@mikro-orm/core 7.2.0-dev.0 → 7.2.0-dev.10

package/utils/QueryHelper.js

@@ -227,6 +227,13 @@ export class QueryHelper {
             if (prop?.customType && convertCustomTypes && !isRaw(value)) {
                 value = QueryHelper.processCustomType(prop, value, platform, undefined, true);
             }
+            else if (!prop &&
+                meta?.compositePK &&
+                convertCustomTypes &&
+                Array.isArray(value) &&
+                key === Utils.getPrimaryKeyHash(meta.primaryKeys)) {
+                value = QueryHelper.processCompositeCustomTypes(value, meta, platform);
+            }
             // oxfmt-ignore
             const isJsonProperty = prop?.customType instanceof JsonType && !isRaw(value) && (Utils.isPlainObject(value) ? !['$eq', '$elemMatch'].includes(Object.keys(value)[0]) : !Array.isArray(value));
             if (isJsonProperty && prop?.kind !== ReferenceKind.EMBEDDED) {
@@ -321,6 +328,24 @@ export class QueryHelper {
         }
         return prop.customType.convertToDatabaseValue(cond, platform, { fromQuery, key, mode: 'query' });
     }
+    /**
+     * Composite PK conditions are keyed by a hash of all the PK names, which `findProperty` cannot
+     * resolve, so the custom types have to be applied positionally instead.
+     */
+    static processCompositeCustomTypes(value, meta, platform) {
+        const props = meta.primaryKeys.map(pk => meta.properties[pk]);
+        if (!props.some(prop => prop.customType)) {
+            return value;
+        }
+        // the tuple can be longer than the PK when the user passes a malformed condition
+        const convert = (tuple) => tuple.map((val, idx) => {
+            if (!props[idx]?.customType) {
+                return val;
+            }
+            return QueryHelper.processCustomType(props[idx], val, platform, undefined, true);
+        });
+        return value.every(val => Array.isArray(val)) ? value.map(val => convert(val)) : convert(value);
+    }
     static isSupportedOperator(key) {
         return !!QueryHelper.SUPPORTED_OPERATORS.find(op => key === op);
     }

package/utils/RawQueryFragment.d.ts

@@ -61,6 +61,12 @@ export declare const ALIAS_REPLACEMENT_RE = "\\[::alias::\\]";
  * await em.find(User, { [raw(alias => `lower(${alias}.name)`)]: name.toLowerCase() });
  * ```
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
  *
  * ```ts

package/utils/RawQueryFragment.js

@@ -146,6 +146,12 @@ export const ALIAS_REPLACEMENT_RE = '\\[::alias::\\]';
  * await em.find(User, { [raw(alias => `lower(${alias}.name)`)]: name.toLowerCase() });
  * ```
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
  *
  * ```ts
@@ -191,13 +197,16 @@ export function raw(sql, params) {
         return Utils.getPrimaryKeyHash(sql);
     }
     if (typeof params === 'object' && !Array.isArray(params)) {
-        const pairs = Object.entries(params);
+        const dict = params;
         const objectParams = [];
-        for (const [key, value] of pairs) {
-            sql = sql.replace(`:${key}:`, '??');
-            sql = sql.replace(`:${key}`, '?');
-            objectParams.push(value);
-        }
+        // single left-to-right scan keeps values in SQL-placeholder order while `::` casts and unknown tokens stay untouched
+        sql = sql.replace(/(?<!:):([$\w]+)(:(?!:))?/g, (match, key, identifier) => {
+            if (!Object.hasOwn(dict, key)) {
+                return match;
+            }
+            objectParams.push(dict[key]);
+            return identifier ? '??' : '?';
+        });
         return new RawQueryFragment(sql, objectParams);
     }
     return new RawQueryFragment(sql, params);

package/utils/RequestContext.d.ts

@@ -17,13 +17,13 @@ export declare class RequestContext {
      * If the handler is async, the return value needs to be awaited.
      * Uses `AsyncLocalStorage.run()`, suitable for regular express style middlewares with a `next` callback.
      */
-    static create<T>(em: EntityManager | EntityManager[], next: (...args: any[]) => T, options?: CreateContextOptions): T;
+    static create<T>(em: EntityManager | EntityManager[], next: (...args: any[]) => T, options?: ((name: string) => CreateContextOptions) | CreateContextOptions): T;
     /**
      * Creates new RequestContext instance and runs the code inside its domain.
      * If the handler is async, the return value needs to be awaited.
      * Uses `AsyncLocalStorage.enterWith()`, suitable for elysia style middlewares without a `next` callback.
      */
-    static enter(em: EntityManager | EntityManager[], options?: CreateContextOptions): void;
+    static enter(em: EntityManager | EntityManager[], options?: ((name: string) => CreateContextOptions) | CreateContextOptions): void;
     /**
      * Returns current RequestContext (if available).
      */

package/utils/RequestContext.js

@@ -50,10 +50,19 @@ export class RequestContext {
     static createContext(em, options = {}) {
         const forks = new Map();
         if (Array.isArray(em)) {
-            em.forEach(em => forks.set(em.name, em.fork({ useContext: true, ...options })));
+            if (typeof options === 'function') {
+                for (const emInstance of em) {
+                    forks.set(emInstance.name, emInstance.fork({ useContext: true, ...options(emInstance.name) }));
+                }
+            }
+            else {
+                for (const emInstance of em) {
+                    forks.set(emInstance.name, emInstance.fork({ useContext: true, ...options }));
+                }
+            }
         }
         else {
-            forks.set(em.name, em.fork({ useContext: true, ...options }));
+            forks.set(em.name, em.fork({ useContext: true, ...(typeof options === 'function' ? options(em.name) : options) }));
         }
         return new RequestContext(forks);
     }

package/utils/TransactionManager.d.ts

@@ -50,6 +50,12 @@ export declare class TransactionManager {
      * Merges entities from fork to parent EntityManager.
      */
     private mergeEntitiesToParent;
+    /**
+     * Returns the property names a given property is tracked and snapshotted under, paired with their values.
+     * Inlined embeddables are hydrated as a single object, so only their leaves tell whether it is complete.
+     */
+    private getTrackedValues;
+    private restore;
     /**
      * Registers a deletion handler to unset entity identities after flush.
      */

package/utils/TransactionManager.js

@@ -162,26 +162,59 @@ export class TransactionManager {
         for (const entity of fork.getUnitOfWork(false).getIdentityMap()) {
             const wrapped = helper(entity);
             const meta = wrapped.__meta;
-            const parentEntity = parentUoW.getById(meta.class, wrapped.getPrimaryKey(), parent.schema, true);
+            const parentEntity = parentUoW.getIdentityMap().getByEntity(entity);
             if (parentEntity && parentEntity !== entity) {
                 const parentWrapped = helper(parentEntity);
                 // Don't overwrite a fully-loaded entity with an uninitialized reference
                 if (!wrapped.__initialized && parentWrapped.__initialized) {
                     continue;
                 }
-                parentWrapped.__data = wrapped.__data;
-                parentWrapped.__originalEntityData = wrapped.__originalEntityData;
+                const parentData = parentWrapped.__data;
+                const parentSnapshot = parentWrapped.__originalEntityData;
+                parentWrapped.__data = { ...wrapped.__data };
+                const originalEntityData = { ...wrapped.__originalEntityData };
                 for (const prop of meta.hydrateProps) {
+                    const tracked = this.getTrackedValues(prop, entity[prop.name]);
+                    // the fork entity can be partially loaded, and propagating a property it does not know about
+                    // would clobber the parent state, so we restore both its value and its snapshot entries
+                    if (!tracked.every(([key, value]) => value !== undefined || wrapped.__loadedProperties.has(key))) {
+                        this.restore(parentWrapped.__data, parentData, prop.name);
+                        tracked.forEach(([key]) => this.restore(originalEntityData, parentSnapshot, key));
+                        continue;
+                    }
                     if (prop.kind === ReferenceKind.SCALAR) {
                         parentEntity[prop.name] = entity[prop.name];
                     }
                 }
+                if (wrapped.__originalEntityData) {
+                    parentWrapped.__originalEntityData = originalEntityData;
+                }
             }
             else {
                 parentUoW.merge(entity, new Set([entity]));
             }
         }
     }
+    /**
+     * Returns the property names a given property is tracked and snapshotted under, paired with their values.
+     * Inlined embeddables are hydrated as a single object, so only their leaves tell whether it is complete.
+     */
+    getTrackedValues(prop, value) {
+        if (prop.kind === ReferenceKind.EMBEDDED && !prop.object) {
+            return Object.values(prop.embeddedProps).flatMap(child => {
+                return this.getTrackedValues(child, value?.[child.embedded[1]]);
+            });
+        }
+        return [[prop.name, value]];
+    }
+    restore(target, source, key) {
+        if (source && key in source) {
+            target[key] = source[key];
+        }
+        else {
+            delete target[key];
+        }
+    }
     /**
      * Registers a deletion handler to unset entity identities after flush.
      */

package/utils/Utils.d.ts

@@ -3,6 +3,18 @@ import type { Platform } from '../platforms/Platform.js';
 import { ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { type RawQueryFragmentSymbol } from './RawQueryFragment.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export declare const DANGEROUS_PROPERTY_NAMES: readonly string[];
 /** Deeply compares two objects for equality, handling dates, regexes, and raw fragments. */
 export declare function compareObjects(a: any, b: any): boolean;
 /** Compares two arrays element-by-element for deep equality. */

package/utils/Utils.js

@@ -5,6 +5,18 @@ import { Reference, ScalarReference } from '../entity/Reference.js';
 import { Collection } from '../entity/Collection.js';
 import { EntityHelper } from '../entity/EntityHelper.js';
 import { Raw, isRaw } from './RawQueryFragment.js';
+/**
+ * List of property names that could lead to prototype pollution vulnerabilities.
+ * These names should never be used as entity property names because they could
+ * allow malicious code to modify object prototypes when property values are assigned.
+ *
+ * - `__proto__`: Could modify the prototype chain
+ * - `constructor`: Could modify the constructor property
+ * - `prototype`: Could modify the prototype object
+ *
+ * @internal
+ */
+export const DANGEROUS_PROPERTY_NAMES = ['__proto__', 'constructor', 'prototype'];
 function compareConstructors(a, b) {
     if (a.constructor === b.constructor) {
         return true;
@@ -141,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.0-dev.0';
+    static #ORM_VERSION = '7.2.0-dev.10';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -232,7 +244,7 @@ export class Utils {
         const source = sources.shift();
         if (Utils.isObject(target) && Utils.isPlainObject(source)) {
             for (const [key, value] of Object.entries(source)) {
-                if (['__proto__', 'constructor', 'prototype'].includes(key)) {
+                if (DANGEROUS_PROPERTY_NAMES.includes(key)) {
                     continue;
                 }
                 if (ignoreUndefined && typeof value === 'undefined') {
@@ -390,7 +402,8 @@ export class Utils {
     static getCompositeKeyHash(data, meta, convertCustomTypes = false, platform, flat = false) {
         let pks = this.getCompositeKeyValue(data, meta, convertCustomTypes, platform);
         if (flat) {
-            pks = Utils.flatten(pks);
+            // deep flatten, nested composite PKs produce nested arrays that would be comma-joined by the hash
+            pks = Utils.flatten(pks, true);
         }
         return Utils.getPrimaryKeyHash(pks);
     }
@@ -450,7 +463,9 @@ export class Utils {
     }
     static getPrimaryKeyCond(entity, primaryKeys) {
         const cond = primaryKeys.reduce((o, pk) => {
-            o[pk] = Utils.extractPK(entity[pk]);
+            const value = entity[pk];
+            // FKs pointing to a composite PK are arrays, which `extractPK` rejects
+            o[pk] = Utils.isPrimaryKey(value, true) ? value : Utils.extractPK(value);
             return o;
         }, {});
         if (Object.values(cond).some(v => v === null)) {

package/utils/clone.js

@@ -112,6 +112,12 @@ export function clone(parent, respectCustomCloneMethod = true) {
             });
         }
         for (const i in parent) {
+            // an own `__proto__` key (as produced by `JSON.parse`) has no own counterpart on
+            // `child` to shadow the inherited accessor, so assigning it would replace the
+            // clone's prototype instead of copying the value
+            if (i === '__proto__') {
+                continue;
+            }
             let attrs;
             if (proto) {
                 attrs = getPropertyDescriptor(proto, i);

package/utils/env-vars.js

@@ -79,6 +79,7 @@ export function loadEnvironmentVars() {
     read2('silent', bool);
     read2('emit');
     read2('snapshot', bool);
+    read2('snapshotOnMigrate', bool);
     read2('snapshotName');
     cleanup(ret, 'migrations');
     ret.schemaGenerator = {};