vanta-api 1.4.2 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanta-api",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Advanced API features and security configuration for Node.js/MongoDB.",
   "main": "index.js",
   "scripts": {

package/src/api-features.js

@@ -704,43 +704,50 @@ export class ApiFeatures {
     return out;
   }
 
-  _sanitizeFilters(filters = {}) {
-    const sanitizeNode = (node, key = "") => {
-      if (node === null || node === "null") return null;
-      if (node === "true") return true;
-      if (node === "false") return false;
+_sanitizeFilters(filters = {}) {
+  const sanitizeNode = (node, key = "") => {
+    if (
+      node instanceof mongoose.Types.ObjectId ||
+      node instanceof ObjectId
+    ) {
+      return node;
+    }
 
-      if (Array.isArray(node)) {
-        return node.map((item) => sanitizeNode(item, key));
-      }
+    if (node === null || node === "null") return null;
+    if (node === "true") return true;
+    if (node === "false") return false;
 
-      if (node && typeof node === "object") {
-        const result = {};
+    if (Array.isArray(node)) {
+      return node.map((item) => sanitizeNode(item, key));
+    }
 
-        for (const [childKey, childVal] of Object.entries(node)) {
-          result[childKey] = sanitizeNode(childVal, childKey);
-        }
+    if (node && typeof node === "object") {
+      const result = {};
 
-        return result;
+      for (const [childKey, childVal] of Object.entries(node)) {
+        result[childKey] = sanitizeNode(childVal, childKey);
       }
 
-      if (typeof node === "string") {
-        if (this.#isStrictObjectId(node) && this._shouldConvertToObjectId(key)) {
-          return new ObjectId(node);
-        }
+      return result;
+    }
 
-        if (/^[0-9]+$/.test(node)) {
-          return node.length > 1 && node.startsWith("0")
-            ? node
-            : parseInt(node, 10);
-        }
+    if (typeof node === "string") {
+      if (this.#isStrictObjectId(node) && this._shouldConvertToObjectId(key)) {
+        return new ObjectId(node);
       }
 
-      return node;
-    };
+      if (/^[0-9]+$/.test(node)) {
+        return node.length > 1 && node.startsWith("0")
+          ? node
+          : parseInt(node, 10);
+      }
+    }
 
-    return sanitizeNode(filters);
-  }
+    return node;
+  };
+
+  return sanitizeNode(filters);
+}
 
   _shouldConvertToObjectId(key = "") {
     const cleanKey = String(key).replace(/^\$/, "").toLowerCase();