mongoose-query-parser - npm Package Compare versions

Comparing version 1.2.0 to 1.2.1

lib/index.d.ts

@@ -46,2 +46,3 @@ export interface ParserOptions {
     parseValue(value: string, key?: string): any;
+    private excludeFilterKeys;
     private castFilter;
@@ -48,0 +49,0 @@ private parseFilter;

lib/index.js

@@ -117,2 +117,15 @@ "use strict";
     };
+    MongooseQueryParser.prototype.excludeFilterKeys = function (obj, blacklist) {
+        for (var i in obj) {
+            if (!obj.hasOwnProperty(i))
+                continue;
+            if (typeof obj[i] == "object") {
+                this.excludeFilterKeys(obj[i], blacklist);
+            }
+            else if (blacklist.indexOf(i) !== -1) {
+                delete obj[i];
+            }
+        }
+        return _.isArray(obj) ? _.remove(obj, function (el) { return _.isEmpty(el); }) : obj;
+    };
     MongooseQueryParser.prototype.castFilter = function (filter, params) {
@@ -122,2 +135,4 @@ var _this = this;
         var parsedFilter = filter ? this.parseFilter(filter) : {};
+        // filter out blacklisted keys in JSON filter query
+        var subsetParsedFilter = this.excludeFilterKeys(parsedFilter, options.blacklist);
         return Object.keys(params)
@@ -155,3 +170,3 @@ .map(function (val) {
             return result;
-        }, parsedFilter);
+        }, subsetParsedFilter);
     };
@@ -158,0 +173,0 @@ MongooseQueryParser.prototype.parseFilter = function (filter) {

lib/test.spec.js

@@ -73,2 +73,29 @@ "use strict";
     };
+    Tester.prototype.parsedObjectBlacklistTest = function () {
+        var parser = new _1.MongooseQueryParser({ blacklist: ['apiKey'] });
+        var qry = {
+            filter: '{"apiKey":"e9117e5c-c405-489b-9c12-d9f398c7a112"}'
+        };
+        var parsed = parser.parse(qry);
+        chai_1.assert.exists(parsed.filter);
+        chai_1.assert.notExists(parsed.filter.apiKey);
+    };
+    Tester.prototype.jsonFilterBlcaklistTest = function () {
+        var options = { blacklist: ['key1', 'key3'] };
+        var parser = new _1.MongooseQueryParser(options);
+        var obj = {
+            $or: [
+                { key1: 'value1' },
+                { key2: { $in: ['key3', 'key2'] } },
+                { key3: 'value3' }
+            ]
+        };
+        var qry = "filter=" + JSON.stringify(obj) + "&name=Google";
+        var parsed = parser.parse(qry);
+        chai_1.assert.isArray(parsed.filter['$or']);
+        chai_1.assert.isOk(parsed.filter['name'] === 'Google');
+        chai_1.assert.isNotOk(parsed.filter['$or'].some(function (obj) {
+            options.blacklist.forEach(function (key) { return obj.hasOwnProperty(key); });
+        }));
+    };
     Tester.prototype.customDateFormatParse = function () {
@@ -186,2 +213,14 @@ var parser = new _1.MongooseQueryParser({ dateFormat: ['yyyyMMdd', 'yyyy-MM-dd'] });
     __decorate([
+        mocha_1.test('should not show black listed property in parsed object filter query'),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", void 0)
+    ], Tester.prototype, "parsedObjectBlacklistTest", null);
+    __decorate([
+        mocha_1.test('should not show black listed property in JSON filter query'),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", void 0)
+    ], Tester.prototype, "jsonFilterBlcaklistTest", null);
+    __decorate([
         mocha_1.test('should parse dates with custom formats'),
@@ -188,0 +227,0 @@ __metadata("design:type", Function),

package.json

 {
   "name": "mongoose-query-parser",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Convert url query string to MongooseJs friendly query object including advanced filtering, sorting, population, string template, type casting and many more...",
@@ -5,0 +5,0 @@ "main": "./lib/index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

48750

increased by5.43%

Lines of code

871

increased by6.74%

No dependency changes