From 13725d75767d3e160a2a39dadf2bfb78a31f03db Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Mon, 16 Oct 2023 12:58:33 +0200
Subject: [PATCH] fix app handling

---
 backend/windmill-api/src/apps.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 32c8fd127f..55945c5299 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -798,7 +798,7 @@ async fn update_app(
 
 #[derive(Debug, Deserialize, Clone)]
 pub struct ExecuteApp {
-    pub args: Box<RawValue>,
+    pub args: HashMap<String, Box<RawValue>>,
     // - script: script/<path>
     // - flow: flow/<path>
     pub path: Option<String>,
@@ -1002,11 +1002,11 @@ fn build_args(
     policy: Policy,
     component: &str,
     path: String,
-    args: Box<RawValue>,
-) -> Result<PushArgs<Box<RawValue>>> {
+    args: HashMap<String, Box<RawValue>>,
+) -> Result<PushArgs<HashMap<String, Box<RawValue>>>> {
     // disallow var and res access in args coming from the user for security reasons
-    {
-        let args_str = args.to_string();
+    for (_, v) in &args {
+        let args_str = serde_json::to_string(&v).unwrap_or_else(|_| "".to_string());
         if args_str.contains("$var:") || args_str.contains("$res:") {
             return Err(Error::BadRequest(format!(
             "For security reasons, variable or resource access is not allowed as dynamic argument"