parameter and commandType in sending commands accept almost all strings

[yudai-nkt]

Describe The Bug:

As far as I investigate, current API accepts any strings but customize as a value for commandType of all devices except for the "Others" IR device. The same thing happens with parameter as well.

To Reproduce:

Send a control command request which satisfies the condition above. E.g., sending a turn-on commands for TV with commandType (resp. parameter) set to foo (resp. bar):

curl -H "Authorization:[MY_API_KEY]"  https://api.switch-bot.com/v1.0/devices/[MY_TV_ID]/commands \
-H "Content-Type: application/json" \
-X POST -d '{"command":"turnOn","commandType":"foo","parameter":"bar"}'

This will return {"statusCode":100,"body":{},"message":"success"} and the TV turns on indeed.

Expected behavior:

I expect a failure response would be returned.

I know the API documentation says that parameter and commandType are not required, but I don't think "not required" means it accepts values including nonsense ones. Optional parameters just have certain fallback values when they are not explicitly specified.

Screenshots:

N/A

Device Model:

N/A

SwitchBotAPI

• Use Case: just found this phenomena while developing a client package. No specific use case is assumed.