Array is being stored as [object Object] in v5.1.6
#1694
Comments
|
@daniellockyer can I have your attention on this please? It's breaking since that vulner.. fix. |
|
I have seen the same thing with date being saved as |
|
@syl-oh that's kind of a workaround then, This change should have been introduced as BREAKING by maintainers if they expect us to change all those affected type (date, object etc.). |
Also seeing this with arrays since the vulnerability fix, but not only returned as this, but the actual value stored in the DB file is |
shubhamp-sf
changed the title
[object Object] in v5.1.6[object Object] in v5.1.6
refs GHSA-jqv5-7xpx-qj74 fixes TryGhost/Toolbox#491 - when you call `ToString()` on `Napi::Value`, it calls `napi_coerce_to_string` underneath, which has the ability to run arbitrary JS code if the passed in value is a crafted object - both remote code execution or denial-of-service are possible via this vulnerability - `toString()` on an Object returns `[object Object]` so instead of calling the function, we're going to hardcode it to prevent this issue Credits: Dave McDaniel of Cisco Talos
Due to a bug in the latest version: TryGhost/node-sqlite3#1694 Signed-off-by: Shubham P <[email protected]>
Due to a bug in the latest version: TryGhost/node-sqlite3#1694 Signed-off-by: Shubham P <[email protected]>
|
@daniellockyer Can you please fix it? It's a major bug. |
|
Even if stringifying arguments were an actual security vulnerability (it isn't), the correct fix would have been to throw a TypeError, not silently corrupt user data. Nobody wants to insert "[object Object]" into a database. |
Issue Summary
This package had a vulnerability from v5.0.0 - v5.1.4, which is said to be fixed by this commit and published starting the version 5.1.6, but this version came with a breaking change i.e. an array is being stored as
[object Object]. As can be seen in sample.log in my reproduction code whereas the same works in5.1.4.Steps to Reproduce
Reproduction repo: https://github.com/shubhamp-sf/sequelize-x-sqlite3-5.1.6
Version
5.1.6
Node.js Version
v18.15.0
How did you install the library?
Using npm on Darwin arm64 based machine.
The text was updated successfully, but these errors were encountered: