mongoose 6.13.8 → 6.13.10

package/lib/document.js

@@ -58,6 +58,7 @@ let MongooseArray;
 let Embedded;
 
 const specialProperties = utils.specialProperties;
+const hasOwnProperty = utils.object.hasOwnProperty;
 
 /**
  * The core Mongoose document constructor. You should not call this directly,
@@ -1869,7 +1870,9 @@ Document.prototype.get = function(path, type, options) {
 
   // Fast path if we know we're just accessing top-level path on the document:
   // just get the schema path, avoid `$__path()` because that does string manipulation
-  let schema = noDottedPath ? this.$__schema.paths[path] : this.$__path(path);
+  let schema = noDottedPath ?
+    hasOwnProperty(this.$__schema.paths, path) ? this.$__schema.paths[path] : undefined :
+    this.$__path(path);
   if (schema == null) {
     schema = this.$__schema.virtualpath(path);
 
@@ -1879,7 +1882,7 @@ Document.prototype.get = function(path, type, options) {
   }
 
   if (noDottedPath) {
-    let obj = this._doc[path];
+    let obj = hasOwnProperty(this._doc, path) ? this._doc[path] : undefined;
     if (adhoc) {
       obj = adhoc.cast(obj);
     }
@@ -1906,6 +1909,10 @@ Document.prototype.get = function(path, type, options) {
   }
 
   for (let i = 0, l = pieces.length; i < l; i++) {
+    if (specialProperties.has(pieces[i])) {
+      return undefined;
+    }
+
     if (obj && obj._doc) {
       obj = obj._doc;
     }
@@ -1927,7 +1934,7 @@ Document.prototype.get = function(path, type, options) {
 
   if (schema != null && options.getters !== false) {
     obj = schema.applyGetters(obj, this);
-  } else if (this.$__schema.nested[path] && options.virtuals) {
+  } else if (hasOwnProperty(this.$__schema.nested, path) && options.virtuals) {
     // Might need to apply virtuals if this is a nested path
     return applyVirtuals(this, utils.clone(obj) || {}, { path: path });
   }

package/lib/helpers/query/sanitizeFilter.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const MongooseError = require('../../error/mongooseError');
 const hasDollarKeys = require('./hasDollarKeys');
 const { trustedSymbol } = require('./trusted');
 
@@ -17,12 +18,14 @@ module.exports = function sanitizeFilter(filter) {
   const filterKeys = Object.keys(filter);
   for (const key of filterKeys) {
     const value = filter[key];
-    if (value != null && value[trustedSymbol]) {
+    if (value && value[trustedSymbol]) {
       continue;
     }
-    if (key === '$and' || key === '$or') {
+    if (key === '$and' || key === '$or' || key === '$nor') {
       sanitizeFilter(value);
       continue;
+    } else if (key === '$jsonSchema' || key === '$where' || key === '$expr' || key === '$text') {
+      throw new MongooseError(key + ' is not allowed with sanitizeFilter');
     }
 
     if (hasDollarKeys(value)) {

package/lib/helpers/query/trusted.js

@@ -5,7 +5,7 @@ const trustedSymbol = Symbol('mongoose#trustedSymbol');
 exports.trustedSymbol = trustedSymbol;
 
 exports.trusted = function trusted(obj) {
-  if (obj == null || typeof obj !== 'object') {
+  if (obj == null || (typeof obj !== 'object' && typeof obj !== 'function')) {
     return obj;
   }
   obj[trustedSymbol] = true;

package/lib/schema.js

@@ -955,7 +955,7 @@ reserved.collection = 1;
 
 Schema.prototype.path = function(path, obj) {
   if (obj === undefined) {
-    if (this.paths[path] != null) {
+    if (Object.prototype.hasOwnProperty.call(this.paths, path)) {
       return this.paths[path];
     }
     // Convert to '.$' to check subpaths re: gh-6405
@@ -983,9 +983,15 @@ Schema.prototype.path = function(path, obj) {
       : undefined;
   }
 
+  const subpaths = path.indexOf('.') === -1 ? [path] : path.split('.');
+  const last = subpaths.pop();
+  if (utils.specialProperties.has(last)) {
+    throw new Error('Cannot set special property `' + last + '` on a schema');
+  }
+
   // some path names conflict with document methods
-  const firstPieceOfPath = path.split('.')[0];
-  if (reserved[firstPieceOfPath] && !this.options.supressReservedKeysWarning) {
+  const firstPieceOfPath = subpaths.length === 0 ? last : subpaths[0];
+  if (Object.prototype.hasOwnProperty.call(reserved, firstPieceOfPath) && !this.options.supressReservedKeysWarning) {
     const errorMessage = `\`${firstPieceOfPath}\` is a reserved schema pathname and may break some functionality. ` +
       'You are allowed to use it, but use at your own risk. ' +
       'To disable this warning pass `supressReservedKeysWarning` as a schema option.';
@@ -998,8 +1004,6 @@ Schema.prototype.path = function(path, obj) {
   }
 
   // update the tree
-  const subpaths = path.split(/\./);
-  const last = subpaths.pop();
   let branch = this.tree;
   let fullPath = '';
 
@@ -2589,7 +2593,7 @@ Schema.prototype._getPathType = function(path) {
           };
         }
         return { schema: foundschema, pathType: 'real' };
-      } else if (p === parts.length && schema.nested[trypath]) {
+      } else if (p === parts.length && Object.prototype.hasOwnProperty.call(schema.nested, trypath)) {
         return { schema: schema, pathType: 'nested' };
       }
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "6.13.8",
+  "version": "6.13.10",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",

package/scripts/tsc-diagnostics-check.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 
 const stdin = fs.readFileSync(0).toString('utf8');
-const maxInstantiations = isNaN(process.argv[2]) ? 100000 : parseInt(process.argv[2], 10);
+const maxInstantiations = isNaN(process.argv[2]) ? 110000 : parseInt(process.argv[2], 10);
 
 console.log(stdin);
 

package/types/expressions.d.ts

@@ -1150,6 +1150,21 @@ declare module 'mongoose' {
       $first: Expression;
     }
 
+    export interface FirstN {
+      /**
+       * $firstN can be used as an aggregation accumulator or array operator.
+       * As an aggregation accumulator, it returns an aggregation of the first n elements within a group.
+       * As an array operator, it returns the specified number of elements from the beginning of an array.
+       *
+       * @version 5.2
+       * @see https://www.mongodb.com/docs/manual/reference/operator/aggregation/firstN/#mongodb-expression-exp.-first
+       */
+      $firstN: {
+        input: Expression
+        n: Expression,
+      };
+    }
+
     export interface In {
       /**
        * Returns a boolean indicating whether a specified value is in an array.
@@ -1190,6 +1205,21 @@ declare module 'mongoose' {
       $last: Expression;
     }
 
+    export interface LastN {
+      /**
+       * $lastN can be used as an aggregation accumulator or array operator.
+       * As an aggregation accumulator, it an aggregation of the last n elements within a group.
+       * As an array operator, it returns the specified number of elements from the end of an array.
+       *
+       * @version 5.2
+       * @see https://www.mongodb.com/docs/manual/reference/operator/aggregation/lastN/#mongodb-group-grp.-lastN
+       */
+      $lastN: {
+        input: Expression
+        n: Expression,
+      };
+    }
+
     export interface LinearFill {
       /**
        * Fills null and missing fields in a window using linear interpolation based on surrounding field values.
@@ -2000,6 +2030,34 @@ declare module 'mongoose' {
       $avg: Expression;
     }
 
+    export interface Bottom {
+      /**
+       * Returns the bottom element within a group according to the specified sort order.
+       *
+       * @version 5.2
+       * @see https://www.mongodb.com/docs/manual/reference/operator/aggregation/bottom/#mongodb-group-grp.-bottom
+       */
+      $bottom: {
+        sortBy: AnyObject,
+        output: Expression
+      };
+    }
+
+    export interface BottomN {
+      /**
+       * Returns an aggregation of the bottom n elements within a group, according to the specified sort order.
+       * If the group contains fewer than n elements, $bottomN returns all elements in the group.
+       *
+       * @version 5.2
+       * @see https://www.mongodb.com/docs/manual/reference/operator/aggregation/bottomN/#mongodb-group-grp.-bottomN
+       */
+      $bottomN: {
+        n: Expression,
+        sortBy: AnyObject,
+        output: Expression
+      };
+    }
+
     export interface Count {
       /**
        * Returns the number of documents in a group.
@@ -2158,6 +2216,20 @@ declare module 'mongoose' {
       $max: Expression | Expression[];
     }
 
+    export interface MaxN {
+      /**
+       * Returns an aggregation of the maxmimum value n elements within a group.
+       * If the group contains fewer than n elements, $maxN returns all elements in the group.
+       *
+       * @version 5.2
+       * @see https://www.mongodb.com/docs/manual/reference/operator/aggregation/maxN/#mongodb-group-grp.-maxN
+       */
+      $maxN: {
+        input: Expression
+        n: Expression,
+      };
+    }
+
     export interface Min {
       /**
        * Returns the minimum value. $min compares both value and type, using the specified BSON comparison order for
@@ -2169,6 +2241,20 @@ declare module 'mongoose' {
       $min: Expression | Expression[];
     }
 
+    export interface MinN {
+      /**
+       * Returns an aggregation of the minimum value n elements within a group.
+       * If the group contains fewer than n elements, $minN returns all elements in the group.
+       *
+       * @version 5.2
+       * @see https://www.mongodb.com/docs/manual/reference/operator/aggregation/minN/#mongodb-group-grp.-minN
+       */
+      $minN: {
+        input: Expression
+        n: Expression,
+      };
+    }
+
     export interface Push {
       /**
        * Returns an array of all values that result from applying an expression to documents.
@@ -2605,6 +2691,8 @@ declare module 'mongoose' {
   export type ArrayExpressionOperatorReturningArray =
     Expression.ConcatArrays |
     Expression.Filter |
+    Expression.FirstN |
+    Expression.LastN |
     Expression.Map |
     Expression.ObjectToArray |
     Expression.Range |
@@ -2763,12 +2851,16 @@ declare module 'mongoose' {
     Expression.DocumentNumber |
     Expression.ExpMovingAvg |
     Expression.First |
+    Expression.FirstN |
     Expression.Integral |
     Expression.Last |
+    Expression.LastN |
     Expression.LinearFill |
     Expression.Locf |
     Expression.Max |
+    Expression.MaxN |
     Expression.Min |
+    Expression.MinN |
     Expression.Push |
     Expression.Rank |
     Expression.Shift |
@@ -2783,6 +2875,10 @@ declare module 'mongoose' {
 
   export type WindowOperatorReturningArray =
     Expression.AddToSet |
+    Expression.FirstN |
+    Expression.LastN |
+    Expression.MaxN |
+    Expression.MinN |
     Expression.Push;
 
   export type WindowOperatorReturningNumber =
@@ -2858,12 +2954,18 @@ declare module 'mongoose' {
     Expression.Accumulator |
     Expression.AddToSet |
     Expression.Avg |
+    Expression.Bottom |
+    Expression.BottomN |
     Expression.Count |
     Expression.First |
+    Expression.FirstN |
     Expression.Last |
+    Expression.LastN |
     Expression.Max |
+    Expression.MaxN |
     Expression.MergeObjects |
     Expression.Min |
+    Expression.MinN |
     Expression.Push |
     Expression.StdDevPop |
     Expression.StdDevSamp |