@mikro-orm/core 6.6.16-dev.1 → 6.6.16

package/entity/EntityAssigner.js

@@ -37,6 +37,10 @@ class EntityAssigner {
         return entity;
     }
     static assignProperty(entity, propName, props, data, options) {
+        // needs to happen before the `props` lookup, as those keys resolve to inherited accessors
+        if (Utils_1.DANGEROUS_PROPERTY_NAMES.includes(propName)) {
+            return;
+        }
         let value = data[propName];
         const onlyProperties = options.onlyProperties && !(propName in props);
         const ignoreUndefined = options.ignoreUndefined === true && value === undefined;

package/index.mjs

@@ -39,6 +39,7 @@ export const ConstraintViolationException = mod.ConstraintViolationException;
 export const CreateRequestContext = mod.CreateRequestContext;
 export const Cursor = mod.Cursor;
 export const CursorError = mod.CursorError;
+export const DANGEROUS_PROPERTY_NAMES = mod.DANGEROUS_PROPERTY_NAMES;
 export const DatabaseDriver = mod.DatabaseDriver;
 export const DatabaseObjectExistsException = mod.DatabaseObjectExistsException;
 export const DatabaseObjectNotFoundException = mod.DatabaseObjectNotFoundException;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "6.6.16-dev.1",
+  "version": "6.6.16",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "main": "index.js",
   "module": "index.mjs",
@@ -64,7 +64,7 @@
     "esprima": "4.0.1",
     "fs-extra": "11.3.3",
     "globby": "11.1.0",
-    "mikro-orm": "6.6.16-dev.1",
+    "mikro-orm": "6.6.16",
     "reflect-metadata": "0.2.2"
   }
 }

package/utils/Utils.d.ts

@@ -4,6 +4,18 @@ import type { Collection } from '../entity/Collection';
 import type { Platform } from '../platforms';
 import { ScalarReference } from '../entity/Reference';
 export declare const ObjectBindingPattern: unique symbol;
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export declare const DANGEROUS_PROPERTY_NAMES: readonly string[];
 export declare function compareObjects(a: any, b: any): boolean;
 export declare function compareArrays(a: any[] | string, b: any[] | string): boolean;
 export declare function compareBooleans(a: unknown, b: unknown): boolean;

package/utils/Utils.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Utils = exports.ObjectBindingPattern = void 0;
+exports.Utils = exports.DANGEROUS_PROPERTY_NAMES = exports.ObjectBindingPattern = void 0;
 exports.compareObjects = compareObjects;
 exports.compareArrays = compareArrays;
 exports.compareBooleans = compareBooleans;
@@ -26,6 +26,18 @@ const Reference_1 = require("../entity/Reference");
 const ArrayCollection_1 = require("../entity/ArrayCollection");
 const EntityHelper_1 = require("../entity/EntityHelper");
 exports.ObjectBindingPattern = Symbol('ObjectBindingPattern');
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+exports.DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 function compareConstructors(a, b) {
     if (a.constructor === b.constructor) {
         return true;
@@ -293,7 +305,7 @@ class Utils {
         const source = sources.shift();
         if (Utils.isObject(target) && Utils.isPlainObject(source)) {
             for (const [key, value] of Object.entries(source)) {
-                if (['__proto__', 'constructor', 'prototype'].includes(key)) {
+                if (exports.DANGEROUS_PROPERTY_NAMES.includes(key)) {
                     continue;
                 }
                 if (ignoreUndefined && typeof value === 'undefined') {