-
-
Notifications
You must be signed in to change notification settings - Fork 4k
Mixed fields cannot contain keys named __proto__ #16202
Copy link
Copy link
Open
Description
Prerequisites
- I have written a descriptive issue title
- I have searched existing issues to ensure the bug has not already been reported
Mongoose version
9.3.3
Node.js version
22.21.1
MongoDB server version
4.4.24
Typescript version (if applicable)
N/A
Description
Trying to save a property named __proto__ in a Mixed schema path doesn't save that property. It works when using the mongodb driver directly, so this seems to be a bug in Mongoose.
Steps to Reproduce
const MyModelSchema = new mongoose.Schema({
path1: mongoose.Schema.Types.Mixed
});
const MyModel = mongoose.model("MyModel", MyModelSchema);
const r1 = await MyModel.create({path1: {}});
const r2 = await MyModel.findOneAndUpdate({_id: r1._id}, {$set: {path1: {["__proto__"]: "abcd"}}}, {returnDocument: "after"});
console.log(r2); // r2.path1 is {}(Note: an object literal with ["__proto__"] as a computed key makes __proto__ an ordinary key; it does not set the prototype of the object.)
Expected Behavior
r2.path1 should be {["__proto__"]: "abcd"}
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels