@lenne.tech/nest-server 11.20.0 → 11.20.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.20.0",
+  "version": "11.20.1",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",

package/src/core/common/helpers/db.helper.ts

@@ -550,6 +550,7 @@ export function removeUnresolvedReferences<T = any>(
   populated: T,
   populatedOptions: (PopulateOptions | string)[] | PopulateOptions | PopulateOptions[] | string,
   ignoreFirst = true,
+  visited: WeakSet<object> = new WeakSet(),
 ): T {
   // Check parameter
   if (!populated || !populatedOptions) {
@@ -558,21 +559,24 @@ export function removeUnresolvedReferences<T = any>(
 
   // Process array
   if (Array.isArray(populated)) {
-    populated.forEach((p) => removeUnresolvedReferences(p, populatedOptions, false));
+    if (visited.has(populated)) return populated;
+    visited.add(populated);
+    populated.forEach((p) => removeUnresolvedReferences(p, populatedOptions, false, visited));
     return populated;
   }
 
   // Process object
   if (typeof populated === 'object') {
-    // populatedOptions is an array
+    // populatedOptions is an array — iterate options for the same object
+    // Each option targets a different property path, so do not mark populated as visited here
     if (Array.isArray(populatedOptions)) {
       populatedOptions.forEach((po) =>
-        removeUnresolvedReferences(populated, ignoreFirst && typeof po === 'object' ? po.populate : po, false),
+        removeUnresolvedReferences(populated, ignoreFirst && typeof po === 'object' ? po.populate : po, false, visited),
       );
       return populated;
     }
 
-    // populatedOptions is a string
+    // populatedOptions is a string — leaf operation, no deep recursion risk
     if (typeof populatedOptions === 'string') {
       if (!['_id', 'id'].includes(populatedOptions) && populated[populatedOptions] instanceof Types.ObjectId) {
         populated[populatedOptions] = null;
@@ -580,13 +584,16 @@ export function removeUnresolvedReferences<T = any>(
       return populated;
     }
 
-    // populatedOptions is an PopulateOptions object
+    // populatedOptions is a PopulateOptions object
     if (populatedOptions.path) {
       const key = populatedOptions.path;
       if (!['_id', 'id'].includes(key) && populated[key] instanceof Types.ObjectId) {
         populated[key] = null;
       } else if (populatedOptions.populate) {
-        removeUnresolvedReferences(populated[key], populatedOptions.populate, false);
+        // Prevent circular reference loops when descending into nested populates
+        if (visited.has(populated as object)) return populated;
+        visited.add(populated as object);
+        removeUnresolvedReferences(populated[key], populatedOptions.populate, false, visited);
       }
     }
   }

package/src/core/common/helpers/input.helper.ts

@@ -413,12 +413,16 @@ export function combinePlain(...args: Record<any, any>[]): any {
 /**
  * Get deep frozen object
  */
-export function deepFreeze(object: any) {
+export function deepFreeze(object: any, visited: WeakSet<object> = new WeakSet()) {
   if (!object || typeof object !== 'object') {
     return object;
   }
+  if (visited.has(object)) {
+    return object;
+  }
+  visited.add(object);
   for (const [key, value] of Object.entries(object)) {
-    object[key] = deepFreeze(value);
+    object[key] = deepFreeze(value, visited);
   }
   return Object.freeze(object);
 }

package/src/core/common/interceptors/check-security.interceptor.ts

@@ -116,17 +116,25 @@ export class CheckSecurityInterceptor implements NestInterceptor {
       const proto = Object.getPrototypeOf(val);
       return proto === null || proto === Object.prototype || typeof val.constructor === 'function';
     };
+    const visited = new WeakSet();
     const removeSecrets = (data: any) => {
       if (!this.config.removeSecretFields || !data || typeof data !== 'object') {
         return data;
       }
       if (Array.isArray(data)) {
+        if (visited.has(data)) return data;
+        visited.add(data);
         data.forEach(removeSecrets);
         return data;
       }
       if (!isPlainLike(data)) {
         return data;
       }
+      // Prevent infinite recursion on circular references
+      if (visited.has(data)) {
+        return data;
+      }
+      visited.add(data);
       for (const field of this.config.secretFields) {
         if (field in data && data[field] !== undefined) {
           data[field] = undefined;