@mikro-orm/core 7.2.0-dev.0 → 7.2.0-dev.1

package/EntityManager.js

@@ -1432,7 +1432,7 @@ export class EntityManager {
         options.validate ??= true;
         options.cascade ??= true;
         validatePrimaryKey(data, em.metadata.get(entityName));
-        let entity = em.#unitOfWork.tryGetById(entityName, data, options.schema, false);
+        let entity = em.#unitOfWork.tryGetById(entityName, data, options.schema, false, options.convertCustomTypes);
         if (entity && helper(entity).__managed && helper(entity).__initialized && !options.refresh) {
             return entity;
         }

package/entity/EntityAssigner.js

@@ -1,5 +1,5 @@
 import { Collection } from './Collection.js';
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { Reference } from './Reference.js';
 import { ReferenceKind, SCALAR_TYPES } from '../enums.js';
 import { validateProperty } from './validators.js';
@@ -35,6 +35,10 @@ export class EntityAssigner {
         return entity;
     }
     static assignProperty(entity, propName, props, data, options) {
+        // needs to happen before the `props` lookup, as those keys resolve to inherited accessors
+        if (DANGEROUS_PROPERTY_NAMES.includes(propName)) {
+            return;
+        }
         let value = data[propName];
         const onlyProperties = options.onlyProperties && !(propName in props);
         const ignoreUndefined = options.ignoreUndefined === true && value === undefined;
@@ -183,7 +187,9 @@ export class EntityAssigner {
             if (options.updateNestedEntities && options.updateByPrimaryKey && Utils.isPlainObject(item)) {
                 const pk = Utils.extractPK(item, prop.targetMeta);
                 if (pk && EntityAssigner.validateEM(em)) {
-                    const ref = em.getUnitOfWork().getById(prop.targetMeta.class, pk, options.schema);
+                    const ref = em
+                        .getUnitOfWork()
+                        .getById(prop.targetMeta.class, pk, options.schema, options.convertCustomTypes);
                     if (ref) {
                         return EntityAssigner.assign(ref, item, options);
                     }

package/entity/EntityFactory.js

@@ -421,7 +421,7 @@ export class EntityFactory {
             const value = data[k];
             if (prop && [ReferenceKind.MANY_TO_ONE, ReferenceKind.ONE_TO_ONE].includes(prop.kind) && value) {
                 const pk = Reference.unwrapReference(value);
-                const entity = this.unitOfWork.getById(prop.targetMeta.class, pk, options.schema, true);
+                const entity = this.unitOfWork.getById(prop.targetMeta.class, pk, options.schema, options.convertCustomTypes);
                 if (entity) {
                     return entity;
                 }

package/entity/EntityLoader.js

@@ -291,7 +291,8 @@ export class EntityLoader {
         }
         for (const child of children) {
             const fk = child.__helper.__data[prop.mappedBy] ?? child[prop.mappedBy];
-            if (fk) {
+            // check for `null`/`undefined` explicitly, the FK can be a falsy raw PK value like `0` (e.g. with `mapToPk`)
+            if (fk != null) {
                 let key;
                 if (targetKey) {
                     // `fk` is the owner reference (resolve its targetKey) unless the relation maps to the raw PK value

package/metadata/MetadataValidator.js

@@ -1,19 +1,7 @@
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { normalizePartitionNameForComparison, splitCommaSeparatedIdentifiers } from '../utils/partition-utils.js';
 import { MetadataError } from '../errors.js';
 import { ReferenceKind } from '../enums.js';
-/**
- * List of property names that could lead to prototype pollution vulnerabilities.
- * These names should never be used as entity property names because they could
- * allow malicious code to modify object prototypes when property values are assigned.
- *
- * - `__proto__`: Could modify the prototype chain
- * - `constructor`: Could modify the constructor property
- * - `prototype`: Could modify the prototype object
- *
- * @internal
- */
-const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 /**
  * @internal
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.2.0-dev.0",
+  "version": "7.2.0-dev.1",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/unit-of-work/ChangeSetComputer.js

@@ -138,7 +138,8 @@ export class ChangeSetComputer {
         return data;
     }
     processProperty(changeSet, prop, target) {
-        if (!target) {
+        // check for `null`/`undefined` explicitly, the target can be a falsy raw PK value like `0` (e.g. with `mapToPk`)
+        if (target == null) {
             const targets = Utils.unwrapProperty(changeSet.entity, changeSet.meta, prop);
             targets.forEach(([t]) => this.processProperty(changeSet, prop, t));
             return;

package/unit-of-work/IdentityMap.d.ts

@@ -12,6 +12,11 @@ export declare class IdentityMap {
     storeByKey<T>(item: T, key: string, value: string, schema?: string): void;
     /** Removes an entity and its alternate key entries from the identity map. */
     delete<T>(item: T): void;
+    /**
+     * Retrieves the entity occupying the same slot as the given one, if any. Hashes the entity the same way `store()`
+     * does, so it matches regardless of the primary key shape — unlike hashing a primary key value obtained elsewhere.
+     */
+    getByEntity<T>(item: T): T | undefined;
     /** Retrieves an entity by its hash key from the identity map. */
     getByHash<T>(meta: EntityMetadata<T>, hash: string): T | undefined;
     /** Returns (or creates) the per-entity-class store within the identity map. */

package/unit-of-work/IdentityMap.js

@@ -40,6 +40,13 @@ export class IdentityMap {
             this.#alternateKeys.delete(item);
         }
     }
+    /**
+     * Retrieves the entity occupying the same slot as the given one, if any. Hashes the entity the same way `store()`
+     * does, so it matches regardless of the primary key shape — unlike hashing a primary key value obtained elsewhere.
+     */
+    getByEntity(item) {
+        return this.getStore(item.__meta.root).get(this.getPkHash(item));
+    }
     /** Retrieves an entity by its hash key from the identity map. */
     getByHash(meta, hash) {
         const store = this.getStore(meta);

package/unit-of-work/UnitOfWork.d.ts

@@ -48,7 +48,7 @@ export declare class UnitOfWork {
      */
     storeByKey<T extends object>(entity: T, key: string, value: unknown, schema?: string, convertCustomTypes?: boolean): void;
     /** Attempts to extract a primary key from the where condition and look up the entity in the identity map. */
-    tryGetById<T extends object>(entityName: EntityName<T>, where: FilterQuery<T>, schema?: string, strict?: boolean): T | null;
+    tryGetById<T extends object>(entityName: EntityName<T>, where: FilterQuery<T>, schema?: string, strict?: boolean, convertCustomTypes?: boolean): T | null;
     /**
      * Returns map of all managed entities.
      */

package/unit-of-work/UnitOfWork.js

@@ -227,12 +227,12 @@ export class UnitOfWork {
         this.#identityMap.storeByKey(entity, key, '' + value, schema);
     }
     /** Attempts to extract a primary key from the where condition and look up the entity in the identity map. */
-    tryGetById(entityName, where, schema, strict = true) {
+    tryGetById(entityName, where, schema, strict = true, convertCustomTypes) {
         const pk = Utils.extractPK(where, this.#metadata.find(entityName), strict);
         if (!pk) {
             return null;
         }
-        return this.getById(entityName, pk, schema);
+        return this.getById(entityName, pk, schema, convertCustomTypes);
     }
     /**
      * Returns map of all managed entities.

package/utils/AbstractMigrator.d.ts

@@ -95,6 +95,8 @@ export declare abstract class AbstractMigrator<D extends IDatabaseDriver> implem
      */
     unlogMigration(name: string): Promise<void>;
     protected init(): Promise<void>;
+    /** Resolves the migrations path (including source folder auto-detection) without touching the filesystem. */
+    protected resolvePaths(): Promise<void>;
     protected initPaths(): Promise<void>;
     protected initServices(): void;
     protected resolve(params: {

package/utils/AbstractMigrator.js

@@ -9,6 +9,7 @@ export class AbstractMigrator {
     options;
     absolutePath;
     initialized = false;
+    #pathsEnsured = false;
     #listeners = new Map();
     constructor(em) {
         this.em = em;
@@ -303,7 +304,8 @@ export class AbstractMigrator {
         this.initialized = true;
         await this.initPaths();
     }
-    async initPaths() {
+    /** Resolves the migrations path (including source folder auto-detection) without touching the filesystem. */
+    async resolvePaths() {
         if (this.absolutePath || this.options.migrationsList) {
             return;
         }
@@ -312,6 +314,14 @@ export class AbstractMigrator {
         /* v8 ignore next */
         const key = this.config.get('preferTs', Utils.detectTypeScriptSupport()) && this.options.pathTs ? 'pathTs' : 'path';
         this.absolutePath = fs.absolutePath(this.options[key], this.config.get('baseDir'));
+    }
+    async initPaths() {
+        await this.resolvePaths();
+        if (this.#pathsEnsured || this.options.migrationsList) {
+            return;
+        }
+        this.#pathsEnsured = true;
+        const { fs } = await import('@mikro-orm/core/fs-utils');
         try {
             fs.ensureDir(this.absolutePath);
         }

package/utils/EntityComparator.js

@@ -172,6 +172,10 @@ export class EntityComparator {
                 if (meta.properties[pk].kind !== ReferenceKind.SCALAR) {
                     lines.push(`    (entity${this.wrap(pk)} != null && isEntityOrRef(entity${this.wrap(pk)})) ? entity${this.wrap(pk)}.__helper.getSerializedPrimaryKey() : entity${this.wrap(pk)},`);
                 }
+                else if (meta.properties[pk].customType) {
+                    const convertorKey = this.registerCustomType(meta.properties[pk], context);
+                    lines.push(`    convertToDatabaseValue_${convertorKey}(entity${this.wrap(pk)}),`);
+                }
                 else {
                     lines.push(`    entity${this.wrap(pk)},`);
                 }

package/utils/TransactionManager.js

@@ -162,7 +162,7 @@ export class TransactionManager {
         for (const entity of fork.getUnitOfWork(false).getIdentityMap()) {
             const wrapped = helper(entity);
             const meta = wrapped.__meta;
-            const parentEntity = parentUoW.getById(meta.class, wrapped.getPrimaryKey(), parent.schema, true);
+            const parentEntity = parentUoW.getIdentityMap().getByEntity(entity);
             if (parentEntity && parentEntity !== entity) {
                 const parentWrapped = helper(parentEntity);
                 // Don't overwrite a fully-loaded entity with an uninitialized reference

package/utils/Utils.d.ts

@@ -3,6 +3,18 @@ import type { Platform } from '../platforms/Platform.js';
 import { ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { type RawQueryFragmentSymbol } from './RawQueryFragment.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export declare const DANGEROUS_PROPERTY_NAMES: readonly string[];
 /** Deeply compares two objects for equality, handling dates, regexes, and raw fragments. */
 export declare function compareObjects(a: any, b: any): boolean;
 /** Compares two arrays element-by-element for deep equality. */

package/utils/Utils.js

@@ -5,6 +5,18 @@ import { Reference, ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { EntityHelper } from '../entity/EntityHelper.js';
 import { Raw, isRaw } from './RawQueryFragment.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 function compareConstructors(a, b) {
     if (a.constructor === b.constructor) {
         return true;
@@ -141,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.0-dev.0';
+    static #ORM_VERSION = '7.2.0-dev.1';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -232,7 +244,7 @@ export class Utils {
         const source = sources.shift();
         if (Utils.isObject(target) && Utils.isPlainObject(source)) {
             for (const [key, value] of Object.entries(source)) {
-                if (['__proto__', 'constructor', 'prototype'].includes(key)) {
+                if (DANGEROUS_PROPERTY_NAMES.includes(key)) {
                     continue;
                 }
                 if (ignoreUndefined && typeof value === 'undefined') {