@mikro-orm/core 7.1.7-dev.8 → 7.1.7

package/entity/EntityAssigner.js

@@ -1,5 +1,5 @@
 import { Collection } from './Collection.js';
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { Reference } from './Reference.js';
 import { ReferenceKind, SCALAR_TYPES } from '../enums.js';
 import { validateProperty } from './validators.js';
@@ -35,6 +35,10 @@ export class EntityAssigner {
         return entity;
     }
     static assignProperty(entity, propName, props, data, options) {
+        // needs to happen before the `props` lookup, as those keys resolve to inherited accessors
+        if (DANGEROUS_PROPERTY_NAMES.includes(propName)) {
+            return;
+        }
         let value = data[propName];
         const onlyProperties = options.onlyProperties && !(propName in props);
         const ignoreUndefined = options.ignoreUndefined === true && value === undefined;

package/metadata/MetadataValidator.js

@@ -1,19 +1,7 @@
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { normalizePartitionNameForComparison, splitCommaSeparatedIdentifiers } from '../utils/partition-utils.js';
 import { MetadataError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
-/**
- * List of property names that could lead to prototype pollution vulnerabilities.
- * These names should never be used as entity property names because they could
- * allow malicious code to modify object prototypes when property values are assigned.
- *
- * - `__proto__`: Could modify the prototype chain
- * - `constructor`: Could modify the constructor property
- * - `prototype`: Could modify the prototype object
- *
- * @internal
- */
-const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 /**
  * @internal
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.1.7-dev.8",
+  "version": "7.1.7",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/utils/Utils.d.ts

@@ -3,6 +3,18 @@ import type { Platform } from '../platforms/Platform.js';
 import { ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { type RawQueryFragmentSymbol } from './RawQueryFragment.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export declare const DANGEROUS_PROPERTY_NAMES: readonly string[];
 /** Deeply compares two objects for equality, handling dates, regexes, and raw fragments. */
 export declare function compareObjects(a: any, b: any): boolean;
 /** Compares two arrays element-by-element for deep equality. */

package/utils/Utils.js

@@ -5,6 +5,18 @@ import { Reference, ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { EntityHelper } from '../entity/EntityHelper.js';
 import { Raw, isRaw } from './RawQueryFragment.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 function compareConstructors(a, b) {
     if (a.constructor === b.constructor) {
         return true;
@@ -141,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.1.7-dev.8';
+    static #ORM_VERSION = '7.1.7';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -232,7 +244,7 @@ export class Utils {
         const source = sources.shift();
         if (Utils.isObject(target) && Utils.isPlainObject(source)) {
             for (const [key, value] of Object.entries(source)) {
-                if (['__proto__', 'constructor', 'prototype'].includes(key)) {
+                if (DANGEROUS_PROPERTY_NAMES.includes(key)) {
                     continue;
                 }
                 if (ignoreUndefined && typeof value === 'undefined') {