@warlock.js/cascade 4.14.0 → 4.16.0

package/cjs/index.cjs

@@ -411,6 +411,70 @@ var TransactionRollbackError = class TransactionRollbackError extends Error {
 	}
 };
 
+//#endregion
+//#region ../cascade/src/errors/unsafe-filter.error.ts
+/**
+* Error thrown when a filter value in an equality position contains
+* MongoDB operator keys (keys starting with `$`, e.g. `$ne`, `$gt`, `$where`).
+*
+* This blocks NoSQL operator injection: request-controlled payloads such as
+* `{ password: { $ne: null } }` must not be able to turn an equality match
+* into an operator query. Use the explicit operator APIs instead:
+* - `where(field, operator, value)` for comparisons
+* - `whereIn` / `whereNull` / `whereBetween` / … for specific operators
+* - `whereRaw({ ... })` (object form) for intentional raw driver filters
+*/
+var UnsafeFilterError = class UnsafeFilterError extends Error {
+	/**
+	* The field whose value contained the rejected operator key (if applicable).
+	*/
+	field;
+	/**
+	* The `$`-prefixed key that triggered the rejection.
+	*/
+	operatorKey;
+	/**
+	* Creates a new UnsafeFilterError.
+	*
+	* @param message - Descriptive error message
+	* @param field - Optional field name whose value was rejected
+	* @param operatorKey - Optional `$`-prefixed key that was rejected
+	*/
+	constructor(message, field, operatorKey) {
+		super(message);
+		this.name = "UnsafeFilterError";
+		this.field = field;
+		this.operatorKey = operatorKey;
+		if (Error.captureStackTrace) Error.captureStackTrace(this, UnsafeFilterError);
+	}
+};
+
+//#endregion
+//#region ../cascade/src/errors/unsafe-raw-expression.error.ts
+/**
+* Error thrown when a string expression is passed to `whereRaw()` /
+* `orWhereRaw()` on the MongoDB driver.
+*
+* String raw expressions used to compile to `{ $where: "<js>" }`, which MongoDB
+* evaluates as JavaScript inside the server for every scanned document — a
+* server-side JS injection sink when any part of the string is
+* request-controlled, and an unindexed full-scan DoS vector even when trusted.
+*
+* Use the object form instead, e.g. `whereRaw({ $expr: { $gt: ["$stock", "$reserved"] } })`.
+*/
+var UnsafeRawExpressionError = class UnsafeRawExpressionError extends Error {
+	/**
+	* Creates a new UnsafeRawExpressionError.
+	*
+	* @param message - Descriptive error message
+	*/
+	constructor(message) {
+		super(message);
+		this.name = "UnsafeRawExpressionError";
+		if (Error.captureStackTrace) Error.captureStackTrace(this, UnsafeRawExpressionError);
+	}
+};
+
 //#endregion
 //#region ../cascade/src/database-dirty-tracker.ts
 function canBeFlatten(object) {
@@ -3069,7 +3133,45 @@ function unsetFields(model, ...fields) {
 	model.dirtyTracker.unset(fields);
 	return model;
 }
+/**
+* Identity columns that a mass-assignment payload may never carry into an
+* already-persisted model. `merge()` is the method request bodies reach
+* (`model.merge(req.body)` / `save({ merge })`), and the primary key is what
+* the UPDATE filter is built from — letting it through means a payload of
+* `{ id: "<victim-id>" }` rewrites which document the save targets. Both the
+* configured primary key and the two framework identity columns are dropped,
+* because `id` and `_id` are managed by the writer/driver either way.
+*
+* A NEW model is untouched: creating with an explicit id is a legitimate flow,
+* and the writer itself merges the driver-returned document (`_id`, defaults)
+* back onto the instance before it is marked persisted.
+*/
+function stripIdentityColumns(model, values) {
+	if (model.isNew) return values;
+	const identityColumns = new Set([
+		model.getPrimaryKey(),
+		"id",
+		"_id"
+	]);
+	const blockedKeys = Object.keys(values).filter((key) => identityColumns.has(key));
+	if (blockedKeys.length === 0) return values;
+	const safeValues = { ...values };
+	for (const key of blockedKeys) delete safeValues[key];
+	return safeValues;
+}
 function mergeFields(model, values) {
+	return mergeDriverFields(model, stripIdentityColumns(model, values));
+}
+/**
+* Merge a document the DRIVER produced (generated `_id`, `RETURNING *`, DB
+* defaults) back onto the model, identity columns included.
+*
+* Framework-internal counterpart of {@link mergeFields}: the write pipeline is
+* the one caller allowed to set identity columns on an already-persisted
+* instance, because the values come from the database rather than from a
+* request. Never route caller-supplied data through this.
+*/
+function mergeDriverFields(model, values) {
 	model.data = (0, _mongez_reinforcements.merge)(model.data, values);
 	model.dirtyTracker.mergeChanges(values);
 	return model;
@@ -3152,7 +3254,7 @@ var DatabaseRemover = class {
 	async destroy(options = {}) {
 		const strategy = options.strategy ?? this.ctor.deleteStrategy ?? this.dataSource.defaultDeleteStrategy ?? "permanent";
 		if (this.model.isNew) throw new Error(`Cannot destroy ${this.ctor.name} instance that hasn't been saved to the database.`);
-		const primaryKeyValue = this.model.get(this.primaryKey);
+		const primaryKeyValue = this.model.trustedPrimaryKey;
 		if (!primaryKeyValue) throw new Error(`Cannot destroy ${this.ctor.name} instance: primary key (${this.primaryKey}) is missing.`);
 		if (!options.skipEvents) await this.model.emitEvent("deleting", {
 			strategy,
@@ -3258,16 +3360,88 @@ var DatabaseRemover = class {
 	}
 };
 
+//#endregion
+//#region ../cascade/src/utils/sanitize-filter.ts
+/**
+* Filter sanitization for equality-position values.
+*
+* `where({ field: value })`, `where(field, value)` and the filter-accepting
+* model statics (`first`, `findAll`, `deleteMany`, …) express *equality*
+* matches. If a request-controlled value such as `{ $ne: null }` is passed
+* through verbatim, MongoDB reinterprets it as an operator query — the classic
+* NoSQL operator-injection / auth-bypass primitive. These helpers reject any
+* `$`-prefixed key found in an equality position instead of forwarding it.
+*
+* Explicit operator APIs (`where(field, operator, value)`, `whereIn`,
+* `whereNull`, object-form `whereRaw({ ... })`, …) are intentionally NOT
+* routed through this check.
+*/
+/**
+* Returns true for plain objects only (`{}` / `Object.create(null)`).
+* BSON values such as `Date`, `RegExp`, `ObjectId` or `Buffer` are class
+* instances whose keys are not Mongo operators, so they are never traversed.
+*/
+const isPlainObject = (value) => {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+const rejectOperatorKey = (field, key) => {
+	throw new UnsafeFilterError(`Unsafe filter: value for field "${field}" contains the reserved MongoDB operator key "${key}". Equality filters must not carry "$"-prefixed keys. Use the explicit operator API instead — e.g. where(field, operator, value), whereIn(), whereNull(), or the object form of whereRaw().`, field, key);
+};
+const assertNoOperatorKeys = (value, field) => {
+	if (Array.isArray(value)) {
+		for (const item of value) assertNoOperatorKeys(item, field);
+		return;
+	}
+	if (!isPlainObject(value)) return;
+	for (const [key, nested] of Object.entries(value)) {
+		if (key.startsWith("$")) rejectOperatorKey(field, key);
+		assertNoOperatorKeys(nested, field);
+	}
+};
+/**
+* Assert a single equality-position value carries no `$`-prefixed keys.
+* Scalars, `Date`s and other non-plain objects pass through untouched;
+* plain objects/arrays are checked recursively.
+*
+* @param value - The equality value to check
+* @param field - The field name, used for the error message
+* @returns The value, unchanged
+* @throws UnsafeFilterError when a `$`-prefixed key is found
+*/
+function sanitizeFilterValue(value, field) {
+	assertNoOperatorKeys(value, field);
+	return value;
+}
+/**
+* Assert a `{ field: value }` equality filter carries no `$`-prefixed keys —
+* neither as top-level field names (`{ $where: … }`) nor inside any value
+* (`{ password: { $ne: null } }`). Dotted field paths ("profile.name") and
+* plain nested documents remain valid.
+*
+* @param filter - The filter object to check
+* @returns The filter, unchanged
+* @throws UnsafeFilterError when a `$`-prefixed key is found
+*/
+function sanitizeFilter(filter) {
+	for (const [field, value] of Object.entries(filter)) {
+		if (field.startsWith("$")) rejectOperatorKey(field, field);
+		assertNoOperatorKeys(value, field);
+	}
+	return filter;
+}
+
 //#endregion
 //#region ../cascade/src/model/methods/delete-methods.ts
 async function destroyModel(model, options) {
 	return new DatabaseRemover(model).destroy(options);
 }
 async function deleteRecords(ModelClass, filter) {
-	return ModelClass.getDriver().deleteMany(ModelClass.table, filter);
+	return ModelClass.getDriver().deleteMany(ModelClass.table, filter ? sanitizeFilter(filter) : filter);
 }
 async function deleteOneRecord(ModelClass, filter) {
-	return ModelClass.getDriver().delete(ModelClass.table, filter);
+	return ModelClass.getDriver().delete(ModelClass.table, filter ? sanitizeFilter(filter) : filter);
 }
 
 //#endregion
@@ -3936,7 +4110,7 @@ var DatabaseWriter = class {
 		if (updatedAtColumn) dataToInsert[updatedAtColumn] = /* @__PURE__ */ new Date();
 		if (!options.skipEvents) await this.model.emitEvent("creating");
 		const result = await this.driver.insert(this.table, dataToInsert);
-		this.model.merge(result.document);
+		mergeDriverFields(this.model, result.document);
 		this.model.dirtyTracker.reset();
 		return result;
 	}
@@ -3952,13 +4126,27 @@ var DatabaseWriter = class {
 		const updatedAtColumn = this.ctor.updatedAtColumn;
 		if (updatedAtColumn) this.model.set(updatedAtColumn, /* @__PURE__ */ new Date());
 		if (options.replace) {
-			const document = await this.driver.replace(this.table, { [this.primaryKey]: this.model.get(this.primaryKey) }, this.model.data);
+			const document = await this.driver.replace(this.table, this.buildPrimaryKeyFilter(), this.model.data);
 			if (document) this.model.replaceData(document);
 			return { modifiedCount: document ? 1 : 0 };
 		}
 		const operations = this.buildUpdateOperations();
-		const filter = { [this.primaryKey]: this.model.get(this.primaryKey) };
-		return await this.driver.update(this.table, filter, operations);
+		if (Object.keys(operations).length === 0) return { modifiedCount: 0 };
+		return await this.driver.update(this.table, this.buildPrimaryKeyFilter(), operations);
+	}
+	/**
+	* Build the filter that pins a write to the row this model was loaded from.
+	*
+	* It reads `model.trustedPrimaryKey` — the value captured when the instance
+	* became persisted — NOT the current value in `model.data`. The current value
+	* is reachable by mass assignment (`model.merge(req.body)`), so deriving the
+	* filter from it let a request body redirect the UPDATE to another document.
+	*
+	* @returns Filter matching the originally loaded record
+	* @private
+	*/
+	buildPrimaryKeyFilter() {
+		return { [this.primaryKey]: this.model.trustedPrimaryKey };
 	}
 	/**
 	* Generate ID for the model if auto-generation is enabled.
@@ -4001,7 +4189,12 @@ var DatabaseWriter = class {
 	*/
 	buildUpdateOperations() {
 		const operations = {};
-		const dirtyColumns = this.model.getDirtyColumns();
+		const identityColumns = new Set([
+			this.primaryKey,
+			"id",
+			"_id"
+		]);
+		const dirtyColumns = this.model.getDirtyColumns().filter((column) => !identityColumns.has(column));
 		if (dirtyColumns.length > 0) {
 			operations.$set = {};
 			for (const column of dirtyColumns) {
@@ -4009,7 +4202,7 @@ var DatabaseWriter = class {
 				operations.$set[column] = this.model.get(column);
 			}
 		}
-		const removedColumns = this.model.getRemovedColumns();
+		const removedColumns = this.model.getRemovedColumns().filter((column) => !identityColumns.has(column));
 		if (removedColumns.length > 0) {
 			operations.$unset = {};
 			for (const column of removedColumns) operations.$unset[column] = 1;
@@ -4376,6 +4569,69 @@ async function detachPivotRelation(model, relation, ids) {
 	return createPivotOperations(model, relation).detach(ids);
 }
 
+//#endregion
+//#region ../cascade/src/model/methods/serialization-methods.ts
+/**
+* Field names that commonly hold credentials/secrets. Used only to emit a
+* one-time warning when such a field exists in a model's schema but is not
+* covered by `hidden`/`resource`/`toJsonColumns` — the fail-open default
+* (`toJSON()` returns the raw document) would leak it.
+*/
+const SENSITIVE_FIELD_PATTERN = /^(password|passwordHash|secret|token|apiKey|api_key)$/i;
+const warnedModelClasses = /* @__PURE__ */ new WeakSet();
+/**
+* Warn once per model class when its schema declares a sensitive-looking field
+* that serialization would expose: no `hidden` entry for it, no `resource`
+* class, and no `toJsonColumns` allow-list excluding it.
+*
+* A warning rather than an error — the fail-open `toJSON()` default is kept
+* for compatibility, but it should at least be loud.
+*/
+function warnUndeclaredSensitiveFields(ModelClass) {
+	if (warnedModelClasses.has(ModelClass)) return;
+	warnedModelClasses.add(ModelClass);
+	const schema = ModelClass.schema;
+	if (!schema) return;
+	const hidden = ModelClass.hidden ?? [];
+	const toJsonColumns = ModelClass.toJsonColumns;
+	const exposed = Object.keys(schema.schema).filter((field) => {
+		if (!SENSITIVE_FIELD_PATTERN.test(field)) return false;
+		if (hidden.includes(field)) return false;
+		if (ModelClass.resource) return false;
+		if (toJsonColumns && toJsonColumns.length > 0 && !toJsonColumns.includes(field)) return false;
+		return true;
+	});
+	if (exposed.length === 0) return;
+	console.warn(`[cascade] Model "${ModelClass.name}" (table "${ModelClass.table}") has sensitive-looking schema field(s) ${exposed.map((field) => `"${field}"`).join(", ")} that toJSON()/JSON.stringify() will include in output. Add them to \`static hidden = [...]\` (or configure \`resource\`/\`toJsonColumns\`) so they cannot leak via res.json(model).`);
+}
+/**
+* Return `data` without the model's `hidden` top-level fields.
+* Returns `data` untouched (same reference) when nothing is hidden.
+*/
+function stripHiddenFields(data, hidden) {
+	if (hidden.length === 0) return data;
+	const output = { ...data };
+	for (const field of hidden) delete output[field];
+	return output;
+}
+function modelToJSON(model) {
+	const ModelClass = model.self();
+	const resource = ModelClass.resource;
+	const hidden = ModelClass.hidden ?? [];
+	warnUndeclaredSensitiveFields(ModelClass);
+	if (!resource) {
+		const toJsonColumns = ModelClass.toJsonColumns;
+		if (toJsonColumns && toJsonColumns.length > 0) return stripHiddenFields(model.only(toJsonColumns), hidden);
+		return stripHiddenFields(model.data, hidden);
+	}
+	const resourceColumns = ModelClass.resourceColumns;
+	let data = resourceColumns !== void 0 && resourceColumns.length > 0 ? model.only(resourceColumns) : { ...model.data };
+	for (const [relationName, relatedModel] of model.loadedRelations) if (Array.isArray(relatedModel)) data[relationName] = relatedModel.map((m) => m instanceof Object && typeof m.toJSON === "function" ? m.toJSON() : m);
+	else if (relatedModel instanceof Object && typeof relatedModel.toJSON === "function") data[relationName] = relatedModel.toJSON();
+	else data[relationName] = relatedModel;
+	return new resource(stripHiddenFields(data, hidden)).toJSON();
+}
+
 //#endregion
 //#region ../cascade/src/model/methods/query-methods.ts
 function buildQuery(ModelClass, BaseModel) {
@@ -4448,7 +4704,7 @@ function decreaseField(ModelClass, filter, field, amount) {
 	return ModelClass.query().where(filter).decrement(field, amount);
 }
 async function performAtomic(ModelClass, filter, operations) {
-	return (await ModelClass.getDriver().atomic(ModelClass.table, filter, operations)).modifiedCount;
+	return (await ModelClass.getDriver().atomic(ModelClass.table, sanitizeFilter(filter), operations)).modifiedCount;
 }
 async function updateById(ModelClass, id, data) {
 	return (await ModelClass.getDriver().update(ModelClass.table, { [ModelClass.primaryKey]: id }, { $set: data })).modifiedCount;
@@ -4458,17 +4714,17 @@ async function findAndUpdateRecords(ModelClass, filter, update) {
 	return await ModelClass.query().where(filter).get();
 }
 async function findOneAndUpdateRecord(ModelClass, filter, update) {
-	const result = await ModelClass.getDriver().findOneAndUpdate(ModelClass.table, filter, update);
+	const result = await ModelClass.getDriver().findOneAndUpdate(ModelClass.table, sanitizeFilter(filter), update);
 	if (!result) return null;
 	return new ModelClass(result);
 }
 async function findAndReplaceRecord(ModelClass, filter, document) {
-	const result = await ModelClass.getDriver().replace(ModelClass.table, filter, document);
+	const result = await ModelClass.getDriver().replace(ModelClass.table, sanitizeFilter(filter), document);
 	if (!result) return null;
 	return new ModelClass(result);
 }
 async function findOneAndDeleteRecord(ModelClass, filter, options) {
-	const result = await ModelClass.getDriver().findOneAndDelete(ModelClass.table, filter, options);
+	const result = await ModelClass.getDriver().findOneAndDelete(ModelClass.table, sanitizeFilter(filter), options);
 	if (!result) return null;
 	const model = ModelClass.hydrate(result);
 	model.dirtyTracker.reset();
@@ -4490,6 +4746,7 @@ function resolveDataSource(ModelClass) {
 		if (Object.keys(mergedDefaults).length > 0) ModelClass.applyModelDefaults(mergedDefaults);
 		ModelClass._defaultsApplied = true;
 	}
+	warnUndeclaredSensitiveFields(ModelClass);
 	return dataSource;
 }
 
@@ -4851,24 +5108,6 @@ function removeLocalModelScope(ModelClass, name) {
 	ownScopeMap(ModelClass, "localScopes").delete(name);
 }
 
-//#endregion
-//#region ../cascade/src/model/methods/serialization-methods.ts
-function modelToJSON(model) {
-	const ModelClass = model.self();
-	const resource = ModelClass.resource;
-	if (!resource) {
-		const toJsonColumns = ModelClass.toJsonColumns;
-		if (toJsonColumns && toJsonColumns.length > 0) return model.only(toJsonColumns);
-		return model.data;
-	}
-	const resourceColumns = ModelClass.resourceColumns;
-	let data = resourceColumns !== void 0 && resourceColumns.length > 0 ? model.only(resourceColumns) : { ...model.data };
-	for (const [relationName, relatedModel] of model.loadedRelations) if (Array.isArray(relatedModel)) data[relationName] = relatedModel.map((m) => m instanceof Object && typeof m.toJSON === "function" ? m.toJSON() : m);
-	else if (relatedModel instanceof Object && typeof relatedModel.toJSON === "function") data[relationName] = relatedModel.toJSON();
-	else data[relationName] = relatedModel;
-	return new resource(data).toJSON();
-}
-
 //#endregion
 //#region ../cascade/src/model/methods/static-event-methods.ts
 /**
@@ -5064,10 +5303,7 @@ async function createManyBulk(ModelClass, chunks) {
 			const results = await driver.insertMany(table, preparedDocuments);
 			models.forEach((model, index) => {
 				const result = results[index];
-				if (result) {
-					const returnedDocument = "document" in result ? result.document : result;
-					model.merge(returnedDocument);
-				}
+				if (result) mergeDriverFields(model, "document" in result ? result.document : result);
 				model.dirtyTracker.reset();
 				model.isNew = false;
 			});
@@ -5203,6 +5439,25 @@ var Model = class Model {
 	*/
 	static toJsonColumns;
 	/**
+	* Top-level fields that are ALWAYS stripped from `toJSON()` output —
+	* regardless of `resource`, `resourceColumns` or `toJsonColumns`.
+	*
+	* `toJSON()` is invoked implicitly by `JSON.stringify(model)` (e.g.
+	* `res.json(user)`), and with no `resource`/`toJsonColumns` configured it
+	* returns the entire raw document. Declare credential/PII columns here so
+	* they can never leak through serialization, whatever else is configured.
+	*
+	* @default []
+	*
+	* @example
+	* ```typescript
+	* class User extends Model {
+	*   public static hidden = ["password", "resetToken"];
+	* }
+	* ```
+	*/
+	static hidden = [];
+	/**
 	* Data source reference for this model.
 	*
 	* Can be:
@@ -5483,6 +5738,16 @@ var Model = class Model {
 	* ```
 	*/
 	static relations = {};
+	/** Backing field for {@link isNew}. */
+	newRecord = true;
+	/**
+	* The primary key value captured at the moment this instance became a
+	* persisted record — the ONLY value an UPDATE/REPLACE filter may be built
+	* from. See {@link trustedPrimaryKey}.
+	*/
+	capturedPrimaryKey = void 0;
+	/** Whether {@link capturedPrimaryKey} holds a captured value. */
+	primaryKeyCaptured = false;
 	/**
 	* Flag indicating whether this model instance represents a new (unsaved) record.
 	*
@@ -5490,8 +5755,38 @@ var Model = class Model {
 	* - `false`: The model represents an existing database record
 	*
 	* This flag is used by the writer to determine whether to perform an insert or update.
+	*
+	* Setting it to `false` (hydration from the database, or the writer marking a
+	* freshly inserted row as persisted) is also the moment the instance captures
+	* its trusted primary key — see {@link trustedPrimaryKey}.
 	*/
-	isNew = true;
+	get isNew() {
+		return this.newRecord;
+	}
+	set isNew(value) {
+		this.newRecord = value;
+		if (value) {
+			this.capturedPrimaryKey = void 0;
+			this.primaryKeyCaptured = false;
+			return;
+		}
+		this.capturedPrimaryKey = this.get(this.self().primaryKey);
+		this.primaryKeyCaptured = true;
+	}
+	/**
+	* The primary key value an UPDATE/REPLACE filter must be built from.
+	*
+	* For a persisted record this is the value the row was loaded with, captured
+	* when `isNew` flipped to `false` — NOT the current value in `data`. Deriving
+	* the filter from post-`merge()` state let a request body carrying
+	* `{ id: "<victim-id>" }` redirect the write to a different document
+	* (`model.merge(req.body); await model.save()`), so the two must never be the
+	* same read. For a model that was never persisted it falls back to the
+	* current value, which is what an insert would use anyway.
+	*/
+	get trustedPrimaryKey() {
+		return this.primaryKeyCaptured ? this.capturedPrimaryKey : this.get(this.self().primaryKey);
+	}
 	/**
 	* The raw mutable data backing this model instance.
 	*
@@ -8384,7 +8679,7 @@ var QueryBuilder = class QueryBuilder {
 			const sub = this.subQuery();
 			args[0](sub);
 			this.addOperation("where", { nested: sub.operations });
-		} else if (args.length === 1 && typeof args[0] === "object" && args[0] !== null) for (const [key, value] of Object.entries(args[0])) this.addOperation("where", {
+		} else if (args.length === 1 && typeof args[0] === "object" && args[0] !== null) for (const [key, value] of Object.entries(sanitizeFilter(args[0]))) this.addOperation("where", {
 			field: key,
 			operator: "=",
 			value
@@ -8392,12 +8687,12 @@ var QueryBuilder = class QueryBuilder {
 		else if (args.length === 2) this.addOperation("where", {
 			field: args[0],
 			operator: "=",
-			value: args[1]
+			value: sanitizeFilterValue(args[1], String(args[0]))
 		});
 		else this.addOperation("where", {
 			field: args[0],
 			operator: args[1],
-			value: args[2]
+			value: args[1] === "=" ? sanitizeFilterValue(args[2], String(args[0])) : args[2]
 		});
 		return this;
 	}
@@ -8406,7 +8701,7 @@ var QueryBuilder = class QueryBuilder {
 			const sub = this.subQuery();
 			args[0](sub);
 			this.addOperation("orWhere", { nested: sub.operations });
-		} else if (args.length === 1 && typeof args[0] === "object" && args[0] !== null) for (const [key, value] of Object.entries(args[0])) this.addOperation("orWhere", {
+		} else if (args.length === 1 && typeof args[0] === "object" && args[0] !== null) for (const [key, value] of Object.entries(sanitizeFilter(args[0]))) this.addOperation("orWhere", {
 			field: key,
 			operator: "=",
 			value
@@ -8414,12 +8709,12 @@ var QueryBuilder = class QueryBuilder {
 		else if (args.length === 2) this.addOperation("orWhere", {
 			field: args[0],
 			operator: "=",
-			value: args[1]
+			value: sanitizeFilterValue(args[1], String(args[0]))
 		});
 		else this.addOperation("orWhere", {
 			field: args[0],
 			operator: args[1],
-			value: args[2]
+			value: args[1] === "=" ? sanitizeFilterValue(args[2], String(args[0])) : args[2]
 		});
 		return this;
 	}
@@ -8529,25 +8824,40 @@ var QueryBuilder = class QueryBuilder {
 	}
 	/**
 	* LIKE pattern match (AND).
+	*
+	* A string is a LIKE pattern (`%` wildcard) and is matched literally
+	* otherwise — regex metacharacters in it are escaped by the driver, so
+	* search input cannot alter the query. Pass an explicit `RegExp` to opt into
+	* raw pattern semantics; never build that `RegExp` from user input.
+	*
 	* @example q.whereLike("email", "%@gmail.com")
 	*/
 	whereLike(field, pattern) {
-		const patternStr = pattern instanceof RegExp ? pattern.source : pattern;
 		this.addOperation("whereLike", {
 			field,
-			pattern: patternStr
+			...this.likePatternData(pattern)
 		});
 		return this;
 	}
-	/** NOT LIKE pattern match. */
+	/** NOT LIKE pattern match. @see whereLike for the escaping rules. */
 	whereNotLike(field, pattern) {
-		const patternStr = pattern instanceof RegExp ? pattern.source : pattern;
 		this.addOperation("whereNotLike", {
 			field,
-			pattern: patternStr
+			...this.likePatternData(pattern)
 		});
 		return this;
 	}
+	/**
+	* Flatten a LIKE argument into operation data, keeping the distinction the
+	* drivers need: an explicit `RegExp` (developer-authored) stays a pattern,
+	* a string (potentially request input) is a literal.
+	*/
+	likePatternData(pattern) {
+		return pattern instanceof RegExp ? {
+			pattern: pattern.source,
+			isRegExp: true
+		} : { pattern };
+	}
 	/** Starts with a prefix. */
 	whereStartsWith(field, value) {
 		return this.whereLike(field, `${value}%`);
@@ -9610,6 +9920,80 @@ var MongoQueryOperations = class {
 	}
 };
 
+//#endregion
+//#region ../cascade/src/utils/escape-regex.ts
+/**
+* Regex escaping for pattern-matching helpers.
+*
+* `whereLike` / `whereNotLike` / `whereStartsWith` / `whereEndsWith` /
+* `whereSearch` compile their argument into a MongoDB `$regex`. The argument is
+* exactly what a search box hands over (`whereSearch("name", req.query.q)`), so
+* passing it through unescaped gave the caller control of the regex itself:
+*
+* - **injection** — `.*` / `|` / `^` change the intended match semantics, and a
+*   boolean-oracle probe (`^a`, `^b`, …) reads values back one character at a
+*   time from a field the endpoint never meant to expose;
+* - **ReDoS** — nested quantifiers (`(a+)+`) backtrack catastrophically inside
+*   `mongod`, against every document the query scans.
+*
+* A string value is therefore treated as a LITERAL. Only an explicit `RegExp`
+* argument — which cannot come from JSON, so it is developer-authored — reaches
+* the regex engine as a pattern.
+*/
+/** Characters that carry meaning to the regex engine and must be neutralized. */
+const REGEX_METACHARACTERS = /[.*+?^${}()|[\]\\]/g;
+/**
+* Escape every regex metacharacter in a string so it matches itself.
+*
+* @param value - The literal text to match
+* @returns Regex source matching `value` verbatim
+*
+* @example
+* ```typescript
+* escapeRegex("(a+)+$"); // "\\(a\\+\\)\\+\\$"
+* ```
+*/
+function escapeRegex(value) {
+	return value.replace(REGEX_METACHARACTERS, "\\$&");
+}
+/**
+* Compile a `whereLike` pattern into regex source.
+*
+* The pattern is escaped first, so nothing the caller typed can act as a regex
+* operator; the SQL `LIKE` wildcard `%` is then translated to `.*` — the one
+* wildcard the API documents (`whereLike("email", "%@gmail.com")`). Runs of `%`
+* collapse into a single `.*`, since `%%%%…` compiles to nothing but extra
+* backtracking work.
+*
+* The result stays unanchored: MongoDB's `whereLike` matches a substring
+* (`whereLike("name", "ar")` finds "Carol"), which is the documented behavior of
+* this driver and is unchanged by the escaping.
+*
+* @param pattern - The user-supplied LIKE pattern
+* @returns Regex source matching the pattern literally, `%` aside
+*
+* @example
+* ```typescript
+* likePatternToRegexSource("%o'brien%"); // ".*o'brien.*"
+* likePatternToRegexSource("a.b");       // "a\\.b"  (a literal dot)
+* ```
+*/
+function likePatternToRegexSource(pattern) {
+	return escapeRegex(pattern).replace(/%+/g, ".*");
+}
+/**
+* Resolve a `whereLike`-style argument to regex source.
+*
+* An explicit `RegExp` is developer-authored and passes through as-is; a string
+* is user-shaped input and is treated as a literal LIKE pattern.
+*
+* @param pattern - A `RegExp` (trusted, used verbatim) or a string (escaped)
+* @returns Regex source ready for `$regex`
+*/
+function resolveLikePattern(pattern) {
+	return pattern instanceof RegExp ? pattern.source : likePatternToRegexSource(pattern);
+}
+
 //#endregion
 //#region ../cascade/src/drivers/mongodb/mongodb-query-parser.ts
 /**
@@ -10078,34 +10462,28 @@ var MongoQueryParser = class {
 				$gte: op.data.range[0],
 				$lte: op.data.range[1]
 			} } };
-			case "whereLike": {
-				const pattern = typeof op.data.pattern === "string" ? op.data.pattern : op.data.pattern.source;
-				return { [field]: {
-					$regex: pattern,
-					$options: "i"
-				} };
-			}
-			case "whereNotLike": {
-				const notPattern = typeof op.data.pattern === "string" ? op.data.pattern : op.data.pattern.source;
-				return { [field]: { $not: {
-					$regex: notPattern,
-					$options: "i"
-				} } };
-			}
+			case "whereLike": return { [field]: {
+				$regex: this.buildLikeRegexSource(op.data),
+				$options: "i"
+			} };
+			case "whereNotLike": return { [field]: { $not: {
+				$regex: this.buildLikeRegexSource(op.data),
+				$options: "i"
+			} } };
 			case "whereStartsWith": return { [field]: {
-				$regex: `^${op.data.value}`,
+				$regex: `^${escapeRegex(String(op.data.value))}`,
 				$options: "i"
 			} };
 			case "whereNotStartsWith": return { [field]: { $not: {
-				$regex: `^${op.data.value}`,
+				$regex: `^${escapeRegex(String(op.data.value))}`,
 				$options: "i"
 			} } };
 			case "whereEndsWith": return { [field]: {
-				$regex: `${op.data.value}$`,
+				$regex: `${escapeRegex(String(op.data.value))}$`,
 				$options: "i"
 			} };
 			case "whereNotEndsWith": return { [field]: { $not: {
-				$regex: `${op.data.value}$`,
+				$regex: `${escapeRegex(String(op.data.value))}$`,
 				$options: "i"
 			} } };
 			case "whereExists": return { [field]: { $exists: true } };
@@ -10139,7 +10517,7 @@ var MongoQueryParser = class {
 			case "whereFullText":
 			case "orWhereFullText": return { $text: { $search: op.data.query } };
 			case "whereSearch": return { [op.data.field]: {
-				$regex: op.data.query,
+				$regex: escapeRegex(String(op.data.query)),
 				$options: "i"
 			} };
 			case "where:not":
@@ -10158,6 +10536,22 @@ var MongoQueryParser = class {
 		}
 	}
 	/**
+	* Resolve the `$regex` source for a whereLike/whereNotLike operation.
+	*
+	* A `RegExp` argument is developer-authored and used verbatim; a string is
+	* treated as a literal LIKE pattern (`%` aside) so that search input cannot
+	* inject regex operators or a catastrophically backtracking pattern. The base
+	* (driver-agnostic) query builder flattens a `RegExp` to its source string and
+	* flags it with `isRegExp`, which is honored here for the same reason.
+	*
+	* @param data - The operation data (`{ pattern, isRegExp? }`)
+	* @returns Regex source for `$regex`
+	*/
+	buildLikeRegexSource(data) {
+		if (data.isRegExp === true && typeof data.pattern === "string") return data.pattern;
+		return resolveLikePattern(data.pattern);
+	}
+	/**
 	* Build a condition based on the operator.
 	*
 	* @param field - The field name
@@ -10192,11 +10586,32 @@ var MongoQueryParser = class {
 			"<=": "$lte"
 		}[operator] || "$eq";
 	}
-	resolveRawExpression(expression, bindings) {
-		if (typeof expression === "string") return { $where: this.bindRawString(expression, bindings) };
-		if (typeof expression === "object" && expression !== null) return expression;
+	resolveRawExpression(expression, _bindings) {
+		if (typeof expression === "string") throw new UnsafeRawExpressionError("whereRaw()/orWhereRaw() string expressions are not supported on the MongoDB driver: they would compile to a {$where: \"<js>\"} filter, which executes JavaScript on the database server. Use the object form instead, e.g. whereRaw({ $expr: { $gt: [\"$stock\", \"$reserved\"] } }).");
+		if (typeof expression === "object" && expression !== null) {
+			this.assertNoJsExecutionOperators(expression);
+			return expression;
+		}
 		return null;
 	}
+	/**
+	* The object form of whereRaw() is forwarded to MongoDB verbatim, so it must
+	* not smuggle in the operators that execute JavaScript inside mongod
+	* ($where, and $function/$accumulator which can nest under $expr).
+	* Aggregation operators like $expr/$gt remain valid — that is the object
+	* form's purpose.
+	*/
+	assertNoJsExecutionOperators(value) {
+		if (Array.isArray(value)) {
+			for (const item of value) this.assertNoJsExecutionOperators(item);
+			return;
+		}
+		if (typeof value !== "object" || value === null) return;
+		for (const [key, nested] of Object.entries(value)) {
+			if (key === "$where" || key === "$function" || key === "$accumulator") throw new UnsafeRawExpressionError(`whereRaw()/orWhereRaw() expressions must not contain "${key}": it executes JavaScript on the database server. Express the condition with query operators instead, e.g. whereRaw({ $expr: { $gt: ["$stock", "$reserved"] } }).`);
+			this.assertNoJsExecutionOperators(nested);
+		}
+	}
 	bindRawString(expression, bindings) {
 		if (!bindings || bindings.length === 0) return expression;
 		let index = 0;
@@ -11403,16 +11818,16 @@ var MongoQueryBuilder = class MongoQueryBuilder extends QueryBuilder {
 	*/
 	addWhereClause(prefix, args) {
 		if (args.length === 1) if (typeof args[0] === "function") this.operationsHelper.addMatchOperation(`${prefix}:callback`, args[0]);
-		else this.operationsHelper.addMatchOperation(`${prefix}:object`, args[0]);
+		else this.operationsHelper.addMatchOperation(`${prefix}:object`, sanitizeFilter(args[0]));
 		else if (args.length === 2) this.operationsHelper.addMatchOperation(prefix, {
 			field: args[0],
 			operator: "=",
-			value: args[1]
+			value: sanitizeFilterValue(args[1], String(args[0]))
 		});
 		else if (args.length === 3) this.operationsHelper.addMatchOperation(prefix, {
 			field: args[0],
 			operator: args[1],
-			value: args[2]
+			value: args[1] === "=" ? sanitizeFilterValue(args[2], String(args[0])) : args[2]
 		});
 	}
 	/**
@@ -22603,6 +23018,8 @@ exports.RelationLoader = RelationLoader;
 exports.SyncContextManager = SyncContextManager;
 exports.SyncManager = SyncManager;
 exports.TransactionRollbackError = TransactionRollbackError;
+exports.UnsafeFilterError = UnsafeFilterError;
+exports.UnsafeRawExpressionError = UnsafeRawExpressionError;
 exports.arrayBigInt = arrayBigInt;
 exports.arrayBoolean = arrayBoolean;
 exports.arrayDate = arrayDate;
@@ -22634,6 +23051,7 @@ exports.defineModel = defineModel;
 exports.double = double;
 exports.dropAllTables = dropAllTables;
 exports.enumCol = enumCol;
+exports.escapeRegex = escapeRegex;
 exports.exportMigrationsSQL = exportMigrationsSQL;
 exports.float = float;
 exports.freshMigrate = freshMigrate;
@@ -22649,6 +23067,7 @@ exports.isAggregateExpression = isAggregateExpression;
 exports.isColumnExpression = isColumnExpression;
 exports.isMongoDBDriverLoaded = isMongoDBDriverLoaded;
 exports.json = json;
+exports.likePatternToRegexSource = likePatternToRegexSource;
 exports.lineString = lineString;
 exports.listExecutedMigrations = listExecutedMigrations;
 exports.listPendingMigrations = listPendingMigrations;
@@ -22665,10 +23084,13 @@ exports.point = point;
 exports.polygon = polygon;
 exports.registerModelInRegistry = registerModelInRegistry;
 exports.removeModelFromRegistery = removeModelFromRegistery;
+exports.resolveLikePattern = resolveLikePattern;
 exports.resolveModelClass = resolveModelClass;
 exports.resolveModelName = resolveModelName;
 exports.rollbackMigrations = rollbackMigrations;
 exports.runMigrations = runMigrations;
+exports.sanitizeFilter = sanitizeFilter;
+exports.sanitizeFilterValue = sanitizeFilterValue;
 exports.setCol = setCol;
 exports.smallInt = smallInt;
 exports.smallInteger = smallInteger;