Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions lib/query.js
Original file line number Diff line number Diff line change
Expand Up @@ -2368,7 +2368,37 @@ Query.prototype._castConditions = function() {

if (sanitizeFilterOpt) {
sanitizeFilter(this._conditions);

}
function _isSimpleEqualityFilter(filter, model) {
if (!filter || typeof filter !== 'object' || Array.isArray(filter)) return false;
const keys = Object.keys(filter);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isn't that expensive to create an array instead of a for loop ?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@billouboq
This approach is crucial for correctly validating the filter structure because it offers two key safety guarantees:
It guarantees iteration only over the object's own enumerable properties.
It automatically excludes inherited properties (which a standard for...in loop would include without an extra hasOwnProperty check).

if (keys.length === 0) return false;

for (let i = 0; i < keys.length; ++i) {
const k = keys[i];
if (k.charAt(0) === '$') return false;

const v = filter[k];
if (v === null) continue;

const t = typeof v;
if (t === 'string' || t === 'number' || t === 'boolean' || v instanceof RegExp) {
const schemaType = model && model.schema ? model.schema.path(k) : null;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't check if the t lines up with schemaType. If you pass in email: 42 this will skip casting number 42 to a string.

if (schemaType && schemaType.instance && /ObjectId/i.test(schemaType.instance)) return false;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also wouldn't handle if schemaType is an object, array, or map.

continue;
}

return false;
}

return true;
}

if (_isSimpleEqualityFilter(this._conditions, this.model)) {
return;
}


try {
this.cast(this.model);
Expand Down