findOne ignore invalid parameter instead of throw an error

[janmisek1]

Issue type:

[ ] question
[x] bug report
[ ] feature request
[ ] documentation issue

Database system/driver:

[ ] cordova
[ ] mongodb
[ ] mssql
[x ] mysql / mariadb
[ ] oracle
[ ] postgres
[ ] sqlite
[ ] sqljs
[ ] react-native
[ ] expo

TypeORM version:

[x] latest
[ ] @next
[ ] 0.x.x (or put your version here)

Steps to reproduce or a small repository showing the problem:

Hello, I have entity

export class FilesFolders {
    @PrimaryGeneratedColumn()
    public id: number

    @ManyToOne(type => Files, file => file.id)
    @JoinColumn() 
    file: Files

    @ManyToOne(type => Folders, folder => folder.id)
    @JoinColumn() 
    branch: Folders
}

Which alowed map files to folders. One file could be in many folders.

But I have done typing error "banch" instead "bRanch" when retrieving data:

filesFolder = await filesFoldersRepository.findOne({where: {file: args.id, banch: args.oldBranchId}, relations: ['file', 'branch'] }) as FilesFolders

but this found first result and ingnored invalid (typing error) parameter. I thing it shoul throw error like "Unknown column 'banchId' in 'where clause'! "

[nghenglim]

Same here on version 0.2.9, I believe it happen in all the find, quite a security issue

Update: the problem is inside the querybuilder, it uses findColumnsWithPropertyPath which ignore the column if not found, but seems to affect a lot of other place if want to fix

[nghenglim]

found in typeorm/src/metadata/EntityMetadata.ts master

/**
     * Finds columns with a given property path.
     * Property path can match a relation, and relations can contain multiple columns.
     */
    findColumnsWithPropertyPath(propertyPath: string): ColumnMetadata[] {
        const column = this.columns.find(column => column.propertyPath === propertyPath);
        if (column)
            return [column];

        // in the case if column with property path was not found, try to find a relation with such property path
        // if we find relation and it has a single join column then its the column user was seeking
        const relation = this.relations.find(relation => relation.propertyPath === propertyPath);
        if (relation && relation.joinColumns)
            return relation.joinColumns;

        return [];
    }

Since we are using typeorm I believe type safety and result correctness is what we care, return [] when not found seems dangerous.

[pleerock]

I think we can throw an exception in the case if we find not exist column.

[vlapo]

Closing in favor of #3416