Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Mongo $and/$or/$nor array items should be validated as objects #20

Open
simonbrunel opened this issue Jun 7, 2021 · 0 comments
Open
Labels
bug Something isn't working

Comments

@simonbrunel
Copy link

MongoDB $and, $nor and $or operators expect array of expressions (i.e. objects):

{ $and: [ { <expression1> }, { <expression2> } , ... , { <expressionN> } ] }
{ $nor: [ { <expression1> }, { <expression2> }, ...  { <expressionN> } ] }
{ $or: [ { <expression1> }, { <expression2> }, ... , { <expressionN> } ] }

However, it seems that the ucast/mongo parser doesn't validate these entries, thus it's possible to call:

parse({ $and: ["foo", 42] })  // e.g. from received HTTP query

No exception thrown but the following condition returned:

{
  "operator": "and",
  "value": [
    {
      "operator": "eq",
      "value": "f",
      "field": "0"
    },
    {
      "operator": "eq",
      "value": "o",
      "field": "1"
    },
    {
      "operator": "eq",
      "value": "o",
      "field": "2"
    }
  ]
}

42 seems to be ignored in this case, probably because Object.keys(42) returns [].

Instead, we should expect an error like Error('"$and" expects value to be an array of objects');

Same applies to calling parse("foo") directly with a non object value, which should be prevented by type checking (i.e. parse expects a record) but can still happen if the value is any. Though I'm not sure if it should be handled by the lib or explicitly by the user, which should make sure to pass an object to parse.

@stalniy stalniy added the bug Something isn't working label Jun 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants