@mikro-orm/core 7.1.12-dev.19 → 7.1.12-dev.20

package/EntityManager.js

@@ -1641,8 +1641,9 @@ export class EntityManager {
         }
         // For TPT inheritance, check the entity's own properties, not just the root's
         // For STI, meta.properties includes all properties anyway
-        const ret = p in meta.properties;
-        if (parts.length > 0) {
+        // use an own-property check so inherited `Object.prototype` members (e.g. `__proto__`, `constructor`) are not treated as populatable
+        const ret = Object.hasOwn(meta.properties, p);
+        if (ret && parts.length > 0) {
             return this.canPopulate(meta.properties[p].targetMeta.class, parts.join('.'));
         }
         return ret;

package/entity/EntityLoader.js

@@ -1,5 +1,5 @@
 import { QueryHelper } from '../utils/QueryHelper.js';
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { ValidationError } from '../errors.js';
 import { LoadStrategy, PopulatePath, ReferenceKind, } from '../enums.js';
 import { Reference } from './Reference.js';
@@ -124,10 +124,10 @@ export class EntityLoader {
     mergeNestedPopulate(populate) {
         const tmp = populate.reduce((ret, item) => {
             /* v8 ignore next */
-            if (item.field === PopulatePath.ALL) {
+            if (item.field === PopulatePath.ALL || DANGEROUS_PROPERTY_NAMES.includes(item.field)) {
                 return ret;
             }
-            if (!ret[item.field]) {
+            if (!Object.hasOwn(ret, item.field)) {
                 ret[item.field] = item;
                 return ret;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.1.12-dev.19",
+  "version": "7.1.12-dev.20",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/utils/QueryHelper.js

@@ -1,5 +1,5 @@
 import { Reference } from '../entity/Reference.js';
-import { Utils } from './Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from './Utils.js';
 import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } from '../enums.js';
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
@@ -269,7 +269,11 @@ export class QueryHelper {
             options.forEach(filter => (opts[filter] = true));
         }
         else if (Utils.isPlainObject(options)) {
-            Object.keys(options).forEach(filter => (opts[filter] = options[filter]));
+            Object.keys(options).forEach(filter => {
+                if (!DANGEROUS_PROPERTY_NAMES.includes(filter)) {
+                    opts[filter] = options[filter];
+                }
+            });
         }
         return Object.keys(filters)
             .filter(f => QueryHelper.isFilterActive(meta, f, filters[f], opts))

package/utils/Utils.js

@@ -153,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.1.12-dev.19';
+    static #ORM_VERSION = '7.1.12-dev.20';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */