@mikro-orm/core 7.1.7 → 7.2.0-dev.0

package/entity/EntityAssigner.js

@@ -1,5 +1,5 @@
 import { Collection } from './Collection.js';
-import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
+import { Utils } from '../utils/Utils.js';
 import { Reference } from './Reference.js';
 import { ReferenceKind, SCALAR_TYPES } from '../enums.js';
 import { validateProperty } from './validators.js';
@@ -35,10 +35,6 @@ export class EntityAssigner {
         return entity;
     }
     static assignProperty(entity, propName, props, data, options) {
-        // needs to happen before the `props` lookup, as those keys resolve to inherited accessors
-        if (DANGEROUS_PROPERTY_NAMES.includes(propName)) {
-            return;
-        }
         let value = data[propName];
         const onlyProperties = options.onlyProperties && !(propName in props);
         const ignoreUndefined = options.ignoreUndefined === true && value === undefined;

package/metadata/MetadataValidator.js

@@ -1,7 +1,19 @@
-import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
+import { Utils } from '../utils/Utils.js';
 import { normalizePartitionNameForComparison, splitCommaSeparatedIdentifiers } from '../utils/partition-utils.js';
 import { MetadataError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 /**
  * @internal
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.1.7",
+  "version": "7.2.0-dev.0",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/utils/Utils.d.ts

@@ -3,18 +3,6 @@ import type { Platform } from '../platforms/Platform.js';
 import { ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { type RawQueryFragmentSymbol } from './RawQueryFragment.js';
-/**
- * List of property names that could lead to prototype pollution vulnerabilities.
- * These names should never be used as entity property names because they could
- * allow malicious code to modify object prototypes when property values are assigned.
- *
- * - `__proto__`: Could modify the prototype chain
- * - `constructor`: Could modify the constructor property
- * - `prototype`: Could modify the prototype object
- *
- * @internal
- */
-export declare const DANGEROUS_PROPERTY_NAMES: readonly string[];
 /** Deeply compares two objects for equality, handling dates, regexes, and raw fragments. */
 export declare function compareObjects(a: any, b: any): boolean;
 /** Compares two arrays element-by-element for deep equality. */

package/utils/Utils.js

@@ -5,18 +5,6 @@ import { Reference, ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { EntityHelper } from '../entity/EntityHelper.js';
 import { Raw, isRaw } from './RawQueryFragment.js';
-/**
- * List of property names that could lead to prototype pollution vulnerabilities.
- * These names should never be used as entity property names because they could
- * allow malicious code to modify object prototypes when property values are assigned.
- *
- * - `__proto__`: Could modify the prototype chain
- * - `constructor`: Could modify the constructor property
- * - `prototype`: Could modify the prototype object
- *
- * @internal
- */
-export const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 function compareConstructors(a, b) {
     if (a.constructor === b.constructor) {
         return true;
@@ -153,7 +141,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.1.7';
+    static #ORM_VERSION = '7.2.0-dev.0';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -244,7 +232,7 @@ export class Utils {
         const source = sources.shift();
         if (Utils.isObject(target) && Utils.isPlainObject(source)) {
             for (const [key, value] of Object.entries(source)) {
-                if (DANGEROUS_PROPERTY_NAMES.includes(key)) {
+                if (['__proto__', 'constructor', 'prototype'].includes(key)) {
                     continue;
                 }
                 if (ignoreUndefined && typeof value === 'undefined') {