) {
        return respondWithError("Internal error while trying to execute task.", error);
    }
};