Comments (20)
@vonagam thanks for this. I've took the updated version of filterQuery
method from feathers-sequelize and it looks like it was already fixed there. The fix is published in feathers-objection v2.0.1
from feathers-objection.
Hm... so you keep this method for convenience, to be comparable with feathers-sequelize
in migration paths?
Because there is no need for convertOperators
in feathers-objection
right now otherwise.
from feathers-objection.
Right. Feathers Crow release dictates security guidelines that were already implemented in most of the well-known Feathers DB adapters, including feathers-sequelize. Some of the recent updates in feathers-objection were simply synced from feathers-sequelize. All these DB adapters, including feathers-objection, are using the same test-suite from feathers that was released recently to test the new filtering functionalities.
from feathers-objection.
Ok. Got it.
(Just to be clear: Ran tests. Removed filterQuery
method, saw two failings. Fixed by reassignment of whitelist in options super(Object.assign({...}, options, {whitelist}))
here. All tests are passing.)
from feathers-objection.
$like
is in the whitelist operators list. it should not be added to the service options.
from feathers-objection.
Why not? options.whitelist
is for additionalOperators
in filterQuery
. And it is its only usage. And $like
is additional operator used in feathers-objection
.
from feathers-objection.
$like is not unique to feathers-objection and is part of the operators that are allowed now by default in feathers-sequelize. It shouldn't be different in feathers-objection.
from feathers-objection.
In feathers-objection
:
const filtered = super.filterQuery(params, { operators: this.whitelist })
In feathers-sequelize
:
const filtered = super.filterQuery(params);
So currently they have different behaviours.
In feathers-objection
all operators are allowed, and you can enable additional (like $eager
, which is really a filter), but you can't disable $like
operator for example.
In feathers-sequelize
all operators are allowed by default, but if you pass whitelist
option and it does not include $like
then $like
will not be allowed.
from feathers-objection.
Ok, you can simply remove filterQuery
and fix test to match feathers-sequelize's behaviour by adding $like
to this whitelist
.
Otherwise this test will fall, because $like
is used but not whitelisted.
from feathers-objection.
OK, thanks for that check.
from feathers-objection.
Sorry, no mistake, you can disable $like
in feathers-sequelize and can't in feathers-objection.
from feathers-objection.
:) ok, releasing a patch
from feathers-objection.
removing filterQuery method
from feathers-objection.
It's a breaking change, though, if you want to match sequelize behaviour.
from feathers-objection.
right, so minor version.
from feathers-objection.
I mean, that if somebody used { "whitelist": [ "$eager" ] }
and used $like
in queries. (Like in current tests) And you change behaviour to sequelize's. Then their code will fail (Like tests was). And then they have to add $like
towhitelist
(Like what you need to fix tests if you match sequelize).
So it is major version change.
from feathers-objection.
OK. It'll be 3.0.0
from feathers-objection.
Here is if you remove all unneeded stuff.
from feathers-objection.
Cool. removed all that too.
from feathers-objection.
published as 3.0.0
from feathers-objection.
Related Issues (20)
- Unknown database error: returning "id" - column "permissionId" of relation "users" does not exist
- How to write custom endpoint HOT 1
- _create() not fetching relations. Shouldn't it use insertGraphAndFetch() HOT 1
- support of feathers dove v5 HOT 2
- syntax for whereNotIn for mysql while building query in objection Js
- Examples of relations in the docs are wrong for TS HOT 2
- Getting error when using `_patch` method with `allowedUpsert` service option enabled. HOT 2
- skipUndefined() is deprecated and will be removed in objection 4.0 HOT 3
- Getting Ready for Feathers v5 Dove HOT 16
- Can I cast a field from the client side and have it reflected in the db query?
- Query parameters aren't used in create call
- $eager not working when _patch is called and allowedUpsert is configured
- Patch JSONB field
- $joinRelation adds select * to the query if groupBy is not in the query HOT 1
- REST query for a service with composite key returns an error in postman Incorrect syntax near ','
- Get the result of parsing the RelationExpression in _withGraph() from the hook context?
- Can the type of join be specified on either $joinRelation or $joinEager?
- is there any update on Adding the Support of feathers v5 for this library? HOT 2
- Can a select statement be constructed using "raw"?
- upsertGraphOptions unrelate HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from feathers-objection.