@mikro-orm/core 7.0.0-dev.128 → 7.0.0-dev.129

package/errors.d.ts

@@ -62,6 +62,7 @@ export declare class MetadataError<T extends AnyEntity = AnyEntity> extends Vali
     static nonPersistentCompositeProp(meta: EntityMetadata, prop: EntityProperty): MetadataError<Partial<any>>;
     static propertyTargetsEntityType(meta: EntityMetadata, prop: EntityProperty, target: EntityMetadata): MetadataError<Partial<any>>;
     static fromMissingOption(meta: EntityMetadata, prop: EntityProperty, option: string): MetadataError<Partial<any>>;
+    static dangerousPropertyName(meta: EntityMetadata, prop: EntityProperty): MetadataError<Partial<any>>;
     private static fromMessage;
 }
 export declare class NotFoundError<T extends AnyEntity = AnyEntity> extends ValidationError<T> {

package/errors.js

@@ -213,6 +213,9 @@ export class MetadataError extends ValidationError {
     static fromMissingOption(meta, prop, option) {
         return this.fromMessage(meta, prop, `is missing '${option}' option`);
     }
+    static dangerousPropertyName(meta, prop) {
+        return this.fromMessage(meta, prop, `uses a dangerous property name '${prop.name}' which could lead to prototype pollution. Please use a different property name.`);
+    }
     static fromMessage(meta, prop, message) {
         return new MetadataError(`${meta.className}.${prop.name} ${message}`);
     }

package/metadata/MetadataValidator.d.ts

@@ -14,4 +14,13 @@ export declare class MetadataValidator {
     private validateIndexes;
     private validateDuplicateFieldNames;
     private validateVersionField;
+    /**
+     * Validates that entity properties do not use dangerous names that could lead to
+     * prototype pollution vulnerabilities. This validation ensures that property names
+     * cannot be exploited to modify object prototypes when values are assigned during
+     * entity hydration or persistence operations.
+     *
+     * @internal
+     */
+    private validatePropertyNames;
 }

package/metadata/MetadataValidator.js

@@ -1,6 +1,18 @@
 import { Utils } from '../utils/Utils.js';
 import { MetadataError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 /**
  * @internal
  */
@@ -26,6 +38,7 @@ export class MetadataValidator {
         this.validateDuplicateFieldNames(meta, options);
         this.validateIndexes(meta, meta.indexes ?? [], 'index');
         this.validateIndexes(meta, meta.uniques ?? [], 'unique');
+        this.validatePropertyNames(meta);
         for (const prop of Utils.values(meta.properties)) {
             if (prop.kind !== ReferenceKind.SCALAR) {
                 this.validateReference(meta, prop, options);
@@ -193,4 +206,19 @@ export class MetadataValidator {
             throw MetadataError.invalidVersionFieldType(meta);
         }
     }
+    /**
+     * Validates that entity properties do not use dangerous names that could lead to
+     * prototype pollution vulnerabilities. This validation ensures that property names
+     * cannot be exploited to modify object prototypes when values are assigned during
+     * entity hydration or persistence operations.
+     *
+     * @internal
+     */
+    validatePropertyNames(meta) {
+        for (const prop of Utils.values(meta.properties)) {
+            if (DANGEROUS_PROPERTY_NAMES.includes(prop.name)) {
+                throw MetadataError.dangerousPropertyName(meta, prop);
+            }
+        }
+    }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mikro-orm/core",
   "type": "module",
-  "version": "7.0.0-dev.128",
+  "version": "7.0.0-dev.129",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "exports": {
     "./package.json": "./package.json",

package/utils/Utils.js

@@ -123,7 +123,7 @@ export function parseJsonSafe(value) {
 }
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.0.0-dev.128';
+    static #ORM_VERSION = '7.0.0-dev.129';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */