Language: TypeScript
Label: vulnerable
CWE: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Code:
exports.handler = async ({ arguments: args }) => {
    if (!args)
        return respondWithError("Internal error while trying to execute lease task.", "Event arguments missing.");
    if (!args.action)
        return respondWithError("Internal error while trying to execute lease task.", "Parameter 'action' missing.");

    let params;
    if (args.paramJson) {
        try {
            params = JSON.parse(args.paramJson);
        } catch (e) {
            return respondWithError("'paramJson' contains malformed JSON string.");
        }
    }

    try {
        switch (args.action) {
            case "getAwsLoginUrlForEvent":
                return getAwsLoginUrlForEvent(params);
            case "getAwsLoginUrlForLease":
                return getAwsLoginUrlForLease(params);
            default:
                throw new Error("unknown API action '" + args.action + "'");
        }
    } catch (error) {
        return respondWithError("Internal error while trying to execute login task.", error);
    }
};