mongoose 6.13.9 → 6.13.11

package/lib/document.js

@@ -58,6 +58,7 @@ let MongooseArray;
 let Embedded;
 
 const specialProperties = utils.specialProperties;
+const hasOwnProperty = utils.object.hasOwnProperty;
 
 /**
  * The core Mongoose document constructor. You should not call this directly,
@@ -1869,7 +1870,9 @@ Document.prototype.get = function(path, type, options) {
 
   // Fast path if we know we're just accessing top-level path on the document:
   // just get the schema path, avoid `$__path()` because that does string manipulation
-  let schema = noDottedPath ? this.$__schema.paths[path] : this.$__path(path);
+  let schema = noDottedPath ?
+    hasOwnProperty(this.$__schema.paths, path) ? this.$__schema.paths[path] : undefined :
+    this.$__path(path);
   if (schema == null) {
     schema = this.$__schema.virtualpath(path);
 
@@ -1879,7 +1882,7 @@ Document.prototype.get = function(path, type, options) {
   }
 
   if (noDottedPath) {
-    let obj = this._doc[path];
+    let obj = hasOwnProperty(this._doc, path) ? this._doc[path] : undefined;
     if (adhoc) {
       obj = adhoc.cast(obj);
     }
@@ -1906,6 +1909,10 @@ Document.prototype.get = function(path, type, options) {
   }
 
   for (let i = 0, l = pieces.length; i < l; i++) {
+    if (specialProperties.has(pieces[i])) {
+      return undefined;
+    }
+
     if (obj && obj._doc) {
       obj = obj._doc;
     }
@@ -1927,7 +1934,7 @@ Document.prototype.get = function(path, type, options) {
 
   if (schema != null && options.getters !== false) {
     obj = schema.applyGetters(obj, this);
-  } else if (this.$__schema.nested[path] && options.virtuals) {
+  } else if (hasOwnProperty(this.$__schema.nested, path) && options.virtuals) {
     // Might need to apply virtuals if this is a nested path
     return applyVirtuals(this, utils.clone(obj) || {}, { path: path });
   }

package/lib/query.js

@@ -2639,9 +2639,11 @@ Query.prototype.findOne = function(conditions, projection, options, callback) {
 
 Query.prototype._count = wrapThunk(function(callback) {
   try {
-    this.cast(this.model);
+    this._castConditions();
   } catch (err) {
-    this.error(err);
+    // `_castConditions()` reports cast errors on the query, but `sanitizeFilter`
+    // throws for filters it refuses outright, like `$where`.
+    return callback(err);
   }
 
   if (this.error()) {
@@ -2667,9 +2669,11 @@ Query.prototype._count = wrapThunk(function(callback) {
 
 Query.prototype._countDocuments = wrapThunk(function(callback) {
   try {
-    this.cast(this.model);
+    this._castConditions();
   } catch (err) {
-    this.error(err);
+    // `_castConditions()` reports cast errors on the query, but `sanitizeFilter`
+    // throws for filters it refuses outright, like `$where`.
+    return callback(err);
   }
 
   if (this.error()) {
@@ -5485,11 +5489,17 @@ Query.prototype.cursor = function cursor(opts) {
 
   const options = this._optionsForExec();
   try {
-    this.cast(this.model);
+    this._castConditions();
   } catch (err) {
+    // `_castConditions()` reports cast errors on the query, but `sanitizeFilter`
+    // throws for filters it refuses outright, like `$where`.
     return (new QueryCursor(this, options))._markError(err);
   }
 
+  if (this.error()) {
+    return (new QueryCursor(this, options))._markError(this.error());
+  }
+
   return new QueryCursor(this, options);
 };
 

package/lib/schema.js

@@ -955,7 +955,7 @@ reserved.collection = 1;
 
 Schema.prototype.path = function(path, obj) {
   if (obj === undefined) {
-    if (this.paths[path] != null) {
+    if (Object.prototype.hasOwnProperty.call(this.paths, path)) {
       return this.paths[path];
     }
     // Convert to '.$' to check subpaths re: gh-6405
@@ -983,9 +983,15 @@ Schema.prototype.path = function(path, obj) {
       : undefined;
   }
 
+  const subpaths = path.indexOf('.') === -1 ? [path] : path.split('.');
+  const last = subpaths.pop();
+  if (utils.specialProperties.has(last)) {
+    throw new Error('Cannot set special property `' + last + '` on a schema');
+  }
+
   // some path names conflict with document methods
-  const firstPieceOfPath = path.split('.')[0];
-  if (reserved[firstPieceOfPath] && !this.options.supressReservedKeysWarning) {
+  const firstPieceOfPath = subpaths.length === 0 ? last : subpaths[0];
+  if (Object.prototype.hasOwnProperty.call(reserved, firstPieceOfPath) && !this.options.supressReservedKeysWarning) {
     const errorMessage = `\`${firstPieceOfPath}\` is a reserved schema pathname and may break some functionality. ` +
       'You are allowed to use it, but use at your own risk. ' +
       'To disable this warning pass `supressReservedKeysWarning` as a schema option.';
@@ -998,8 +1004,6 @@ Schema.prototype.path = function(path, obj) {
   }
 
   // update the tree
-  const subpaths = path.split(/\./);
-  const last = subpaths.pop();
   let branch = this.tree;
   let fullPath = '';
 
@@ -2589,7 +2593,7 @@ Schema.prototype._getPathType = function(path) {
           };
         }
         return { schema: foundschema, pathType: 'real' };
-      } else if (p === parts.length && schema.nested[trypath]) {
+      } else if (p === parts.length && Object.prototype.hasOwnProperty.call(schema.nested, trypath)) {
         return { schema: schema, pathType: 'nested' };
       }
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mongoose",
   "description": "Mongoose MongoDB ODM",
-  "version": "6.13.9",
+  "version": "6.13.11",
   "author": "Guillermo Rauch <guillermo@learnboost.com>",
   "keywords": [
     "mongodb",

package/.claude/settings.local.json

@@ -1,7 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "mcp__acp__Bash"
-    ]
-  }
-}

package/startmdb.mjs

@@ -1,19 +0,0 @@
-import { MongoMemoryReplSet } from 'mongodb-memory-server';
-
-const replSet = await MongoMemoryReplSet.create({
-  binary: {
-    systemBinary: '/home/v/libs/mongodb-linux-x86_64-enterprise-ubuntu2404-8.2.0/bin/mongod'
-  },
-  instanceOpts: [
-    {
-      port: 27017
-    }
-  ],
-  replSet: {
-    storageEngine: 'inMemory',
-    count: 1
-  }
-});
-
-const uri = replSet.getUri();
-console.log(uri);